Troubleshooting Backuppc problems

My environment: Ubuntu 12.04 + BackupPC 3.2.1
Xfer Method: Rsync + SSH

Log file location: /var/lib/backuppc/log/LOG
Host per log: TOPDIR/pc/$host/LOG

Mine is: /data/backuppc/pc/$host/LOG


The easiest way to debug backup problems on a specific host is to run BackupPC_dump manually as the BackupPC user. This is the most important thing, run it at first to detect the source of problem

/usr/share/backuppc/bin/BackupPC_dump -v -f remote_host.vn > remote_host.log

http://backuppc.sourceforge.net/faq/

Common Backuppc Problem

Backuppc user in Visudo group of Remote host. But when the Server start sudo script it return this error

sudo: no tty present and no askpass program specified

In remote host:

visudobackuppc ALL=(root) NOPASSWD: /usr/bin/rsync, /bin/tar

In Backuppc Server
add -t option to ssh

DumpPreUserCmd  $sshPath -t -q -x -l backuppc $host /usr/bin/sudo /usr/local/bin/rsync_script.sh

no ping response

backuppc work only if it can ping the remote host, if it can not ping, you have to check your

• Network connection to remote host
• Firewall rules / Polices

If you can ping from backuppc console, it mean backppc ping configuration went wrong:

$Conf{Ping6Path} is not set by default in 3.2.1. The solution is easy. Set this in /etc/backuppc/config.pl

$Conf{Ping6Path} = '/bin/ping6';

If ping also not work -> try Echo (Solution from SysadminWorld.com)

In the BackupPC webinterface, click the client host name, Edit Config, go to the Backup Settings and change the setting PingCmd ($pingPath -c 1 $host by default) to/bin/echo

Don’t forget to check override and click the Save button to apply the change.

http://www.sysadminworld.com/2012/no-ping-response/#comment-59434

Use of qw(…) as parentheses is deprecated

Use of qw(...) as parentheses is deprecated at /usr/share/backuppc/lib/BackupPC/Storage/Text.pm line 302.
Use of qw(...) as parentheses is deprecated at /usr/share/backuppc/lib/BackupPC/Lib.pm line 1425.

apply one-liner patch from www.tolaris.com

wget -q http://www.tolaris.com/blog/wp-content/uploads/2012/05/BackupPC-3.2.1-CVE-2011-170886.diff -O- | patch -p0 -N -r - -d /usr/share/backuppc/

BackupPC displays bogus “Last email sent” messages

BackupPC will send error message emails to the administrator or user of a host (backup target) if it cannot reach the host for a set period of time. The user interface always displays this last message, even if it doesn’t exist:

Last email sent to user@example.com was at 2012-05-01 01:23, subject “”.

apply one-liner patch from www.tolaris.com

wget -q http://www.tolaris.com/blog/wp-content/uploads/2012/05/BackupPC-3.2.1-no_blank_email.diff -O- | patch -p0 -N -r - -d /usr/share/backuppc/

Got fatal error during xfer (aborted by signal=PIPE)

This is the most common Backuppc error message. It can be:

Your remote script execution (Xfer script, DumpPreUserCmd, DumpPostUserCmd): it depend on which user running the script, permission to run that script, status of the script, result of the script. Make sure you run the script successfully on the console of that host as backuppc user first , then try run the script remotely on Backuppc Server console for example:

ssh -t -c blowfish -q -x -l backuppc remote_server.vn /usr/bin/sudo /usr/local/bin/rsync_script.sh

Your remote location: Check your RsyncShareName in Host Xfer setting carefully. Make sure the directory you specify are exsits and backuppc have permssion to read it, do not add any extra blank line in RsysncShareName

Timeout: possibly the remote script take long time to return. Here is a work around
Try adding -o ServerAliveInterval=300 into RsyncClientRestoreCmd, RsyncClientCmd, DumpPreUserCmd, DumpPostUserCmd

$sshPath -c blowfish -o ServerAliveInterval=300 -q -x -l backuppc $host $rsyncPath $argList+

Backuppc wrong setting: make sure you don't have any typo mistakes on any fields, select the right xfer method.

Resouces on both host while running backup: RAM, CPU, DISK, Network...Any bottle neck?

Turn on Verbose

XferLogLevel=9, RsyncArgs -vv

Waiting for your comment :D 

Read More

Setup Backuppc Client

On Remote Server

Add backuppc user

adduser backuppc
passwd backuppc
su - backuppc

From root run visudo to update sudoer

backuppc ALL=(ALL:ALL) NOPASSWD: /usr/bin/rsync, /bin/tar

Optional:

chmod 755 /home/backuppc/.ssh
chmod 600 /home/backuppc/.ssh/authorized_keys

On BackupPC server

Copy Public key from BackupPC server to remote host for passwordless login

ssh-copy-id backuppc@Remote_Host
ssh -c blowfish -q -x -l backuppc Remote_Host hostname

if it successfully return the remote hostname, we ready to add remote host to Backuppc Web Dashboard

http://mydomain.vn/backuppc -> Edit Config -> Host -> Add Host: Hostname, User: backuppc

Configure transfer method

Select the remote hostname from the list of Host

http://mydomain.vn/backuppc/index.cgi?host=Remote_Host -> Edit Config -> Xfer

XferMethod: Rsync 

RsyncShareName: /var/www

Replace root user (after -q -x -l) with backuppc in RsyncClientCmd, RsyncClientRestoreCmd

Leave Schedule as default

Read More

Restore a Windows Server 2008 RC2 from VMWare VDX file

I have to investigate one of the Domain Controller running Windows Server 2008 RC2 from a Backup VMware folder that contain VDX file. This is a snapshot of running Server from last month from other remote backup Datastore.

Restore a Cloned Virtual Machine

In VCenter go to the Datastore that contain VDX file
Right Click VDX file and register VM with different than the running one. EX: SrvrRecovery
After that change the Datastore from backup to our production Datastore
Now when you fire up the Machine it will have a lot of problem because the disk is Write Protected, Hidden and it has Nodefault Driver Letter so the Boot Procedure will fail. To overcome that

Change the value of the disk.EnableUUID parameter to False: Vcenter -> Host -> SrvrRecovery (PowerOFF) -> Actions -> Edit Settings -> VM Options -> Advanced -> Configuration Parameters -> Edit Configuration -> disk.EnableUUID-> False

Ajust booting flags on Primary Boot Partition

VCenter -> SrvrRecoveryPowerON -> Connect Windows Server 2008 RC2 .iso and boot into it.

Optional: change your network card to other place or temporary disable 

When Host bootup -> Esc -> Boot from CD -> Choose Repair your computer -> Select Command Prompt Option.

diskpart
list volume
select volume 1
attributes volume
attributes volume clear nodefaultdriveletter
attributes volume clear hidden
attributes volume clear readonly
exit

Rebuild Boot Configuration Data

In command Prompt 

bootrec /rebuildbcd
type Y (yes)
exit

After it complete successfully exit the prompt and restart the server 

Yeah man! the Virtual server is coming back

Reference:

https://neosmart.net/wiki/winload-exe-missing-corrupt

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2004505

http://www.online-tech-tips.com/computer-tips/fix-media-is-write-protected-in-windows-7/

Read More

Vyatta - Enable WebSafe search for entire School

My School's ICT director want to block all adult content from Search result (almost google). Here's how from google, there are 3 options:
1st option turn on safesearch which require a google account on every Chrome
2nd option require Chrome book
3rd Option which work for entire network without edit every single machine -> I go this way ^^

With our school infrastructure in place: Vyatta black box outside the border and local DNS server
Step1: redirect all https://www.google.com https://www.google.com.vn -> http://nosslsearch.google.com
Because google turn on https by default so all the content was encrypted so that it cannot be filtered out, I have to redirect the search result to other nosslsearch which also provide by Google.
In our DNS server which running Windows Server 2008 RC2 (I hate them but it were there before I come :D )  -> create 2 Primary DNS zones www.google.com, www.google.com.vn
Add a CNAME record: leave the alias name as blank, add FQDN nosslsearch.google.com. as target host
Right Click on the DNS server -> Clear Cache
==> All the request to https://www.google.com will come to http://www.google.com which will not affect any other Google product require ssl (drive, gmail, plus...)

Step2: append &safe=active directly to all search URLs which happening on Vyatta black box.

configure
set service webproxy url-filtering squidguard enable-safe-search
commit
save

enable-safe-search: turn on safe search for almost search engine

The final result: when I search Sex on my search box

http://www.google.com.vn/search?q=sex&safe=active&hl=en&noj=1&source=lnms&tbm=isch&sa=X&ei=SrOWU_muPNHp8AX0y4CIAQ&ved=0CAgQ_AUoAQ&biw=1366&bih=638

The result I always dislike but it good for the kid :D

Read More

Ubuntu Network Manager cannot connect to WPA2/PEAP/MSCHAPv2 network without CA_Certificate

Quick way to fix all the Wireless network that require Certificate, you don't have to provide your certificate.
Use incrontab to pull the trigger automatically when you connect to Wireless network that require Certificate, the script will add a mozilla External Root Certificate when your Network Manager create Wireless SSiD connection on /etc/NetworkManager/system-connections/

sudo -i
incrontab -e
/etc/NetworkManager/system-connections/ IN_CREATE sleep 3; grep -rl 'system-ca-certs=true' /etc/NetworkManager/system-connections/ | xargs sed -i '/system-ca-certs=true/a ca-cert=/usr/share/ca-certificates/mozila/AddTrust_External_Root.crt'

Read More

Customize default desktop environment settings for Gnome-centric Linux distributions

Some of you are probably wondering why would you want to spend your time fiddling with default desktop environment settings customization, when you can easily customize everything to your liking inside you own user account? Most probably you'd want to do this when you're re-mastering your favorite Linux distribution using tools like OS4 system imager (fork of the now discontinued Remastersys) or Relinux. In this article I'll show you how to handle this task elegantly using GSettings vendor overrides.

Introduction

First some background. GSettings provides a convenient API for storing and retrieving application settings, similar to system registry inside one of the popular proprietary operating system. Applications can define key/value pairs their application is using by installing .gschema.xml files, and then use GSettings API to manipulate the values. GSettings also provides mechanisms for distribution vendors to override default key/value pairs for specific applications by using .gschema.override files.

Pick the right schema file

First thing we need to do is picking the key/value pair which controls the setting whose defaults we want to modify. We do this using command line tools like "gsettings list-schemas" or "gsettings list-recursively" or using GUI tools like "dconf-editor". For the sake of simplicity and to better illustrate this process, in this article I'll use dconf-editor. On a Debian based distributions like Ubuntu we will find dconf-editor inside dconf-tools package:

sudo apt-get install dconf-tools

Now that we have all the tools lets imagine we want to change default fonts our Gnome-centric desktop environment like Gnome 3, Unity or Cinnamon is using. Using dconf-editor we can edit settings for current user account, but most importantly find GSettings schemas and key/value pairs we're interested in:

org.gnome.desktop.interface

• font-name
• document-font-name
• monospace-font-name

org.gnome.desktop.wm.preferences

• titlebar-font

Here's screenshot displaying one section of org.gnome.desktop.interface schema inside dconf-editor:

Create .gschema.override file

Now when we have all of the information we can use our favorite editor to create the .gschema.override file:

sudo nano /usr/share/glib-2.0/schemas/60_our-own.gschema.override

The 60 is override priority, here I usually use 60 because most Linux distribution vendors use priority of 50 or less. Now we place following inside that file:

[org.gnome.desktop.interface]font-name='Ubuntu 12' document-font-name='Sans 12' monospace-font-name='Ubuntu Mono 14' 
[org.gnome.desktop.wm.preferences] titlebar-font='Ubuntu Bold 12'

We exit and save using Ctrl^X and then compile GSettings schemas to reflect our changes like this:

sudo glib-compile-schemas /usr/share/glib-2.0/schemas/

After system restart desktop environment for all new users and existing users who haven't changed desktop environment fonts will use fonts we have specified inside our .gschema.override file. This way we can easily tweak almost every aspect of our desktop environment interface, and in the end easily create our own flavor of the Linux distro using remastersys-like tools. That's what I call flexible operating system, don't you agree?

http://www.techytalk.info/customize-default-desktop-environment-settings-gnome-centric-linux-distributions/

How I customize My Cinnamon

gsettings set org.cinnamon.desktop.background picture-uri file:///usr/share/backgrounds/myWallpaper.jpg
gsettings set org.cinnamon.desktop.background picture-options stretched
gsettings set org.cinnamon.settings-daemon.peripherals.touchpad disable-while-typing true
gsettings set org.cinnamon.settings-daemon.peripherals.touchpad motion-acceleration 2
gsettings set org.cinnamon.settings-daemon.peripherals.touchpad motion-threshold 2
gsettings set org.cinnamon.settings-daemon.peripherals.touchpad scroll-method two-finger-scrolling
gsettings set org.cinnamon.settings-daemon.peripherals.touchpad tap-to-click true
gsettings set org.cinnamon.settings-daemon.peripherals.touchpad touchpad-enabled true

How to add your shorcut to Cinnamon

http://askubuntu.com/questions/232053/how-to-add-a-shortcut-to-a-command-to-the-cinnamon-menu

Read More

How to sync Windows folder to Ubuntu permanent

apt-get install cifs-utils

Mounting unprotected (guest) network folders

sudo mkdir /media/windowsshare

Then edit your /etc/fstab file (with root privileges) to add this line:

//servername/sharename /media/windowsshare cifs guest,uid=1000,iocharset=utf8 0 0

guest indicates you don't need a password to access the share,
uid=1000 makes the Linux user specified by the id the owner of the mounted share, allowing them to rename files,
iocharset=utf8 allows access to files with names in non-English languages. This doesn't work with shares of devices like the Buffalo Tera Station, or Windows machines that export their shares using ISO8895-15.

If there is any space in the server path, you need to replace it by \040, for example

//servername/My\040Documents

After you add the entry to /etc/fstab type:

sudo mount -a

Mount password protected network folders

The quickest way to auto-mounting a password-protected share is to edit /etc/fstab (with root privileges), to add this line:

//servername/sharename /media/windowsshare cifs username=msusername,password=mspassword,iocharset=utf8,sec=ntlm 0 0

This is not a good idea however: /etc/fstab is readable by everyone and so is your Windows password in it. The way around this is to use a credentials file. This is a file that contains just the username and password.

Using a text editor, create a file for your remote servers logon credential:

vi ~/.smbcredentials

Enter your Windows username and password in the file:

username=msusername
password=mspassword

Change the permissions of the file to prevent unwanted access to your credentials:

chmod 600 ~/.smbcredentials

Then edit your /etc/fstab file (with root privileges) to add this line (replacing the insecure line in the example above, if you added it):

//servername/sharename /media/windowsshare cifs credentials=/home/ubuntuusername/.smbcredentials,iocharset=utf8,sec=ntlm 0 0

Save the file, exit the editor. Finally, test the fstab entry by issuing:

sudo mount -a

If there are no errors, you should test how it works after a reboot. Your remote share should mount automatically.

Special permissions

If you need special permission (like chmod etc.), you'll need to add a uid (short for 'user id') or gid (for 'group id') parameter to the share's mount options.

//servername/sharename /media/windowsshare cifs uid=ubuntuuser,credentials=/home/ubuntuuser/.smbcredentials,iocharset=utf8,sec=ntlm 0 0

Sync Localdir with Sharedir

rsync -avz /media/windowsshare/ /var/www/app/img/

Sync every 5 minutes

su - www-data
crontab -e
* 5 * * * rsync -avz /media/windowsshare/ /var/www/app/img/ > /dev/null 2>&1

https://wiki.ubuntu.com/MountWindowsSharesPermanently

http://www.techpository.com/?page_id=1741

Read More

How does all this work? HTTPS, SSL, certificates, CA, public and private keys, CSRs?

http://wpengine.com/support/how-does-all-this-work-https-ssl-certificates-ca-public-and-private-keys-csrs/

HTTPS, SSL, certificates, and all the other bits and pieces of browser security is complicated, and it’s hard to get a simple, clear explanation of what it means and what to do. Hopefully this will help.

CAVEAT

This description intentionally omits various details and exceptions. The purpose is to give a non-technical user a clear picture of how all this stuff works. Extra complexity would just cloud this clarity. Use references like Wikipedia and security books for completely precise information.

HTTPS AND SSL

SSL stands for Secure Socket Layer, and it’s a protocol that does two things:

• Encrypts your data, which means no hacker can see what your browser sends to the server nor what the server sends to the browser.
• Authenticates your website, which means it tells your browser “This website really is who it claims to be.” For example, that when you type your username and password into your PayPal account, that the website really is PayPal, and not a hacker posing as PayPal.

HTTPS just means “HTTP with SSL.” Just as “http://” means “this is a website,” seeing “https://” means “this is a website, and it’s using SSL to encrypt data and authenticate the website.

So when you want a “secure website,” i.e. a website with https, you’re saying you want us to support the SSL protocol. It turns out the encryption part of that protocol we can handle completely automatically for you, but the authentication part is a lot trickier. So the rest of this will be about authentication.

CERTIFICATES

A Certificate is a document that your website shows a browser to proclaim its identity. It “certifies” that the website is who it says it is.

It includes web-stuff like your domain name (e.g. “paypal.com”) and also identification-stuff like your company’s name, address, phone number, and so forth. Some certificates provide more information than others, but this is the general idea.

Simple enough, but the trouble is it’s not authentication. Because: Although PayPal provides a certificate identifying themselves as PayPal, a hacker could just as easily provide that same certificate to the web browser! How does the browser know that this certificate is to be trusted?

CA stands for “Certificate Authority,” and it’s a company who will verify for the browser that a particular website’s certificate can in fact be trusted. All browsers come pre-loaded with special security files listing dozens of CAs whose opinion it will trust.

So it’s not enough that your website provides a certificate, it needs to be a certificate that has been certified by a CA. This is called a Signed Certificate, because the CA has “signed their name” to your certificate so that the browser will trust it.

To get a signed certificate you first need to select a CA. There are literally dozens of CAs; some examples you might have heard of are GoDaddy, Verisign, but if you search on Google you’ll find a zillion of them. Prices range from $50 to $5000 depending on lots of factors. You’ll need to consult with your CA or a technical consultant to decide what’s right for you since there’s lots of details and trade-offs.

Next you’ll need to generate other documents which you provide to the CA in order for them to process and issue your precious signed certificate. I know, like Alice and Wonderland you’re going further down the rabbit hole…

PUBLIC AND PRIVATE KEYS

A Private Key is a secret password that your website keeps and which you never ever ever let anyone have access to except your hosting company and your CA. Unlike your email password, this password is really long, typically 1024 characters or more. That’s a good thing — a human being never needs to read it, only machines, so it’s good to have something so massive that it really is literally impossible for anyone to guess it.

The private key is a required component of SSL because it’s part of how it does the encryption part of its job. It’s also a required component of the certificate and the CA’s approval, because what you’re really saying is this:

“This secret, private key XYZ is something that only me, the real website, knows. So I want you, the CA, to verify to him, the browser, that this certificate (my identity) is one and the same with this private key. So then when I use that private key to send encrypted stuff to the browser, the browser will be certain I’m who I say I am, and we’re in business.”

But wait — if you use the private key to encrypt data, doesn’t that mean the browser needs that same private key to decrypt the data? And then the private key isn’t a secret anymore! Don’t worry, that’s not how it works. It’s like this:

When your security tool creates one of these special private keys it also creates a corresponding, matching Public Key. This is a different password, but also really long, like 1024 characters. The public and private keys are a pair with the following very useful feature:

Data encrypted with the private key can only be decrypted with the public key. (And vice versa.)

So here’s how this all gets put together:

Your website keeps the private key secret, and encrypts everything with that key. The public key is placed inside that certificate as yet another part of your website’s identity, just like your domain name and phone number. When the CA certifies your certificate, it’s telling the browser, “Yes this is the real-life identity of this website, and furthermore that’s the public key of this website, so you can trust anything that you can decrypt with that public key.”

Since only the private key can encrypt stuff for that particular public key, only you, the real website could be talking to that browser, providing that certificate, and that’s how the browser knows you’re actually you.

It’s also why you need to keep that private key secret. It’s also why you will need to give that private key to us, your hosting provider, because we’ll need it to encrypt data coming from your website.

Now there’s only one more thing you’ll need to get this friggin’ certificate certified by the friggin’ CA:

CSR stands for Certificate Signing Request, and it’s the official document you give to a CA asking them to “sign” your certificate, thus finally getting you that “signed certificate.”

The CSR essentially just combined all the stuff we just discussed — the public key, the certificate you want signed, etc — in a standard format. There are security tools which generate CSRs depending on what fields you need to fill out and using your keys.

It’s a common mistake to think the CSR is the same thing as a signed certificate, but as you can see that’s not at all the case. The CSR is literally a request, not a signed certificate. Only a CA can provide you with a signed certificate.

GETTING IT ALL LIVE AND WORKING

To host your HTTPS-powered website, we’ll need two things:

• Your private key (so we can encrypt data)
• Your signed certificate (so we can provide that to browsers)

We don’t need your public key, CSR, or any other things you might have generated along the way.

You can purchase and configure an SSL Certificate in the User Portal by following this guide.Please note, we only offer SSL on our Professional and above Plans.

CHAINED CERTIFICATES (NEEDED ONLY SOMETIMES)

About 10% of the time your CA will require you to use something called a Chained Certificate. If that’s not the case for you, you can skip this section.

Here’s why this happens: Remember the web browser has a list of CAs which the web browser trusts. Now suppose you used a CA which was not in that list. The browser won’t accept your certificate because, although it’s signed, it’s signed by a CA which in turn the browser has no reason to trust! This unknown CA could just as easily be a hacker.

To get around this, your CA will provide you with another certificate that says “I’m a CA you should trust, and look, I got this other CA to certify that I’m a trustable CA, and you do already trust that CA.”

In short, your CA passes the buck to a trusted CA, therefore creating a “trust chain.” The browser trusts your website because your CA says so, and it trusts your CA because another CA says so, etc., until we get to a CA the browser trusts implicitly because it’s in that “official list of trusted CAs.”

If this is the case for you, that’s fine! We just need you to send us that additional certificate so we can provide the complete chain to the browser. Your CA will be able to give you that document.

DEDICATED IP’s

You can only have a dedicated IP provisioned for your site if you have an SSL certificate. You have to have the SSL certificate first before we make the request to get the dedicated IP for your site.

Read More

Apple Server - OpenDirectory intergrate with ActiveDirectory

I drove myself crazy reading a lot of people set up their Triangles called Dual Directory, Golden Triangle, Magic Triangle... But you will clearly understand how it all work with this image below from MacSysadmin Magazine.

Clients still use Active Directory for user authentication, while Open Directory supplies Managed Preferences only.

Every Profile Manager instance is an Open Directory Master. Apple has included a local group in Mac OS X Server called Profile Manager ACL. Users and groups from any directory domain that can be viewed in dscl can be added to this group. Adding objects to this group enables them to authenticate to the MyDevices portal but not administrate. Kerberos isn’t really used here, nor are nested groups. You’ll apply policies directly to Active Directory groups in Profile Manager.

Start by enabling directory services debug logging:

odutil set log debug

disable the debug logging:

odutil set log default

Now when you attempt to join Active Directory, you can look at the log at /var/log/opendirectoryd.log to see what’s occurring.

To disable encryption:

/usr/sbin/dsconfigad -packetencrypt disable

To reenable encryption:

/usr/sbin/dsconfigad -packetencrypt allow

When capturing traffic for the following ports:

UDP 53 - DNS
TCP 88 - Kerberos
TCP 389 - LDAP
TCP/UDP 464 - Kerberos Password Changes (KPasswd)
TCP 3268 - Global Catalog (LDAP)

To capture traffic over the built-in Ethernet connection to a file called “capture.out,” you could use the following syntax for tcpdump

tcpdump –K -i en0 -s 0 -w capture.out port 88 or port 464 or port 53 or port 389 or port 3268

Setting Up Profile Manager

Prepare: HostName, ComputerName, LocalHostName, Static IP, DNS: A, PTR record
apple.mydomain.vn - 192.18.1.3. Go to Server app

Profile Manager is built on top the web service, APNS and Open Directory

Start the web service (click ON slider) and View Server Website

Click on Profile manager service (DO NOT CLICK ON ON/OFF SLIDER)

At the Directory Administrator screen, provide the username and password you’d like the Open Directory administrative account to have (note, this is going to be an Open Directory Master

Account Name: administrator
Pass: yourp@ss

The Open Directory master is then created. Even if you’re tying this thing into something like Active Directory, this is going to be a necessary step. Once Open Directory is setup you will be prompted to provide an SSL Certificate.

This can be the certificate provided when Open Directory is initially configured, which is self-signed, or you can select a certificate that you have installed using a CSR from a 3rd party provider.
You will then be prompted to enter the credentials for an Apple Push Notification Service (APNS) certificate. This can be any valid AppleID.

When the assistant closes, you will be back at the Profile Manager screen in the Server application. Here, check the box for Sign Configuration Profiles

=> Import mydomain.vn certificate

Finally Click ON to start Profile Manager -> http://apple.mydomain.vn/profilemanager/
Login with adminitrator yourp@ss

Integrating Mac OS X Lion Server's Profile Manager With Active Directory

Bind to Active Directory

System Preferences, click on the Users & Groups System Preference pane and click on Login Options. Then click on the Edit… button for the Network Account Server. From here, click on the plus sign (“+”) and enter the domain name into the Server field.

Once bound, you will see the server listed. At this point, if you try to authenticate to the MyDevices portal as an Active Directory user, you will be able to authenticate, but you will not have permission to enroll devices. To log in, access the web service at the address of the server followed by /MyDevices https://apple.mydomain.vn/mydevices.

Provide the user name and password to the service. The Active Directory users are unable to access the MyDevices service. Nest Groups Using Workgroup Manager

Click on Logout and we’ll fix this. There is no further configuration required for the Active Directory groups to function properly in regards to how they work with the server. However, we will need to open Workgroup Manager and nest some groups. You might think that you’d be doing something all kinds of complicated, but notsomuch. You also might think that you would be nesting the Active Directory users and groups inside Open Directory groups, given that you have to enable Open Directory in order to use Profile Manager. Again, notsomuch. To nest the groups, browse to the local directory and then then click on the com.apple.access_devicemanagement group.

Click on the lock icon to unlock the directory domain, authenticating when prompted.

Click on the Members tab and then click on the plus sign (“+”) to add members to the group. Workgroup manager -> View -> Show system record

Then in the menu that slid out, click on the domain browser at the top of that menu and select the Active Directory entry.

Test Access

Drag the user or group from the menu into the list of members and then click on the Save button.
Now log in again using the MyDevices portal and you’ll be able to Enroll. From within Profile Manager (log in here as a local administrator), you’ll see all of the users and groups and be able to apply policies directly to them by clicking on the Edit button for each (the information isn’t saved in the directory service on the server, but is cached into the directory service client on the client when using Mac OS X 10.7, Lion based clients).

To enroll devices for management, use the URL -> https://apple.mydomain.vn/mydevices/

To Sign Certificate -> Create a CSR from Certificate Management from Server.app, then open Certificate Authority on Windows Server 2008 create a Code Signing from Certificate Template -> use command line to sign the CSR file

 Reference:
http://krypted.com/iphone/setting-up-profile-manager-in-lion-server/
http://krypted.com/mac-security/integrating-mac-os-x-lion-servers-profile-manager-with-active-directory/

Read More

Enable PHP 5.5 Opcache on Ubuntu 14.04 with Nginx and PHP-FPM

OPcache improves PHP performance by storing precompiled script bytecode in shared memory, thereby removing the need for PHP to load and parse scripts on each request.

Making the switch from APC to Opcache now that it's standard with Ubuntu 14.04. All the tutorials seemed to be on Apache so thought I'd share what I did. The first change and restarting php I believe is all you need to do while the other changes are for performance and will vary based on your needs. If others have recommendations or additional advice please pipe in!

sudo vim /etc/php5/fpm/php.ini

Change:

;opcache.enable=0 to opcache.enable=1

Change:

;opcache.memory_consumption=64 to opcache.memory_consumption=128

Change:

;opcache.max_accelerated_files=2000 to opcache.max_accelerated_files=4000

Change:

;opcache.revalidate_freq=2 to opcache.revalidate_freq=60

Then restart:

sudo service php5-fpm restart
sudo service nginx restart

https://www.digitalocean.com/community/questions/enable-php-5-5-opcache-on-ubuntu-14-04-with-nginx-and-php-fpm

http://www.php.net/manual/en/opcache.configuration.php

Read More

Vyatta - How to enable SNMP

Go to Vyatta firewall and switch to configure mode

configure
set service snmp community GodBless authorization ro
set service snmp description "Vyatta FW-LoadBalancer"
set service snmp location HellOnEarth
set service snmp contact handsome@mydomain.vn
set service snmp listen-address 192.168.1.2
set service snmp listen-address 192.168.1.2 port 161
set service snmp trap-target 192.20.5.201
commit
save

Have a look at the configuration

cat /etc/snmp/snmpd.conf

vyatta@vyatta# show service snmp
 community GodBless {
     authorization ro
 }
 contact handsome@mydomain.vn
 description "Vyatta FW-LoadBalancer"
 listen-address 192.168.1.2 {
     port 161
 }
 location HellOnEarth

vyatta@vyatta:~$ netstat -ntlp
tcp 0 0 127.0.0.1:199 0.0.0.0:* LISTEN - SNMPD

snmp running on port 161 and warpped around by port 199 which is SmuxC Protocol: http://uw714doc.sco.com/en/SDK_netapi/smuxC.works.html

Read More

Vyatta - How to block specific URL

Log in to Vyatta Firewall and switch to configure mode

configure
set service webproxy url-filtering squidguard local-block 'itsysroute.cl'
set service webproxy url-filtering squidguard local-block-url 'itsysroute.cl'
set service webproxy url-filtering squidguard redirect-url 'http://www.google.com'
commit
save

Have a look at Vyatta configuration

configure
show service webproxy
    cache-size 20480
    domain-noncache mydomain.vn
    listen-address 192.168.1.2 {
    }
    maximum-object-size 40960
    mem-cache-size 1500
    url-filtering {
        squidguard {
        local-block itsysroute.cl
        local-block-url itsysroute.cl
        redirect-url http://www.google.com }
    }

Read More

Vyatta - How to enable Transparent Proxy

Login to Vyatta and switch to configure mode

configure
set service webproxy listen-address 192.168.1.2
set service webproxy  domain-noncache mydomain.vn
set service webproxy cache-size 20480
set service webproxy mem-cache-size 1500
set service webproxy maximum-object-size 40960
commit
save

cache-size (MB): Total disk cache size = 20GB

mem-cache-size (MB): Total memory cache size = 1.5GB 

maximum-object-size (KB): Maximum size of 1 file = 40MB

configure
show service webproxy
   cache-size 20480
   domain-noncache mydomain.vn
   listen-address 192.168.1.2 {
   }
   maximum-object-size 40960
   mem-cache-size 1500

Read More

Vyatta - How to view configuration

When you log on to the system, the system is in operational mode

• Operational mode provides access to operational commands for showing and clearing information and enabling or disabling debugging, as well as commands for configuring terminal settings, loading and saving configuration, and restarting the system.
• Configuration provides access to commands for creating, modifying, deleting, committing and showing configuration information

Operation mode

vyatta@vyatta:~$ <Tab>
vyatta@vyatta:~$ show <Tab>
vyatta@vyatta:~$ show wan-load-balance status
vyatta@vyatta:~$ show configuration
vyatta@vyatta:~$ show interfaces

Configure mode

To enter configuration mode type configure, to exit just type exit in operation mode

vyatta@vyatta:~$ configure
[edit]
vyatta@vyatta#
In configuration mode we can also use show to view configure parameter
vyatta@vyatta# show interfaces
vyatta@vyatta# show load-balancing

When we finish our configuration, we have to commit the change before exit. For example: to Enable https Service.

vyatta@vyatta# set service https
[edit]
vyatta@vyatta# commit
vyatta@vyatta# save
vyatta@vyatta# exit

You will notice that which mode you are in by looking at the symbol $ (operation) or # (configure)

Read More

Increase file upload size limit in PHP-Nginx

If Nginx aborts your connection when uploading large files, you will see something like below in Nginx’s error logs:

[error] 25556#0: *52 client intended to send too large body:

This means, you need to increase PHP file-upload size limit. Following steps given below will help you troubleshoot this!

Changes in php.ini

To change max file upload size to 100MB

Edit…

vim /etc/php5/fpm/php.ini

Set…

upload_max_filesize = 100M
post_max_size = 100M

Notes:

1. Technically,  post_max_size should always be larger than upload_max_filesize but for large numbers like 100M you can safely make them equal.
2. There is another variable max_input_time which can limit upload size but I have never seen it creating any issue. If your application supports uploads of file-size in GBs, you may need to adjust it accordingly. I am using PHP-FPM behind Nginx from very long time and I think in such kind of setup, its Nginx to which a client uploads file and then Nginx copies it to PHP. As Nginx to PHP copying will be local operation max_input_time may never create issue. I also believe Nginx may not copy the file but merely hand-over the location of file or descriptor records to PHP!

You may like to read these posts which explains PHP file upload related config in some details.

Change in Nginx config

Add following line to http{..} block in nginx config:

http {
 #...
        client_max_body_size 100m;
 #...
}

Note: For very large files, you may need to change value of client_body_timeout parameter. Default is 60s.

Reload PHP-FPM & Nginx

service php5-fpm reload
service nginx reload

Changes in WordPress-Multisite

If you are running WordPress Multisite setup, then you may need to make one more change at the WordPress end.

Go to: Network Admin Dashboard >> Settings. Look for Upload Settings

Also change value for Max upload file size

https://rtcamp.com/tutorials/php/increase-file-upload-size-limit/

Read More

Moodle 2.7 on Ubuntu server 14.04

In this tutorial I set up new Ubuntu server 14.04 and Moodle 2.7 for my school. Here is the stack:

1. Nginx
2. Php5-fpm
3. MariaDB (Mysql)

Near Future upgrade: MariaDB cluster + HAProxy for High availability Database

First let update your server

sudo apt-get update && apt-get -y dist-upgrade 

Moodle installation

sudo apt-get install mariadb-server nginx php5-fpm php5-mysql graphviz aspell php5-pspell php5-curl php5-gd php5-intl php5-mysql php5-xmlrpc php5-ldap git-core

Note: remember your mysql administrator password
Checkout latest Moodle 2.7 from Git repository

cd /opt
sudo git clone git://git.moodle.org/moodle.git
cd moodle
sudo git branch -a
sudo git branch --track MOODLE_27_STABLE origin/MOODLE_27_STABLE
sudo git checkout MOODLE_27_STABLE
sudo mkdir -p /var/www/moodledata
sudo cp -R /opt/moodle /var/www/
chown -R www-data:www-data /var/www/moodle/
chown -R www-data:www-data /var/www/moodledata/
sudo chmod -R 777 /var/www/moodledata
sudo chmod -R 0755 /var/www/html/moodle

In the future just checkout update from git and copy to moodle dir

MariaDB

I left default setting for Mysql because MariaDb run InnoDB as default
Create moodle database and its user. Use your mysql root pass as installation of MariaDB

mysql -u root -p
CREATE DATABASE moodle DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;
GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,CREATE TEMPORARY TABLES,DROP,INDEX,ALTER ON moodle.* TO moodle_user@localhost IDENTIFIED BY 'moodle_user_password';
quit;

Php5-fpm

I run php-fpm on TCP. Edit /etc/php5/fpm/pool.d/www.conf

[www]
user = www-data
group = www-data
listen = 127.0.0.1:9000

pm = ondemand
pm.max_children = 30
pm.start_servers = 10
pm.min_spare_servers = 4
pm.max_spare_servers = 10

pm.max_requests = 50000
request_terminate_timeout = 180
php_flag[display_errors] = off
php_admin_value[error_reporting] = 0
php_admin_value[error_log] = /var/log/php5-fpm.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 128M
chdir = /

service php5-fpm restart

Nginx

This box dedicated for Moodle only. Edit /etc/nginx/site-enabled/default

server {
        listen 80 default_server;
        root /var/www/moodle;
        index index.php index.html index.htm;
        server_name moolde27.mydomain.vn;
        location / {
                try_files $uri $uri/ =404;
        }
        location ~ \.php$ {
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                include fastcgi_params;
                }
        }

service nginx restart

 Complete Setup

Notice these Path: /var/www/moodle, /var/www/moodledata

Open your browser and go to http://moodle27.mydomain.vn

Follow the prompts selecting:

Database Type

Choose: MariaDB

Database Settings

Host server: 127.0.0.1
Database: moodle
User: moodle_user
Password: moodle_user_password
Tables Prefix: mdl_

Environment Checks

This will indicate if any elements required to run moodle haven't been installed.

Next next next...

follow prompts and confirm installation

Create a Site Administrator Account

Create your moodle user account which will have site administrator permissions.

Installation Complete

Congrats! You can now start using Moodle!

It was extremely annoying instead of showing nice Moodle Bootstrap interface it show only text and text. Troubleshooting Nginx does not show Images and CSS

Use browser search for the text path Sites Administration > Server > HTTP

Disable Use slash arguments which is enabled by Default

Reload your Browser and BINGO!

Reference:
http://docs.moodle.org/27/en/Step-by-step_Installation_Guide_for_Ubuntu

Read More

OpenStack summit 2014

Read More

Zabbix monitor VMWare Infrastructure

Monitor VMware is new feature of Zabbix 2.2

I got alot of disadvantages at this moment, can't get the most from guest machine: host IP address, host status, trigger, action... But it worth a try.

To turn on VMware monitoring, Zabbix extensions --with-libxml2 --with-libcurl needs to be compiled with. In addition, the configuration file zabbix_server.conf StartVMwareCollectors must be set to 1 or higher.

apt-get install libxml2-dev libcurl

Edit /etc/zabbix/zabbix_server.conf

LogFile=/tmp/zabbix_server.log
DBName=zabbix
DBUser=zabbix
DBPassword=
StartTrappers=5
StartVMwareCollectors=5
VMwareFrequency=10
VMwareCacheSize=32M
ListenIP=0.0.0.0
StartPollers=96
CacheSize=64M
HistoryCacheSize=16M
TrendCacheSize=16M
HistoryTextCacheSize=32M
ValueCacheSize=16M

Use the following procedure to monitor VMware.

1. Create a host of vCenter VMware hypervisor or (vSphere / ESXi)
   
2. $ {URL} , {$ USERNAME} , {$ PASSWORD}
   $URL -> https://(name/IP of vSphere Host or vCenter)/sdk
   You must have access to the URL. Try test it first. If it not work go to your VCenter and adjust it.
   
3. Apply "Template Virt VMware" to host
   
4. Hypervisor, guest VM is automatically registered by the discovery, monitoring is started. It take more than 2 hours to fetch the Information from VCenter. That's it

Read More