Chris Magnuson's questions

I am trying to install SecurityOnion (an xubuntu 12.04 based linux distrobution) using cobbler.

I have followed the instructions here to get cobbler installed from source on Ubuntu 12.04.

I have also followed the instructions here to configure cobbler but I am getting an error on the cobbler import step.

I am running cobbler import --name=securityonion --path=/media/iso --breed=ubuntu but it fails

task started: 2014-03-08_110255_import
task started (id=Media import, time=Sat Mar  8 11:02:55 2014)
Found a candidate signature: breed=ubuntu, version=precise
Found a candidate signature: breed=ubuntu, version=saucy
Found a candidate signature: breed=ubuntu, version=oneiric
Found a candidate signature: breed=ubuntu, version=lucid
Found a candidate signature: breed=ubuntu, version=quantal
Found a candidate signature: breed=ubuntu, version=raring
No signature matched in /var/www/cobbler/ks_mirror/securityonion
!!! TASK FAILED !!!

I assume this is because I need to add a signature to /var/lib/cobbler/distro_signatures.json

I know I should be able to copy and paste the definition for precise and make it work since SecurityOnion uses 12.04 but I don't know how to change the definition so that it matches whatever string of text I assume cobbler is looking for under the installation files that make up securityonion.

I have read the documentation on cobbler site but it doesn't seem to give me what I need to be able to add an additional distribution.

Anyone know what I can do to modify the signatures file to accept this additional distribution?

I have multipath IO configured server 2012 blade that shows warnings like the following during MPIO path failure:

The IO operation at logical block address 0 for Disk 7 was retried.

I know what is causing the warning to happen so I am not looking for the cause but what does this message actually mean?

Does it mean that if this IO was a write operation then server actually lost data that it was trying to write?

Thank you for any light you can shed on the meaning of this warning message.

I would like to move an Exchange 2010 mailbox from mydomain\userAccount1 to mydomain\userAccount2 without deleting userAccount1.

I have seen numerous articles online that talk about how to do this after userAccount1 is deleted but none that provide steps to move a mailbox with all its e-mail, active sync relationships, and other metadata over to a different active directory user account.

How can I move a mailbox from mydomain\userAccount1 to mydomain\userAccount2 without deleting userAccount1?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of my issues are related to my need to configure http specific SPNs on the windows service account that is running the application pool hosting my site.

All this has made me realize I just don't fully get the relationship between service types (MSSQL, http, host, termsrv, wsman, etc.), Kerberos authentication, active directory computer accounts (PCName$), windows services accounts, SPNs, and the user account I am using to try and access a service.

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying the explanation?

Bonus points for a creative analogy that would resonate with a moderately experienced system administrator/developer.

I have been scripting the configuration of our IIS 7.5 instance and through bits and pieces of other peoples scripts I have come up with a syntax that I like:

$WebAppPoolUserName = "domain\user"
$WebAppPoolPassword = "password"

$WebAppPoolNames = @("Test","Test2")

ForEach ($WebAppPoolName in $WebAppPoolNames ) {
    $WebAppPool = New-WebAppPool -Name $WebAppPoolName    
    $WebAppPool.processModel.identityType = "SpecificUser"
    $WebAppPool.processModel.username = $WebAppPoolUserName
    $WebAppPool.processModel.password = $WebAppPoolPassword
    $WebAppPool.managedPipelineMode = "Classic"
    $WebAppPool.managedRuntimeVersion = "v4.0"
    $WebAppPool | set-item
}

I have seen this done a number of different ways that are less terse and I like the way this syntax of setting object properties looks compared to something like what I see on TechNet:

Set-ItemProperty 'IIS:\AppPools\DemoPool' -Name recycling.periodicRestart.requests -Value 100000

One thing I haven't been able to figure out though is how to setup recycle schedules using this syntax.

This command sets ApplicationPoolDefaults but is ugly:

add-webconfiguration  system.applicationHost/applicationPools/applicationPoolDefaults/recycling/periodicRestart/schedule -value (New-TimeSpan -h 1 -m 30)

I have done this in the past through appcmd using something like the following but I would really like to do all of this through powershell:

%appcmd% set apppool "BusinessUserApps" /+recycling.periodicRestart.schedule.[value='01:00:00']

I have tried:

$WebAppPool.recycling.periodicRestart.schedule = (New-TimeSpan -h 1 -m 30)

This has the odd effect of turning the .schedule property into a timespan until I use $WebAppPool = get-item iis:\AppPools\AppPoolName to refresh the variable.

There is also $WebappPool.recycling.periodicRestart.schedule.Collection but there is no add() function on the collection and I haven't found any other way to modify it.

Does anyone know of a way I can set scheduled recycle times using syntax consistent with the code I have written above?

For some reason the % alias for ForEach-Object throws an exception when using the ( $Thing in $Things) syntax while the ForEach alias works fine.

Here are two examples:

Using the % alias:

$ints = @(1, 2, 3, 4, 5)
% ($i in $ints)
{Write-Host $i}

This fails with the error Unexpected token 'in' in expression or statment.

Using the ForEach alias:

$ints = @(1, 2, 3, 4, 5)
foreach ($i in $ints)
{Write-Host $i}

This succeeds without issue.

Why is there a difference if they are both aliases of ForEach-Object?

We are about to start wiring out a building expansion and our vendor has laid out the racks in the following configuration:

Option 1

1U Fiber patch panel 
2U Cable Manager 
2U 48 port Patch Panel
2U Cable Manager 
2U 48 port Patch Panel
2U Cable Manager 
1U 48 port Switch
2U Cable Manager 
1U 48 port Switch
Total = 15U 

All the patch panels would be connected to the switches with 1ft+ cables fed through cable management.

What I am considering instead is:

Option 2

1U Fiber patch panel 
1U 24 port Patch Panel 
1U 48 port Switch
2U 48 port Patch Panel 
1U 48 port Switch
2U 48 port Patch Panel 
Total = 8U

All of the patch panels would be connected to the switches with .5 ft cables directly on their face with the top 24 ports of each switch patched to the patch panel above it and the bottom 24 ports of each switch patched to the patch panel beneath it which would not require any cable management.

If I go with option 2 it save all of the space used by cable management and allows us to keep adding on switches and patch panels at the end without having to re-cable all of the patch panels above.

Our vendor has indicated that this is not best practice and that .5ft cables will introduce cross talk. I could understand that being the case if we were connecting the .5 ft cable directly into another switch but we are connecting it to a patch panel that likely has another 150 ft cable run from the back of the patch panel out to the port in the building in which case the real resulting cable is 150.5 ft at minimum before even connecting it to a PC.

It seems like it makes much more sense to go with option 2. It is easier to expand, saves space, and saves money on cabling and cable management.

Does this kind of configuration make sense or is there a legitimate reason to choose Option 1 over Option 2?

We are about to put in the wiring in an expansion of our office building and the vendor is proposing we use Cat 6 cabling because it is "faster." Gigabit works fine over Cat 5e which is what our existing building has run throughout it and according to Wikipedia we would need Cat 6a to be able to actually support 10 GB though it may work over shorter distances with Cat 6 (how long is shorter distances exactly?).

People talk about the increased speed/bandwidth of Cat 6 cable over Cat 5e but I believe what they are talking about is that Cat 6 supports 250 MHz vs Cat 5e support for 100 MHz. My understanding is that this does not at all translate into any difference in MBps which is what I normally think of in terms of speed.

If I setup a test with two computers at a distance of 100 ft that transfer data between each other using Cat 6 and then again using Cat 5e I don't believe I would see the time to transfer a 10GB file vary at all due to the cable used.

To further confuse the issue variance by MHz doesn't seem to be a reliable measurement of performance even when comparing cabling as the Cat 5e 350 MHz debacle illustrated.

I will be the first one to admit that I am not expert in this area but I am struggling not to make this decision based on what I see as cable suppliers use of fear mongering to convince me to purchase something that provides us no real benefit other than protecting myself by making the choice that no one will question in the future.

Are there other benefits that I am not considering or things that I have misunderstood which make a compelling case for Cat 6 instead of Cat 5e?

We have an LTO-3 Tape drive in a Dell media library that we use for our tape backups. The article about LTO on Wikipedia states that:

LTO uses an automatic verify-after-write technology to immediately check the data as it is being written, but some backup systems explicitly perform a completely separate tape reading operation to verify the tape was written correctly. This separate verify operation doubles the number of end-to-end passes for each scheduled backup, and reduces the tape life by half.

What I would like to know is, do I need my backup software (Backup Exec in this case) to perform a verify on these tapes or is the verify-after-write technology inherent in LTO drives sufficient?

I would also be curious if Backup Exec understands the verify-after-write technology enough to alert me if that technology couldn't veryify the data or will it just ignore it making it useless anyway since even if the drive detecs a problem I would never know about it.

We have a number of users who have MP3s in their home directories which are stored on our centralized file server. This has a negative affect on how long our backups take, how much drives space we need to have, etc. I thought about sending e-mails out for people to remove it with a notice that it would be deleted by a certain day but I don't feel that this is the right way to go about this. Many of these employees have music because it helps them work more efficiently and they don't have quantities that are excessive but the amount in sum across all the employees is still significant.

I have come up with a couple of ideas but each have their own problems:

• Idea: Allow Users to stream music instead of storing it
• Problem: Takes up too much bandwidth
• Idea: Move all the music to the users' local machines
• Problem: This would take significant effort on my department's part and we would then be responsible for doing things like redirecting the default directories for iTunes on people's computers so that data is stored locally
• Idea: Encourage people to purchase their own portable MP3 players by leveraging our corporate discount to offer employees discounted players
• Problem: Some of our users listen to podcasts, something that I have found extremely beneficial in my job, and may not have a computer at home to synchronize with

What are some good ways to handle respecting our users and getting the productivity and morale benefits that music affords without having to store users' music on our file server?

I have a number of domain service accounts that are running with more privileges than they need and I need to reduce their permissions and change all of their passwords.

How can I audit all of the places where a domain service account is used throughout my company?

Are there any software solutions that will be able to handle replicating the data from one SAS based DAS (a Dell MD3200) attached to two R410 servers running clustered Server 2008 R2 Hyper V instances in a co location data center to another MD3200 attached to another two R410 servers running clustered Server 2008 R2 Hyper V instances that are in our office so that in the event that the data center goes down it is simply a matter of turning on the VMs in our office and the VMs are able to start up as if they were a server that had been turned off without being shutdown?

I have recently seen someone doing something similar with HP’s left hand SAN offering and VMWare where they were able to have iSCSI endpoints clustered together and replicating across a WAN link so that if for some reason the data center became unavailable they could simply start up the VMs on ESX servers running in their local office and the only negative affect is that to the VMs it was like being turned off instead of properly shut down which most applications like SQL will handle without too much trouble.

I would like to do something similar but use DAS based storage instead of HP's Left Hand SAN and Hyper V R2 instead of ESX.

This blog entry indicates that Clustered Shared Volumes cannot be replicated but I was curious if there was third party software out there that can handle this.

Edit1: I am exploring the functionality of Double Take's Availability replication product but based on what I have currently seen it doesn't provide any indication that it can replicate clustered Hyper V instances, just normal ones.

Edit2: I have spoken with representatives from Double Take and their product does not support replication of Cluster Shared Volumes but I have discovered that Microsoft's Data Protection Manager 2010 does support backing up Cluster Shared Volumes.

We have a number of user's in our company who are using iPhones that have been provided by our company.

How can I remotely wipe out all data on an iPhone owned by our company?

I used the following to create a folder share called "Running Virtual Machines" on a Hyper V R2 server:

net share "Running Virtual Machines"="C:\Hyper V\Running Virtual Machines"

Now I need to change the permissions on the share to allow users to access the share but using the following gives me the error "You used an option with an invalid value":

net share "Running Virtual Machines" /GRANT:domain/username,FULL

I have also tried:

net share "Running Virtual Machines"="C:\Hyper V\Running Virtual Machines" /GRANT:domain\username,FULL

This gives me the message "The name has already been shared."

How do I change permissions on an existing folder share from the command line without having to delete the share and recreate it?

We need to have a company directory setup so that people within our company can easily look up other user's extensions, location, a picture of the individual, and any other information.

What would be some good tools to do this so that we are able to manage everything through active directory but still provide our users with an itnerface to easily view all the information?

Edit:

We have SharePoint 2007 implemented in our organization but it does not provide an easy to use company directory that includes people's pictures. A custom SharePoint list would also not accomplish this as the information is to dense and not easily displayed enough. I don't want to do custom web part development for this as I want to just purchase the best of breed tool instead of re-inventing the wheel

I have been researching System Center Configuration Manager 2007 R2 SP2 and struggling to swallow the SCCM pill. The tool seems outdated and not well equipped for managing an environment with the latest versions of Server 2008 R2, SQL 2008 R2, Exchange 2010, SharePoint 2010, etc.

I need software that will help me:

• Deploy new software
• Monitor what software is deployed
• Deploy updates
• Install new server and client OSes with specific configurations
• Monitor drive space and be able to send out alerts
• Aggregate event logs so that there is one central place for monitoring the health of an organization
• Be configurable via script
• Have a good DR plan so that all the effort poured into setting everything up is not at risk

These features line up well with the advertised features of System Center Configuration Manager and possibly Operations Manager as well but both of these pieces of software feel old and out of date.

Do I have any real alternatives in this market space?

I have seen Nagios and Zenoss but we are a Windows shop and adding the maintenance and management of a linux server for this purpose is probably more work than dealing with the quirks of SCCM.

If I install SQL Server 2005 x86 on Windows Server 2008 x64 how much memory will SQL be able to use be default? How much after setting SQL server's AWE switch?

This post talks about using /3gb, /PAE, and AWE to utilize SQL Server 2008 x86 memory appropriately on Windows Server 2008 x86.

My hypothesis based on that post and related information I have seen elsewhere is that by default a SQL Server 2005 x86 instance will be able to use 4GB of memory on Windows Server 2008 x64 and if I enable AWE then SQL will be able to use as much memory as the OS's sees.

PS: Please note if your answer generalizes to other version of SQL and or Windows Server.

Thanks

I have scripted against sysocmgr in Windows XP, servermanagercmd in server 2008, and now I find that I have to use a new PowerShell module servermanager to install features on Server 2008 R2 and so I would expect that I would use the same module in Windows 7 but it's not there.

How can I install Windows features using the command line or PowerShell in Windows 7?

How do I get a list of drive letters and their associated labels on a windows system through a bat file?

I want to assign my virtual machines MAC addresses so that I can configure DHCP reservations for them so that they always get the same IP address regardless of which host hypervisor they are running on or operating system they are running.

What I need to know is what range of MAC addresses can I use without fear that one day some device may be connected to our network with that MAC?

I have read the Wikipedia article on MAC addresses and this section seems to indicate that if I create an address with the form 02-XX-XX-XX-XX-XX then it is considered a locally administered address.

I would assume this means that no hardware manufacturer would ever use an address starting with 02 so I should be safe to use anything that starts with 02 for my virtual machines?

Thanks for the help.