mit's questions

I would like to setup an MS SQL proxy server.

It should forward all requests 1:1 and make it possible to log them, and modify some of the requests or answers according to some replacement rules I setup.

Maybe some TCP IP networking software or general proxy can do this, but even better some specialised MS SQL tools.

We are still on SQL Server 2005

How can I enable the immediate shutdown without logging in on the windows 2003 server login screen.

I know it is less secure because anyone can shut the machine down then.

(But "they" could always pull the power plug anyway ;)

I have ssh login to an ESXi 5 host.

All the guests have vmware tools running, so they can be shut down by the host properly.

I would like an equivalent for this menu option in vSphere client:

It shuts down all the guests automatically (if they have vmware tools running) and then the host itself.

Is there such a "smart" shutdown all command on the ESXi 5 commandline?

How can I shutdown a virtual machine when I am on the commandline of an ESXi5 host over ssh?

Sidenote:

To enable scripts on other machines to login to the ESXi without password, add the public key of the user on the other machine to the ESXi's "/etc/ssh/keys-root/authorized_keys" if you want to login as root. If you want to login as user x add the key to "/etc/ssh/keys-x/authorized_keys".

Sometimes we open vSphere from a restricted terminal that only has a basic ascii keyboard and f1-f12 and a mouse but is missing the additional numeric block on the right side of a big keybaord part and also there is no numlock state.

In the bios screen of a vm you have to press num-<+> or num-<-> to move the boot order of devices.

As we don't have these keys, how can we do it?

The <+> and <-> keys on the normal keyboard do not seem to work (although everything else works).

I have a virtual disk with one snapshot. I want to acces the latest data after the snapshot.

One way would be to merge the delta into the disk.

But the rest of the vm does not exist any more. How can I do this, e.g. delete the snapshot?

I am quite sure all the disk files are complete an in consistent state, I made a backup:

I wonder if this would be possible:

If I add the disk to a working VM in vSphere it offers 2 possible vmdks, the normal disk, and a ...-000003 file.

If I add the -000003 file, can I access the latest version then?

Edit: following the accepted answer, I found it is easy from the command line:

vmkfstools -i xxxx-nnnn.vmdk  newdisk.vmdk

xxxx-nnnn.vmdk is a snapshot file and newdisk woll contain a disk where this snapshot has been removed (this means the changes from the snapshot have been merge into the newdisk file).

But it is necessary that the parent snapshot(s), if existing, are present. And all disk files have still to be in consistent shape.

A guest on VMWare ESXi 4 is not booting anymore and I want to attach its disk to another machine. Both are almost identical ubuntu 64 bit server instances.

But the broken machine had snapshots, so vSphere client offers me to add from 2 vmdk files:

• redmine-alt-clon.vmdk 4GB
• redmine-alt-clon-000003.vmdk 257MB

This is a screenshot of the situation on the harddrive:

So is it fine to just add the first one that vSphere finds (redmine-alt-clon.vmdk) and I get the drive contents from yesterday?

(This would mean the other small file with -000003 and the delta file contains the old state or the difference makes the old state that I no longer need.)

Or if it is not that simple, what can I do to get yesterdays state of the drive without starting the vm or reverting the snapshot.

I would rather avoid reverting the snapshot from vSphere client because the broken vm is no longer available with all files.

EDIT: What I found out after some time is that more delta files like 00002-delta are missing (the parents, as there were more snapshots in the chain) and so it was not possible to fix the issue for me. But the different answers below should help in similar cases if all necessary snapshot files do still exist (and they should normally).

Is there also a console on ESXi 5? The well known method from ESXi 4 for the "hiddenconsole" does not seem to work.

(Alt-F1, type "unsupported", enter root password)

From windows server 2003 I can easily add a cups printer service from another host:

I tried the same on a windows server 2008 machine, but I did not succeed to add this kind of http printer addresses there, although the address is reachable in the browser (the cups http interface shows up):

What is the way to do it on 2008 ?

(I can easily go to the cups http page in a browser from the 2008 machine)

When I activate a new rackspace ubuntu 10.04 instance I keep getting these messages:

perl: warning: Please check that your locale settings: LANGUAGE = (unset), LC_ALL = (unset), LANG = "de_DE.UTF-8" are supported and installed on your system.

How do I select and configure the locales correctly?

Edit: This was given to me by Rackspace support, it also worked, maybe it helps someone with ubuntu 10.04:

sudo locale-gen en_US.UTF-8
sudo /usr/sbin/update-locale LANG=en_US.UTF-8

I have already installed cygwin (running sshd) on windows 2003 DC several times.

But now another admin who is actually responsible for this domain asked my if this is really safe.

Edit:: I changed the question to make it better fit the accepted answer. I have moved the other part of the question that I had originally in mind to a new thread, please klick here.

I have created an nfs share on a synology NAS. I want to add the share to an ESXi host, but without success.

Configuration of the nfs share:

I inserted the IP of the ESXi host, allowed read/write and tried all 3 root_squash values (not assigned, guest and admin)

Adding the share to ESXi:

I inserted the IP of the NAS, the name of the nfs share (I tried both /vms and vms without slash)

This is the error message on the ESXi client:

I know of 2 ways to clone a VirtualBox machine on a linux host, one is by using the VirtualBox gui and exporting and re-importing as appliance (in the file menu of VirtualBox).

The other is by cloning only the virtual disk container files:

VBoxManage clonevdi /mnt/md1/original/root-fs.vdi /mnt/md1/cloned/root-fs.vdi

(Taken from http://forums.virtualbox.org/viewtopic.php?p=853#p858 )

Edit: this does not seem to work for VDI files that are already part of ~/VirtualBox/VirtualBox.xml, I get an error message:

ERROR: Cannot register the hard disk '/mnt/md1/original/root-fs.vdi' with UUID {96a1462b-c30a-4911-a954-d9093122f083} because a hard disk '/mnt/md1/original/root-fs.vdi' with UUID {96a1462b-c30a-4911-a954-d9093122f083} already exists in the media registry ('/home/mit/.VirtualBox/VirtualBox.xml')

I would have to create a new VM afterwards and use the cloned virtual disk containers.

Is it also possible to clone a VM by copying the virtual disk contianer files and the config files using filesystem commands and do the rest by hand?

I'd have to manually edit the ~/VirtualBox/VirtualBox.xml and insert a new disk and a new machine:

Can I just make up UUIDs or how would this work?

I would very much prefer this hardcore method of doing things as it allows me to freely and rapdily backup, restore, move or clone machines. Or ist there a better way to do this?

I can connect with this script from linux to a windows RDP session:

#!/bin/bash
/usr/bin/rdesktop -N -x m -u Administrator -p secret123 -d DOMAIN1 127.0.0.1:33891

(The rdp port of the remote windows server is securely tunneled to port 33891 on localhost)

But this script does not transmit the password properly:

#!/bin/bash
/usr/bin/rdesktop -N -x m -u Administrator -p #secret$123# -d DOMAIN2 127.0.0.1:33892

How do I have to encode the special chars in the password?

I am also wondering if it makes a difference if I choose /bin/sh as the shell for the script.

Edit:

I found out this works:

\#secret\$123\#

I have a http service running on 10.1.1.187:8080.

This is delivered as a public https service to https://public.example.com which is 10.1.1.186:443 via apache proxy magic:

<VirtualHost 10.1.1.186:443>
    ServerName public.example.com

    #Configure Reverse Proxy
    ProxyRequests Off
    ProxyPreserveHost On

    <Location />
        ProxyPass http://10.1.1.187:8080/
        ProxyPassReverse http://10.1.1.187:8080/

        Order allow,deny
        Allow from all
    </Location>

    #Define Virtual Host Specific SSL information.
    SSLEngine On
    SSLProxyEngine On
    SSLProxyProtocol all -SSLv2

    SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

</VirtualHost>

When I enter https://public.example.com in my browser and click through the certificate, I can get the first page which contains a login form:

<form action="http://public.example.com/login" method="post">
  <--  ... contains username, password fields and a send button -->
</form>

So the action target was very nice rewritten. But the http should read https. How to do that?

It would be nice if the link was changed in the form action tag, pointing to the correct https page already, rather using a second http virtual host with a rewrite condition.

Edit:

This is the additional part that solved it (I put it in the vhost but outside the Location container):

SetOutputFilter proxy-html

# On: rewrite also css and javascript - Off: only in HTML
ProxyHTMLExtended Off
# Maybe this should be switched on

ProxyHTMLURLMap http://public.example.com https://public.example.com

I am installing mtop on ubuntu 8.04 Mysql is running.

During the installation process there is a message:

Access denied for user 'root'@'localhost' (using password: NO)

(see below)

I suspect I have to allow access from unix user root to mysql account root somehow?

What are the correct steps?

$ sudo aptitude install mtop
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Reading extended state information      
Initializing package states... Done
Building tag database... Done      
The following NEW packages will be automatically installed:
  libcurses-perl 
The following packages have been kept back:
  linux-image-server linux-server pm-utils 
The following NEW packages will be installed:
  libcurses-perl mtop 
0 packages upgraded, 2 newly installed, 0 to remove and 3 not upgraded.
Need to get 0B/168kB of archives. After unpacking 664kB will be used.
Do you want to continue? [Y/n/?] y
Writing extended state information... Done
Preconfiguring packages ...
Selecting previously deselected package libcurses-perl.
(Reading database ... 36744 files and directories currently installed.)
Unpacking libcurses-perl (from .../libcurses-perl_1.13-1_i386.deb) ...
Selecting previously deselected package mtop.
Unpacking mtop (from .../mtop_0.6.6-1.2_all.deb) ...
Setting up libcurses-perl (1.13-1) ...
Setting up mtop (0.6.6-1.2) ...
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
dpkg: error processing mtop (--configure):
 subprocess post-installation script returned error exit status 1
Errors were encountered while processing:
 mtop
E: Sub-process /usr/bin/dpkg returned an error code (1)
A package failed to install.  Trying to recover:
Setting up mtop (0.6.6-1.2) ...
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
dpkg: error processing mtop (--configure):
 subprocess post-installation script returned error exit status 1
Errors were encountered while processing:
 mtop
Reading package lists... Done             
Building dependency tree       
Reading state information... Done
Reading extended state information      
Initializing package states... Done
Writing extended state information... Done
Building tag database... Done             

Edit: After reading the bugreport on launchpad I decided to go with the similar tool mytop in the old ubuntu editions.

We have 2 ubuntu 8.04 LTS fileservers running samba version 3.0.28a-1ubuntu4.12, they export samba shares for windows server 2003 machines. There is no windows AD domain, just plain user authentication. From /etc/samba/smb.conf:

[global]
        workgroup = WORKGROUP
        security = SHARE
        passdb backend = smbpasswd:/etc/samba/smbpasswd
        unix password sync = no
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        dns proxy = No
        panic action = /usr/share/samba/panic-action %d
        encrypt passwords = true
        invalid users = root
        hosts allow = 10.1.1.0/24

[md0]
        comment = md0
        path = /mnt/md0/smb/share1
        valid users = user1
        force user = root
        force group = root
        read only = no
        create mask = 0660
        directory mask = 0770
        browseable = Yes

/mnt/md0/ is a raid system and file permissions are root.root for historical reasons.

On a windows server 2003 machine we access the share with a script:

net use t: \\fileserver0\md0 passwordforuser1 /user:user1

On the windows machine we now see Unix user\root as the owner:

This is logically correct.

But is there a chance to change samba configuration so we see user1.user1 as owner on the windows side instead of Unix user\root?

How to zero fill a virtual disk's free space on windows for better compression?

I would like a simple open source tool (or at least free) for that. It should probably write an as big as possible file full of 0and erase it afterwards. Only one pass (this is not for security reasons but for compression, we are backing up virtual machines).

Should run from inside windows and not from a disk.

On Linux I do it like this (as a user):

cd
mkdir wipe
sudo sfill -f -l -l -z ./wipe/

Edit 1: I decided to use sdelete from the accepted answer. I had a look at the sdelete's help:

C:\WINDOWS\system32>sdelete /?

SDelete - Secure Delete v1.51
Copyright (C) 1999-2005 Mark Russinovich
Sysinternals - www.sysinternals.com

usage: sdelete [-p passes] [-s] [-q] <file or directory>
       sdelete [-p passes] [-z|-c] [drive letter]
   -c         Zero free space (good for virtual disk optimization)
   -p passes  Specifies number of overwrite passes (default is 1)
   -q         Don't print errors (Quiet)
   -s         Recurse subdirectories
   -z         Clean free space

This is an old version. I used the -c switch from the 2nd invocation and this was quite fast (syntax only valid for older versions before V1.6):

c:\>sdelete -c c: (OUTDATED!)

I have the impression this does what I want. The sdelete tool is easy to use and easy to get.

Edit 2: As scottbb pointed out in his answer below, there was a September 2011 change to the tool (version 1.6) The -c and -z options have changed meanings. The correct usage from 1.6 onwards is

c:\>sdelete -z c:

Edit 3: There is a 2.0 version of sdelete and sdelete64. They appear to be buggy when zeroing. It will appear to be stuck at 100% for extremely long times. Some people have reported 10 - 40 times longer. The older version 1.61 does not have this issue. See https://social.technet.microsoft.com/Forums/en-US/2ffb2539-34ba-4378-aa8a-941d243f117e/sdelete-hangs-at-100?forum=miscutils

Edit 4: Now there's the issue of dynamically allocated virtual disc space. If you have a 100GB disk that is not full and uses only 30GB on the host, zero filling should not increase dramatically the size of the disc because that contradicts the purpose of dynamic allocation. There is an answer for Oracle VM VirtualBox https://superuser.com/q/907196/44402 - but on other stacks like VMWare, Xen, XenServer, etc., this needs to be answered separately.

I am connecting to ESXi with vSphere client from a remote LAN.

ESXi is running on 10.1.1.10, so I create an ssh tunnel (using cygwin but putty or plink should also work) with this command:

ssh -v -p 2222 -L 903:10.1.1.10:903 -L 902:10.1.1.10:902 -L 443:10.1.1.10:443 -L 80:10.1.1.10:80 [email protected]

VSphere does not connect, I get a "connection error" connecting to localhost. I can telnet the ports on localhost, they are responding.

Do I have to forward more ports apart from 80,433,902 and 903? When I connect with VSphere client from within the remote-lan to 10.1.1.10 it works.

In this drawing = means WAN connection and -stands for LAN connection:

[vSphere client machine] = = = ssh = = = [remote-lan-router] - - - [ESXi 10.1.1.10]

Edit: Solution (via accepted answer):

I added a host entry 127.0.0.1 myhost1 to the hosts file (c:\WINDOWS\system32\drivers\etc\hosts) on the vSphere client machine (which runs windows) and then connected the vSphere client to myhost1

At least with a single client controlling a single server this seems to work fine.

I want to allow access to a single file in a directory that is otherwise forbidden.

This did not work:

<VirtualHost 10.10.10.10:80>
  ServerName example.com

  DocumentRoot /var/www/html

  <Directory /var/www/html>
    Options FollowSymLinks
    AllowOverride None
    order allow,deny
    allow from all
  </Directory>

  # disallow the admin directory: 
  <Directory /var/www/html/admin>
    order allow,deny
    deny from all
  </Directory>

  # but allow this single file:: 
  <Files      /var/www/html/admin/allowed.php>
      AuthType basic
      AuthName "private area"
      AuthUserFile /home/webroot/.htusers
      Require user admin1
  </Files>

  ...
</VirtualHost>

When I visit http://example.com/admin/allowed.php I get the Forbidden message of the http://example.com/admin/ directory, but not the browser login popup from the basic auth, so the basic auth does not work on the file. How can I make an exception for allowed.php?

If not possible, maybe I could enumerate all forbidden files in another Files directive?

Let's say admin/ contains also user.php and admin.php which should be forbidden in this virtual host.

Edit: I also tried the following modification, trying to follow advice from Ignacio's answer, with the same result 'Forbidden':

  ...

  # disallow the admin directory: 
  <Directory /var/www/html/admin>
    order allow,deny
    deny from all
  </Directory>

  # but allow this single file:: 
  <Files      /var/www/html/admin/allowed.php>
      order allow,deny
      allow from all
      AuthType basic
      AuthName "private area"
      AuthUserFile /home/webroot/.htusers
      Require user admin1
      satisfy all
  </Files>
  ...