Andy Arismendi's questions

Trying to create an RPM that uses Python 2.7 on a RHEL 6 machine. I'm using SCL to enable Python2.7 and building the RPM with it fine. However, when I try to install that RPM on a different system after enabling Python 2.7 (scl enable python27 bash then yum localinstall myrpm.rpm), I receive an error stating:

Requires: python(abi) = 2.7
Installed: python-2.6.6-64
    python(abi) = 2.6

Is there something I need to add in the spec file when building the RPM to fix this issue. Or is the issue related to the environment on the machine I'm attempting to install the RPM?

I have a VM with Redhat 6.8 that originally started with a 60GB disk 1. In VMware I increased the size to 100GB. I would like to increase the /tmp volume from 2GB to 5GB. I assume I need to resize the sda2 partition first and then increase the LV. I tried echo 1 > /sys/class/scsi_device/2\:0\:0\:0\/device/rescan and then resize2fs /dev/sda but it said it was busy. Not sure what commands I need or what the the order is... Here's my system info -

$ fdisk -l /dev/sda

Disk /dev/sda: 107.4 GB, 107374182400 bytes
255 heads, 63 sectors/track, 13054 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0000555c

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1          26      204800   83  Linux
Partition 1 does not end on cylinder boundary.
/dev/sda2              26        7833    62708736   8e  Linux LVM

$ lsblk
NAME                            MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sr0                              11:0    1  3.6G  0 rom
sda                               8:0    0  100G  0 disk
├─sda1                            8:1    0  200M  0 part /boot
└─sda2                            8:2    0 59.8G  0 part
  ├─system-swap (dm-0)          253:0    0   10G  0 lvm  [SWAP]
  ├─system-root (dm-1)          253:1    0   10G  0 lvm  /
  ├─system-opt (dm-2)           253:2    0   10G  0 lvm  /opt
  ├─system-tmp (dm-3)           253:3    0    2G  0 lvm  /tmp
  ├─system-var_log (dm-4)       253:4    0    1G  0 lvm  /var/log
  ├─system-var (dm-5)           253:5    0   10G  0 lvm  /var
  ├─system-home (dm-6)          253:6    0   10G  0 lvm  /home
  └─system-var_log_audit (dm-7) 253:7    0    1G  0 lvm  /var/log/audit

$ lvdisplay /dev/system/tmp
  --- Logical volume ---
  LV Path                /dev/system/tmp
  LV Name                tmp
  VG Name                system
  LV UUID                QOy6T3-vVnK-fJ0o-hyfY-gPYf-IC61-YDLQn1
  LV Write Access        read/write
  LV Creation host, time hardlogs.localdomain, 2014-02-19 12:09:47 -0500
  LV Status              available
  # open                 1
  LV Size                2.00 GiB
  Current LE             512
  Segments               1
  Allocation             inherit
  Read ahead sectors     auto
  - currently set to     256
  Block device           253:3

When I add permissions at the data center level with the propagate option, I see the account in the permissions list on the individual servers but the privileges aren't taking effect. The privileges only work when I add the account explicitly to the esxi server.

For example:

• My Datacenter (permissions: MyAccount:Administrator w/ Propagate)
  • My Cluster
    • My Server 1 (permissions: MyAccount:Administrator (inherited))

The privileges for administrator are not in effect for user MyAccount on My Server 1. However the privileges do take effect when the account is explicitly put on My Server 1 in this configuration:

• My Datacenter
  • My Cluster
    • My Server 1 (permissions: MyAccount:Administrator (explicit))

Any idea why privileges aren't taking effect for the inherited permission?

I have an OVA that contains a vApp with 9 VMs inside. I need to make a change to the drive contents of one of the VMs in the OVA. The OVA takes a very long time to export from vSphere (24 hours). Is there any way to modify the VM in the OVA without having to re-export the whole vApp?

Creating NFS shares on server 2008 R2 spanned volumes (with dynamic disks) works however when I tried on 2012 I received an error. The same PowerShell command works on the C drive basic volume on 2012.

New-NfsShare -Name nfsshare -Path E:\nfsshare -Authentication All `
    -EnableAnonymousAccess:$true -NetworkName $env:COMPUTERNAME `
    -Permission ReadWrite

New-NfsShare : Failed to perform the requested operation.
    At line:1 char:1
    + New-NfsShare -Name nfsshare -Path E:\nfsshare -Authentication All -EnableAnonymo ...
    + CategoryInfo          : NotSpecified: (MSFT_NfsServerTasks:root/Microsoft/..._NfsServerTasks) [New-NfsShare], CimException
    + FullyQualifiedErrorId : HRESULT 0x80070001,New-NfsShare

Is there a way to ignore part of a templated file?

I have a service which has a config file and each time the service starts it writes the start time in the config file. This makes puppet detect a change and since I have it notifying the service it will restart the service. I don't want puppet to restart the service shortly after I have just started it.

So is there a way for to make puppet ignore part of a templated file?

I would like to make CentOS a port forwarding NAT machine using iptables. This is the first time I've tried this and I think i might need a little help.

This is the configuration i'm trying to achieve. I'm trying to make a remote desktop connection through the CentOS machine on port 5500 and have CentOS connect to the server on port 3389.

192.168.21.11 is the client that should connect to port 3389 on 192.168.9.120 by connecting to 192.168.21.10 (CentOS) on port 5500.

• CentOS eth0 is 192.168.9.20/24
• CentOS eth1 is 192.168.21.10/24

What I tried so far:

1. Disabled SELINUX

2. Enabled IPv4 forwarding in /etc/sysctl.conf

   /etc/sysctl.conf
   net.ipv4.ip_forward = 1
   

3. Ran the following iptables commands

   iptables -t nat -A PREROUTING -p tcp -d 192.168.21.10 --dport 5500 -j DNAT --to 192.168.9.120:3389
   iptables -A INPUT -i eth1 -p tcp --dport 5500 -m state --state NEW,ESTABLISHED -j ACCEPT
   iptables -A OUTPUT -o eth0 -p tcp --sport 5500 -m state --state ESTABLISHED -j ACCEPT
   service iptables save
   

After saving this configuration I was not able to make the remote desktop connection I'm trying to achieve, so is there anything wrong with my iptables rules? Or is there something I might be missing?

I'm trying to configure Windows Firewall on Server 2008 R2 to block everything except for the traffic that I add to the rule list.

I see there are three policies - public/private/domain. I've been making the same setting changes to each one, though I only have a single NIC and its assigned the domain policy.

In the domain policy properties I've set the Inbound Connections to "Block (default)" but this still let's ICMP through. I changed it to "block all connections" and created an inbound rule that allows ICMP from all three profiles, for all programs on all interfaces but this made the firewall drop ICMP traffic even though I have an allow rule created for it.

According to this documentation the allow rules are supposed to take precidence over default rules. I want to set my default rule to block all traffic and only allow certain traffic with allow rules.

I created two custom allow rules:

1. Allow inbound ICMPv4 traffic for all programs/IP addresses.
2. Allow inbound ICMPv6 traffic for all programs/IP addresses.

With the Inbound connections policy set to block all connections and the above allow rules enabled it still blocks my remote pings.

How do I configure Windows Firewall to do this?

Update - It turns out I was using the wrong GUI (embarrassing). Instead of using the GUI in Administrative Tools I was using the one in Group Policy editor (which happen to look identical). There were already rules set on the firewall that I couldn't see in the group policy editor. These rules were taking effect without me realizing it which caused my confusion. To do what I wanted I just had to set the policy to "Block (default)" (with the right tool of course). After deleting all the pre-existing rules (that I didn't see with the group policy editor) I was able to only allow the traffic that I wanted by creating specific allow rules.

I have a Red Had Linux machine with two NICs:

• eth0 - 10.0.1.253 | 255.0.0.0
• eth1 - 10.0.1.1 | 255.255.255.0

So the first one is on a class A subnet, the second is on a class C subnet.

This is what my routing table looks like:

Destination  Gateway   Genmask        Flags Metric Ref Use Iface
10.0.1.0     *         255.255.255.0  U     0      0     0 eth1
link-local   *         255.255.0.0    U     1002   0     0 eth0
10.0.0.0     *         255.0.0.0      U     0      0     0 eth0
default      10.0.0.1  0.0.0.0        UG    0      0     0 eth0

The two NICs are connected to separate physical (actually virtual) LAN segments and I have a host connected to the same LAN segment eth0 is with IP 10.0.1.3 | 255.0.0.0 but I can't ping it from this machine because it appears its getting confused and sending out eth1. When I disable eth1 to force the packet to go out eth0 it connects but I need both enabled.

I'm thinking the solution is to add a manual route to my host 10.0.1.3 to force it to go through eth0. I'm not sure given the information above what the command would be to manually the route. Basically I need to send any traffic to 10.0.1.3 out eth0. Any help would be great!!

I have a couple APC UPS -

• Smart-UPS RT 6000 RM XL
• Smart-UPS RT 5000 RM XL

Unfortunately the power in my office likes to go out (out of my control) and hence the equipment powered by these UPS shuts down. They power a VMware infrastructure environment (VMware Lab Manager) and what I'd like to do is detect when one is on battery (say has been for x amount of time or has x percentage left) and run a script on this event.

What software do I need to detect a on-battery event and have it run a script?

Thanks!

Running RSH commands on a Windows box against a Linux box works only for the administrator user. Is there a file somewhere that has a list of users that can run commands remotely?

More Info

The server configuration is automated by VMware's product... There's no /etc/hosts.equiv file setup but there is a /root/.rhosts file with an entry of [IP ADDRESS] +.

The SUA client C:\Windows\SUA\bin\rsh can login when run as the local administrator account but no other user can login. The error is: rcmd: unknown user: [username]. The command I'm trying to run is: rsh -l root [IP ADDRESS] ls.

Can I use secedit.exe to export out the "Security Options" from the local security policy and then import them on another machine?

I'm trying to do this on Windows Server 2008.

Update

I just tried with:

secedit /export /db C:\andy.db /cfg C:\andy.inf /areas SECURITYPOLICY /log C:\andy.log

But it didn't work with error:

Warning 2: The system cannot find the file specified.
    Error opening C:\andy.db.

Where do I get the DB file from?

When Windows is installed it searches it's driver database and installs the appropriate HBA driver so the boot loader can access the drive and boot the system. When an image is taken and cloned to a machine of an incompatible HBA type, Windows will fail to boot with a 7B (inaccessible boot device) error because it doesn't rescan for HBAs every boot.

What are ways of getting a Windows image that was created on a machine with one HBA type to clone onto another with an incompatible HBA type? For example non AHCI to AHCI, RAID to non-RAID, IDE to SCSI, etc...

Contraints:

1. Free methods are preferable.
2. The image can't be pre-syspreped and loaded with drivers for a bunch of different HBA types.
3. I also may not have the system type the image was taken from in the first place.
4. I'd like to stay away from the Windows repair approach because I think that makes other changes other than just fixing the HBA driver (if it even does fix the HBA driver).

The only way I've been able to get this to work is to:

1. Install a fresh copy of Windows onto the machine I'm cloning to. F6 driver additions added if required.
2. Extract the CriticalDeviceDatabase registry information and driver sys files with a script I wrote.
3. Image over the machine with the incompatible image.
4. Boot up into ERD commander and attach to the Windows install and import the registry data and driver files I previously extracted.

This typically works however it's not particularly easy and ERD commander is aging. It's not even based on WinPE.

The reason I use ERD commander is that it can attach to the registry hive with read/write access and has read/write access to the disk. I use both of these capabilities to import registry data and driver files.

So far this approach has generally worked for me however I want to see what other ways people have to solve this problem considering the constraints I've listed.

How would one export all of the user rights assignments from one Windows Server 2008 box and import them on another. Neither would be on a domain so this would just be local security policy.

I'm a VCP 4 so I'm aware of the configuration maximums for LUNs/RDMs/VMDKs in vSphere 4, but say I want to create a VM that has a logical drive bigger than 2TBs. The only ways I can think of doing this are:

1. Creating the VM with multiple VMDKs each less than 2TB on different LUNs and spanning or software RAIDing them in the guest operating system.

2. Creating a VMFS extent across multiple LUNs and creating multiple VMDKs and spanning or software RAIDing them in the guest operating system (just a slight variation of #1).

3. Use multiple 2TB or smaller RDMs and spanning or software RAIDing them in the guest operating system.

4. Mount an iSCSI LUN larger than 2TB from the guest operating system.

All of these methods rely on spanning/software RAIDing from the guest operating system. Is this pretty much it or are there other possibilities?

Update TomTom pointed out a 4th option.

Update 2 Tom's hardware has an interesting article about a petabyte sized storage device. They have a screenshot of it mounted via NFS in vSphere 4.1. As to JakeRobinson's suggestion with NFS, the sky is the limit with these types of datastores!

Does anyone know how to create a self-signed SSL certificate for use with IIS (7) that has subject alternative names (SAN)s? I need the certificate to be able to validate the hostname AND the IP address like this:

• CN=MyServerName
• IP SAN: 192.168.2.2

Some things i've been looking at:

• Windows SDK: makecert.exe (doesn't support SANs)

• Windows API CertEnroll (Server 2008): using PowerShell script (I've been able to get this to work with IIS, however when I export the certificate into a Java keystore (must have) I get an error keytool error: 'java.lang.Exception: Input not an X.509 certificate’)

Here's an example of a PowerShell script using CertEnroll: http://blogs.technet.com/b/vishalagarwal/archive/2009/08/22/generating-a-certificate-self-signed-using-powershell-and-certenroll-interfaces.aspx

• OpenSSL: I haven't looked into this yet...

It would be great if I can get my PowerShell script to create a certificate that Java recognizes using the CertEnroll API, but anything that works at this point i'll be happy hearing about.

My website has two bindings: 1000 and 1443 (port 80/443 are in use by another website on the same IIS instance). Port 1000 is HTTP, port 1443 is HTTPS. What I want to do is redirect any incoming request using "htt p://server:1000" to "https://server:1443". I'm playing around with IIS 7 rewrite module 2.0 but I'm banging my head against the wall. Any insight is appreciated!

BTW the rewrite configuration below works great with a site that has an HTTP binding on port 80 and HTTPS binding on port 443, but it doesn't work with my ports.

P.S. My URLs intentionally have spaces because the 'spam prevention mechanism' kicked in. For some reason google login doesn't work anymore so I had to create an OpenID account (No Script could be the culprit). I'm not sure how to get XML to display nicely so I added spaces after the opening brackets.

< ?xml version="1.0" encoding="utf-8"?>
< configuration>
  < system.webServer>
    < rewrite>
      < rules>
        < rule name="HTTP to HTTPS redirect" stopProcessing="true">
          < match url="(.*)" />
          < conditions trackAllCaptures="true">
                        < add input="{HTTPS}" pattern="off" />
          < /conditions>
          < action type="Redirect" redirectType="Found" url="htt ps: // {HTTP_HOST}/{R:1}" />
        < /rule>
      < /rules>
    < /rewrite>
  < /system.webServer>
< /configuration>