Saturday, August 30, 2014

Windows 7+ Not registering Reverse DNS

Not sure if anyone else besides me uses a network device for DHCP anymore but if you do this is for you.  I've never been a fan of how Microsoft apparently wants you to setup DHCP, on a friggin Windows Server.  Why on earth would you do this when your firewall, router, IPS, or basically anything else besides another Windows Server does the job just as well?  According to Microsoft this is blasphemy and as such starting with Windows 7 they punish you.

No longer will a Windows client register its PTR record automatically without any extra GPO settings.  Windows XP did it just fine but ce la vie Windows 7 and beyond does not do this.  To fix this you either have to configure the Windows client to do it individually OR the lazy way is to configure a GPO for this.


Computer Configuration/Admin Templates/Network/DNS Client; Configure "Primary DNS Suffix" with your domain's DNS suffix and then Enable "Register DNS records with connection-specific DNS suffix".  Once you do that and allow the GPO to take effect you'll be rewarded with properly registered PTR records.

Saturday, August 9, 2014

The bane of my Windows-Administrating existence, CONQUERED!

Restricted Groups.

I've never been able to fully get the grasp of restricted groups. No matter how many times I've seen a tech blog for it or had someone who has used them explain it to me. Didn't matter, I always failed.  Today is a big day for me my friends. I kicked it's rear end.

I've been fighting this fight, losing it, since Windows Server 2003.  I've NEVER been able to get it to work right.  It's just been one thing I've never gotten but always wanted to.  Thankfully a gentleman on the web somehow stumbled onto a way to explain it to me in a method I could digest.

I will take NO credit for this whatsoever but instead will provide a link back and a copy of his posting on this for validation. Great write up : http://www.frickelsoft.net/blog/?p=13 I implemented this with NO problems. Sad to know this has been out there since 2006 and yet I never found it.



How To Use Restricted Groups? Part I
Posted October 16, 2006


( – or: How can I add [Active Directory] user accounts into some? clients’ local Administrators group without touching each client?)

This article describes the feature “Restricted Groups” in Group Policy. This feature enables you – as the administrator – to configure group memberships on the client computers or member servers. You can add user accounts to groups on client machines that are in the scope of the policy.

As there are many questions about this in the newsgroups, I will come up with an example that shows how to put a group of Active Directory users into the local Administrators group on the clients.

For this article, I assume that you already created a global security group containing all users that shall become local Administrators on some client computers. In my example, the group is called “localAdmins”. The target (= client) computers reside in a specific OU.

If you’re using the Group Policy Editor, you navigate to the OU where the client computers reside and right-click it. Choose “Properties” and “Group Policy” where you create a new Policy and click “Edit”. You then navigate to:

CompConf\Windows Settings\Security Settings\ and then right-click “Restricted Groups” and choose “Add Group”.




You simply add the created group by clicking “Browse..” or typing the group name into the box.



After clicking “OK”, another beautiful window opens up, where you can find two boxes. The upper box, saying “Members of this group”, the lower one saying “This group is a member of”.

If you added users or groups into the “Members of this group” box, you would advise the Restricted Groups feature to put the users and groups you selected into the localAdmins group. Restricted Groups would thenreplace the current members of the localAdmins group with the users and groups you filled into the box. Please recognize my words, it would replace them – just wipe existing users out of the localAdmins group.

As we do not want to add users or other groups to our group, but add our localAdmins group the local Administrators group on our clients, we have a look at the lower box – labeled “This group is member of”. We click “Add” and type in the name of the group, we want localAdmins to be member of. In this case, it “Administrators”. We then simply click “OK” and “Apply” and close all windows. “This group is member of” advices “Restricted Groups” to add our localAdmins group into the “Administrators” group of the clients. The existing group members will not be touched – it simply adds our group.

Saturday, June 14, 2014

Deploying Office 2013 via Group Policy

Ever since Office 2007 I've wanted to learn how to deploy Microsoft Office by way of Group Policy but never quite grasped how to do it.  Office 2003 worked like all the previous versions by deploying with a simple MSI file which any admin, worth the air he or she breathes, can deploy without much trouble.  Starting with Microsoft Office 2007 the game was changed and deployment via MSI package no longer was an option.  Why they did it I can see now was to facilitate more customization but I just never could get the documentation on how to do it.  The example I will use below is with my experience recently deploying Microsoft Office 2013 Standard but the method is the same whether it be Standard or Pro, 2007, 2010, or 2013.

First copy all of your files from the ISO to a network install folder.  Next using your member server or a workstation execute the setup.exe with an added switch: \\server\share\office15\setup.exe /admin .  From there the Office Customization Tool will start allowing you to do a LOT of customization.  A quick search of the interwebs can show you just what all you can mess with in there but I'll give account of what I cared to mess with.  I added the organization who owned the software, what pieces of the install I wanted, which ones I wanted left out, added my MAK product key (KMS can be used as well), added shortcuts to be left on the user's desktop, etc.  The biggest help I found here.  This helpful admin put the steps out in detail with screen shots on how to get those parts figured out.

1) Run the OCT by typing setup.exe /admin at the command line from the root of the network installation point that contains the Office 2010 source files. For example, use \\server\share\office15\setup.exe /admin.
2) In the OCT, select Licensing and user interface in the left pane, and in the right pane select Enter another product key, add your organization specific MAK Office product key in the Product key field, and other options as desired.
3) In the OCT, select Modify Setup properties in the left pane and then click the Add... button in the right pane.
4) In the Add/Modify Property Value dialog and type AUTO_ACTIVATE in the Name field. Note that property names are case sensitive.
5) In Value field, type 1, and then click OK.
6) Note that the AUTO_ACTIVATE property has been added to the MSP file and has a value of 1.
7) Click the File menu and then click Save as to save the Setup customization file. If the file is saved in the Updates folder that is part of the Office source file location/installation point, running the Office Setup.exe file will automatically detect the customization file in the Updates folder and apply the customizations.
8) As an alternative to placing the customization .msp file in the Updates folder, you can use the Setup command-line option /adminfile to specify the fully qualified path of the location of the MSP file. For example, type setup.exe /adminfile \\server\share\mychanges\custom.msp.

After this is done we need to make some changes to our \\server\share\office15\standard.ww\config.xml file. There is a shell in there allowing you to uncomment-out certain values to install strictly by using the config.xml file I've read but I just left all the default things in there and added my own lines after the last default line and before the </Configuration> tag.
<Display Level="None" CompletionNotice="No" SuppressModal="No" AcceptEula="Yes" />
<AddLanguage Id="match" />
<AddLanguage Id="en-us" ShellTransform="Yes" />
<Setting Id="SETUP_REBOOT" Value="Never" />
<Setting Id="REBOOT" Value="ReallySuppress"/>
<Setting Id="AUTO_ACTIVATE" Value="1" />
<PIDKEY Value="YOURMAKHERE" />

Adding that bit is what will allow the MSP file to continue on installing once it touches the config.xml file.

Last thing to do is configure your startup or shutdown script to kick all of this magic off.  Like I said in the beginning things are not like it used to be.  A cmd script can be used to do all the goodies for you.

The following was borrowed from a technet article but I also made some changes to it only to make it work for my environment. 

setlocal

REM *********************************************************************
REM Environment customization begins here. Modify variables below.
REM *********************************************************************

REM Get ProductName from the Office product's core Setup.xml file, and then add "office14." as a prefix. 
set ProductName=Office15.Standard

REM Set DeployServer to a network-accessible location containing the Office source files.
set DeployServer=\\server\share\office15

REM Set ConfigFile to the configuration file to be used for deployment (required)
set ConfigFile=\\server\share\office15\standard.ww\config.xml

REM Set LogLocation to a central directory to collect log files.
set LogLocation=\\server\share\office15\install-logs

REM *********************************************************************
REM Deployment code begins here. Do not modify anything below this line.
REM *********************************************************************

IF NOT "%ProgramFiles(x86)%"=="" (goto ARP64) else (goto ARP86)

REM Operating system is X64. Check for 32 bit Office in emulated Wow6432 uninstall key
:ARP64
reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\Microsoft\Windows\CurrentVersion\Uninstall\%ProductName%
if NOT %errorlevel%==1 (goto End)

REM Check for 32 and 64 bit versions of Office 2010 in regular uninstall key.(Office 64bit would also appear here on a 64bit OS) 
:ARP86
reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%ProductName%
if %errorlevel%==1 (goto DeployOffice) else (goto End)

REM If 1 returned, the product was not found. Run setup here.
:DeployOffice
start /wait %DeployServer%\setup.exe /adminfile %DeployServer%\Updates\basic-install.msp
echo %date% %time% Setup ended with error code %errorlevel%. >> %LogLocation%\%computername%.txt

REM If 0 or other was returned, the product was found or another error occurred. Do nothing.
:End

Endlocal

That should do it.  Another guy wrote up something similar to this one, http://deployhappiness.com/deploy-office-2013-with-group-policy/, which did help me get started in the right direction but it seems like no one I could find had everything I wanted.  Hope this helps someone else out.

Monday, June 2, 2014

Using one Rsyslog instance for multiple ports

Ever cared to or needed to have one Rsyslog v5 instance listening on multiple ports while either re-directing or something else with those feeds? Rsyslog documentation allows for this with RuleSets.  If you have Rsyslog v7.6 or newer there is a cool config builder which can help but for those who don't roll your own rpms you can visit the link below.


http://www.rsyslog.com/doc/v5-stable/concepts/multi_ruleset.html

I was able to use this to keep the number of rsyslog instances to a minimum while providing multiple data source routings.  Cheers!

Wednesday, October 23, 2013

Re-naming Network Interfaces on Red Hat 6

If you've ever needed to use a certain network interface on a linux (specifically RHEL6 here) you'll notice there are several different ways to do it.  A search of the interwebs will give you numerous avenues but I'm going to outline the one here which worked for me. We'll use ifcfg-em1 and ifcfg-em2 for these examples and assume you have console access.

Symptoms: one of your nics has died and the software on the server is dependent on the interface name. i.e. Oracle RAC

First you will need to reboot afterwards, there was no way around it for myself.  Give yourself that luxury instead of thinking you can just do a <code> service network restart </code> to finish it. Start by creating backups of ifcfg-em1 and ifcfg-em2. Rename ifcfg-em1 to ifcfg-em3 and then ifcfg-em2 to ifcfg-em1.

Next create a file if it does not exist already of "/etc/udev/rules.d/70-persistent-net.rules".  If it does not exist you can attempt to create it using the automated tool of "/lib/udev/write_net_rules all_interfaces".  This method did not work for me and I had to create the file manually which did work.  *Note you are swapping the MAC addresses here and putting what you WANT em1 and em2 to be.

</etc/udev/rules.d/70-persistent-net.rules>
 # PCI device 0x14e4:0x163a (bnx2) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:11:22:33:44:55", ATTR{type}=="1", KERNEL=="em*", NAME="em1"

# PCI device 0x14e4:0x163a (bnx2) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:11:22:33:44:44", ATTR{type}=="1", KERNEL=="em*", NAME="em2"
</etc/udev/rules.d/70-persistent-net.rules>

Once you've confirmed those two things are done reboot the server and it'll come back up proper. Took a lot of searching to get all this set up correctly.  Hope this helps someone else.

Friday, June 21, 2013

Breaking a Bonded interface on RHEL

Today I had to break a bonded interface on a server running RHEL 5.  The bond was not a port channel but rather a fail-over setup.  The end result was to have only eth0 still up but if possible not bring down the box to do it.  Here's how I did it and a link to the original site I pulled it from.  You can also look in the documentation on the box if you don't have the interwebs available at the time.


For more reference to use there values you can check, in your linux box :  /usr/share/doc/kernel-doc-2.6.18/Documentation/networking/bonding.txt 

>>>> 3.  How to Gracefully Break the Bonded Network Interface?
In Sample Configuration is we have bond0 configure for two interface name eth0 and eth1, and bond running configuration looks as 
# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.4.0  Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
Slave Interface: eth0
MII Status: up
Link Failure Count: 0
Permanent HW addr: 53:44:00:43:91:04
Slave Interface: eth1
MII Status: up
Link Failure Count: 0
Permanent HW addr: 52:33:00:6d:0e:70
The process to break the bonded interface is :
a.  Online remove one slave network interface which will be assigned with a new IP address from the bonding device. In this example, we are going to remove the eth1 from bond0. Execute the following command as root:
# ifenslave -d bond0 eth1
Or
# echo -eth1 > /sys/class/net/bond0/bonding/slaves
After issue the command above , You will see the eth1 device has been remove from bond0 # cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.4.0 
Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
Slave Interface: eth0
MII Status: up
Link Failure Count: 0
Permanent HW addr:  53:44:00:43:91:04
b. Create a new network configuration for eth1 via graphic tool or text tool and then using following command to start eth1 again. Make sure the physical link has been changed correctly to match the new network configuration of eth1.
# ifup eth1
During the above 2 steps, the network of bond0 will work fine without any break up.
c. Create the same network configuration as bond0 for eth0 
 – just copy the content of /etc/sysconfig/network-scripts/ifcfg-bondX to  /etc/sysconfig/network-scripts/ifcfg-eth0, except the interface name and HW MAC address.
d. Remove the eth0 from bond0, destory the bond0 device and start eth0 immediately.
Please note this disruptive operation, The network of bond0/eth0 will break shortly during this step. # ifenslave -d bond0 eth0; ifdown bond0; ifup eth0
# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.4.0 
Bonding Mode: load balancing (round-robin)
MII Status: down
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
now ifconfig will show the configuration for only eth0 and eth1, no bonding interface appears.
e. Remove all bonding setting of bond0 in /etc/modprobe.conf and remove the ifcfg-bond0 in /etc/sysconfig/network-script directory. Then issue following command to remove the bond0 device from memory completely.
# echo -bond0 > /sys/class/net/bonding_masters

Monday, March 18, 2013

Updating iDRAC firmware from linux

Here are ways to update the firmware on Dell iDRAC6 remote access cards.

Both methods require downloading the BIOS from Dell and extracting it from the bundle. For example, this is the 1.70.21 firmware:
mkdir /tmp/dell
cd /tmp/dell
wget http://ftp.dell.com/esm/IDRAC6_FRMW_LX_R299265.BIN


Grab this and extract like this:
cd /tmp/dell
sh IDRAC6_FRMW_LX_R299265.BIN --extract ./idrac6-1.70.21

The firmware image is now in /tmp/dell/idrac6-1.70.21/payload/firmimg.d6

If using the CMC to update the firmware upload the extracted firmimg file, NOT THE BIN!

If you are just updating one machine, then the simplest way to perform the update is to use the Dell bmcfwul tool locally. This is supplied in the dell_ie_nitrogen package, and is installed to /usr/libexec/dell_dup/dell_ie_nitrogen/bmcfwul.

Install the new firmware like this:
/usr/libexec/dell_dup/dell_ie_nitrogen/bmcfwul -input=/tmp/dell/idrac6-1.70.21/payload/firmimg.d6
If you have several machines to update, the most convenient way to perform the update is with tftp.

First, copy the firmware image to the tftp server, and put it in /tftproot, or wherever the root of your tftp server is located:
scp /tmp/dell/idrac6-1.70.21/payload/firmimg.d6 $ip_of_tftp_server:/tftproot

Then, trigger a firmware upgrade on the machines remotely using either racadm or ssh:
racadm -r host.to.update -u root -p calvin fwupdate -g -u -a $ip_of_tftp_server
or
ssh host.to.update racadm fwupdate -g -u -a $ip_of_tftp_server

http://yo61.com/updating-dell-idrac6-firmware-linux.html