convert vmdk from thick to thin

vmkfstools -i /vmfs/volumes/datastore1/somehost/somehost.vmdk /vmfs/volumes/datastore1/somehost/somehost-thin.vmdk -d 'thin' -a lsilogic

# adjust vmx and away you go.

loop-aes-utils, smbfs and Ubuntu

The following was experienced on Ubuntu Desktop 9.10

if you install loop-aes-utils, and then install smbfs, the cryptoloop.ko is removed from the kernel.

`mount` will give you errors like:

ioctl: LOOP_SET_STATUS: Invalid argument, requested cipher or key length (256 bits) not supported by kernel


`modprobe loop` will give you:

FATAL: Module loop not found


well, not sure what the whole story is, but the following fixes it.

`modprobe cryptoloop`

make a bootable custom rhel install disk

run from the root of where you have copied the RHEL disk to and your ks.cfg resides.

# mkisofs -o /root/x/rhel43_app.iso -b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table -R -J -V -T ./

compare directory trees

ssh server1 "find /usr/local/apache2/sites/htdocs/ -type f -exec basename {} \; | sort" > server1.txt; ssh server2 "find /usr/local/apache2/sites/htdocs/ -type f -exec basename {} \; | sort" > server2; comm -3 ./server1 ./server2

rpm packages by name only

rpm -qa --qf "%{NAME}\n" > hostname.rpm.txt

then you can compare to see what is missing.

comm -3 host1.rpm.txt host2.rpm.txt

ESXi 4.0 not booting off DVD ISO or Host CD/DVD Device with DVD's

I had some problems with booting off DVD iso's on nfs shares and DVD's in the Host system CD/DVD reader (which, incidentally is a SATA device, also problematic with ESXi according to some forums I've read). But I was able to get it to boot off the DVD media by burning the DVD iso to a physical disk and placing the disk in my client system DVD reader. Then, I set the boot options to delay by 5000ms, set the boot order in the VM's bios as removable,network,cdrom,hard drive, and then i started the vm. while it was sitting there trying to boot off the network, i used the little CD button above the vm console window to connect my local DVD drive to the vm through the VI4 client. This worked, it was slow but it worked and I was so happy!

List installed perl modules

perl -MCPAN -e 'print CPAN::Shell->r '

convert unix time to local time

date -R -d @1245049200

-R requests that date output in RFC 2822 format
-d requests that date output the date based on a string that follows

Set up SNMP v3 on Cisco IOS

conf t
snmp-server group group_name v3 priv
snmp-server group group_name v3 priv read secure_ro write secure_rw access 5
snmp-server view secure_ro internet included
snmp-server view secure_rw mgmt included
snmp-server user snmp_user iksecure v3 auth md5 auth_password priv des56 priv_password

access-list 5 permit host x.x.x.x
access-list 5 deny any log


show snmp group
show snmp user

Installing sshfs on RHEL5

installing sshfs on rhel5
yum install kernel-devel gcc
wget http://downloads.sourceforge.net/fuse/fuse-2.7.4.tar.gz
tar xvf fuse-2.7.4.tar.gz
cd fuse-2.7.4
./configure
make
make install
modprobe fuse
echo "modprobe fuse" > /etc/sysconfig/modules/fuse.modules
ls -la
wget http://dag.wieers.com/rpm/packages/fuse-sshfs/fuse-sshfs-1.9-1.el5.rf.i386.rpm
wget http://dag.wieers.com/rpm/packages/fuse/fuse-2.7.3-1.el5.rf.i386.rpm
rpm -Uvh ./fuse-2.7.3-1.el5.rf.i386.rpm
rpm -Uvh ./fuse-sshfs-1.9-1.el5.rf.i386.rpm

Remove nameserver references from resolv.conf

sed -i 'N;$!P;$!D;$d' /etc/resolv.conf

Howto Shrink a VM

First, run a script similar to the following, one for each significant mountpoint as defined in /etc/fstab

#!/bin/sh

cd /
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /tmp
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /home
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /var
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill
cd /usr
cat /dev/zero > zero.fill;sync;sleep 1;sync;rm -f zero.fill

# Delete this script

rm -rf /usr/local/jboss/server/default/log/*
cd /root/tools
rm -rf shrink.sh

Then shutdown the vm and close vmware workstation.
Run the following command at the Windows Command Interpreter.

vmware-vdiskmanager -k <path to vmdk>

chroot tor in openBSD

https://wiki.torproject.org/noreply/TheOnionRouter/OpenbsdChrootedTor

config check

#!/bin/sh
#written and tested on openbsd 4.4
#pf.master contains the last known good sha1 of pf.conf

MASTER=`cat ./pf.master`
DGST=`ssh fwmon@192.168.43.132 'sudo sha1 /etc/pf.conf | cut -d" " -f 4'`

#echo $DGST
#echo $MASTER

if [[ "${MASTER}X" == "${DGST}X" ]] ; then

#notify that unscheduled config has changed
#insert incident details into security db
echo "fw Config Secure"

else

#insert incident details into security db
echo "fw Config Breached"

fi

sed && awk one-liners

These guides are great. Thanks to all who compiled them.

Famous sed one-liners Explained, Part I
Famous sed one-liners Explained, Part II
Famous sed one-liners Explained, Part III

Famous awk one-liners Explained, Part I
Famous awk one-liners Explained, Part II
Famous awk one-liners Explained, Part III

Convert Windows CR/LF to Unix newlines

sed 's/.$//'

sed 's/^M$//'

Delete lines from a file by line number with sed

Today i decided to make a new monitoring tool, and I needed to make a list of all permutations of 3 in a set of 22. The set happens to be hostnames of a private Tor network. Order is important, as forming 3-hop circuits through Tor is sequential, which is why i need permutations instead of combination's.

22 * 21 * 20 = 9240 permutations

Crap, I'm not really up on my combinatorial number theory, I guess I'll have to hack it up.

First I used an excel plugin to generate all the permutations.

But this ended up giving me 1408 invalid permutations, because the mix of sets had 10647 results. I copied the results into a text file and counted the number of lines as well as obtained the line numbers of the invalid permutations using this script:
----------
#!/bin/sh

tornames=("tornode01" "tornode02" "tornode03" "tornode04" "tornode05" \
"tornode06" "tornode07" "tornode08" "tornode09" "tornode10" \
"tornode11" "tornode12" "tornode13" "tornode14" "tornode15" \
"tornode16" "tornode17" "tornode18" "tornode19" "tornode20" \
"tornode21" "tornode22")

for i in ${tornames[*]};
do
while read line; do echo $line|tr " " "\n"|grep $i |wc -l; done < ./vc_list.bak > ./lines.$i
grep -rn '3\|2' ./lines.$i | cut -d: -f1 > ./lines.$i.ln
done
----------

It saved a bunch of files for me as: lines.[hostname], containing a number on each line indicating the number of times the hostname appears on each line.
Then it grep'd out the lines with a 2 or a 3, asking grep to return the line number, and cut the line number from the output to a file named: lines.[hostname].ln

Then at the command line I did this:

# cat ./lines.*.ln > line.numbers.all
# sed 's/.*/&d/g' ./line.numbers.all > ./delete.sed
# sed -f delete.sed ./file.master >> file.trimmed

Using a sed delete file...finally I had my 9240 valid permutations:

# cat ./file.trimmed | wc
9240 27720 254520

Next I want to make this text list into an array that I can `source` into the monitoring script as an array.

# rsync ./file.trimmed ./perms_array.sh
sed -i -e 's/^\./perms_array.sh

Almost done, I just need to fill in the array number with another sed expression.

# sed = ./perms_array.sh | sed 'N; s/^// ; s/\nperms\[// ; s/^/perms\[/' > \
./perms_array.final.sh

and now to put quotes around the array value:

# sed -e 's/\=/\=\"/' < ./perms_array.final > ./perms_array.final.new && rsync ./perms_array.final.tmp ./perms_array.final
# sed -e 's/$/\"/' < ./perms_array.final > ./perms_array.final.new && rsync ./perms_array.final.tmp ./perms_array.final

here's what the file looks like:

perms[1]="tornode01 tornode02 tornode03"
perms[2]="tornode01 tornode04 tornode05"
perms[3]="tornode01 tornode06 tornode07"
...

Now I can move on to write an essentially simple script that performs the test of all possible virtual circuits.

SNMPv3 Quickstart

i DONT claim this to be complete or authoritative. But, with these quick steps i was able to get snmpv3 working, a generally avoided version of a widely used protocol, and a fog to many sysadmins i've worked with. I'm sick of reading 10 pages of prose to get the steps i need to move securely forward in my projects.

0) yum install net-snmp.i386 net-snmp-libs.i386

1) Run snmpconf -i to create snmpd.conf and snmp.conf
- sudo /usr/bin/snmpconf -i

Notes:
- if you're regenerating the files at some point, cd into /etc/snmp, then run `snmpconf -i`. snmpconf looks in the local dir for files first before looking elsewhere. The resultant files are still saved to /usr/local/share/snmp/
- when creating snmp.conf, complete section 3: 2-10
- when creating snmpd.conf, complete section 4: 1-3
- when creating a new user while configuring snmpd.conf, choose 'priv' for the minimum security level. you can also restrict the user to a specific branch of the OID tree here as well.

2) Copy these files to /etc/snmp

rsync -av /usr/local/share/snmp/snmp.conf /etc/snmp/
rsync -av /usr/local/share/snmp/snmpd.conf /etc/snmp/

3) Run net-snmp-config to actually create snmpv3 user, here is the correct syntax...

net-snmp-config --create-snmpv3-user [-ro] [-A authpass] [-X privpass] [-a MD5|SHA] [-x DES|AES] [username]

Here's my command that corresponds to my previous configuration of snmp.conf and the test snmpget command further below in step 5:

net-snmp-config --create-snmpv3-user -ro -A authpass -X privpass -a SHA -x AES rouser

Note: the manpage for net-snmp-config has the X and x incorrectly in their example of create-snmpv3-user. The help cruft (for net-snmp-config --help) shows it correctly. I tried to create a read-write user (with -rw), but it didnt work. I dont change system parameters through snmp anyways, so it doesnt matter to me. Maybe the absence of [-ro] creates a read-write user? seems like ro should be the default unless -rw is specified. ???

4) Restart snmpd service

5) Make test snmpv3 request

snmpget -v 3 -n "" -u rouser -a SHA -A "authpass" -x AES -X "privpass" -l authPriv localhost system.sysUpTime.0

Notes:
- The `-l authPriv` argument specifies that the request should be both signed (-a SHA) and encrypted (-x AES).
- The command above can be greatly simplfied because most of these options have been declared in the snmp.conf.

install a perl module

perl -MCPAN -e 'install Net::SNMP'

or

perl -MCPAN -w -e 'shell'

CPAN> install Net::SNMP

Deployment Tools: Puppet

I've started looking at Puppet as the next gen tool for system deployments. Check it out.

http://reductivelabs.com/trac/puppet/wiki/DocumentationStart

It leaves cfengine and others in the dust...