Managing Self Signed Certs and When They Expire

Have you ever walked in to work one morning to have people jump on you stating nothing is working?  You never got any pages from your monitoring system.  Everything appears to still be up.  Come to find out one of your self sign SSL certificates expired and needs updating.  Well, it has happened to some of the Windows Admins I have worked with.  It is difficult to track and manage self signed certificates.  Even if you have a good handle on it, and have automated reminders about certificates that will expire, it can slip by.  I came across a utility (script) called "ssl-cert-check.bash" found here:  http://prefetch.net/articles/checkcertificate.html  And, this does almost exactly what I want.  This will show you and even e-mail you if you have any servers with expired certificates.  I wanted to take it one simple step further...  I want a report e-mailed to my department regarding the status of all certificated whether they expired or not.  So here is what I did.  On a linux server I put the "ssl_cert-check.bash" file in my utility user's home "bin" directory.  I then created a file called ssldomains.txt (following the format described in the link above) containing the list of servers that have ssl certificates.  I then created a file called "cert_report.bash" in the same bin directory.  It's contents looks like this:
-----------------------------------------
#!/bin/bash
#
# SCRIPT: cert_report.bash
# AUTHOR: Bob
# DATE: Sep 24, 2012
# REV: 1.1.P (Valid are A, B, D, T, Q, and P)
# (For Alpha, Beta, Dev, Test, QA, and Production)
#
# PLATFORM: Not platform dependent
#
# PURPOSE: This script will call another script to report SSL Cert
# expiration days, save to a text file, and e-mail that text
# file.
#
# set -n # Uncomment to check script syntax, without execution.
# # NOTE: Do not forget to put the # comment back in or
# # the shell script will never execute!
# set -x # Uncomment to debug this shell script
#
##########################################################
# DEFINE FILES AND VARIABLES HERE
##########################################################
THIS_SCRIPT=$(basename )

##########################################################
# DEFINE FUNCTIONS HERE
##########################################################
　

##########################################################
# BEGINNING OF MAIN
##########################################################
~/bin/ssl_cert_check.bash -f ~/bin/ssldomains.txt > /tmp/SSL_Cert_Report.txt

echo "Attached is the bi-monthly SSL Certificate Expiration Report." | mutt -s "SSL Cert Check Report" -a /tmp/SSL_Cert_Report.txt mydepartment@mydomain.com

# End of script
----------------------------------------------

I then added an entry in cron for this to run twice a month.
0 8 1,15 * * ~/bin/cert_report.bash

This delivers a nicely formatted report of my servers and their certificate status.  Here is an example of the e-mailed report.

Host                                                    Status        Expires        Days
-------------------------------------------  ------------ ------------      ----
appsrv.mydomain.com:443                Valid       Jul 7 2014      643
lync1001.mydomain.com:443            Valid       Feb 13 2013   134
monitor01.mydomain.com:443          Valid       Feb 13 2013   134
idm.mydomain.com:443                     Valid       Oct 14 2021   3299
mail.mydomain.com:443                    Valid       Jul 10 2014   646
ntsrv1.mydomain.net:3471                 Valid       Aug 30 2013 332
ops1003.mydomain.net:3471              Valid       Feb 13 2013 134
web1003.mydomain.net:4443             Valid       Oct 14 2021 3299
web1004.mydomain.net:4443             Valid       Oct 14 2021 3299
report.mydomain.com:443                  Valid       Jul 7 2014    643
reportdev.mydomain.com:443            Valid       Jul 7 2014    643
srvavautil.mydomain.net:443              Valid      Mar 15 2019 2355
srvmail1002.mydomain.net:443          Valid      Jul 10 2014   646
srvmom01.mydomain.net:443             Valid      Mar 3 2028   5631
srvmoss001.mydomain.net:443           Valid      Aug 1 2013   303
srvocs2001.mydomain.net:443            Valid     Dec 29 2012   88
srvrecord2001.mydomain.net:443       Valid      Feb 13 2013   134
srvslshd1001.mydomain.net:443          Valid      Dec 14 2014   803
srvunibackup1001.mydomain.net:443  Valid      Sep 6 2014    704
srvvault2001.mydomain.net:443          Valid       Sep 6 2014   704
srvwas2001.mydomain.net:443            Valid       Jan 5 2020   2651
srvwcs2001.mydomain.net:443            Expired   Dec 16 2011 -291
app.mydomain.com:443                       Valid       Jul 9 2014     645
sftp.mydomain.com:443                       Valid       Feb 10 2015  861
solarwinds.mydomain.com:443            Valid       Feb 13 2013  134
support.mydomain.com:443                 Valid       Jul 9 2014     645
vcenter01.mydomain.com:443             Valid       Sep 27 2021   3282

Thermaltake - Dual Bay Docking Station for SATA drives

I bought one of these little gems at Best Buy recently.  I love it.

I use it on my Linux and Windows Servers/PCs to copy, image, and access SATA drives.  It works with 3.5 inch and 2.5 inch SATA drives.  I bought mine on-sale for $59.00.  It can access two drives at a time and can be connected to your computer with the supplied USB or eSATA cable.  This comes in very useful in my line of work.  It sure beats an external inclosure.
You can read more about it here:  http://www.thermaltakeusa.com/Product.aspx?C=1346&ID=1895

Backing Up your Laptop or PC - Easy!

I was using a program called G4L to image my laptop or pc but I have found a much easier way.  It works with Linux or Windows, no installation is needed, allows you to resize partitions, backup systems, access files, and recover lost data.  It is a live CD called "Redo".  Check it out here http://redobackup.org/.  It rocks!

Taken from the site:

Redo Backup and Recovery is so simple that anyone can use it. It is the easiest, most complete disaster recovery solution available. It allows bare-metal restore. Bare metal restore means that even if your hard drive melts or gets completely erased by a virus, you can have a completely-functional system back up and running in as little as 10 minutes.


All your documents and settings will be restored to the exact same state they were in when the last snapshot was taken. Redo Backup and Recovery is a live CD, so it does not matter if you use Windows or Linux. You can use the same tool to backup and restore every machine. And because it is open source released under the GPL, it is completely free for personal and commercial use.

Backing Up a django Web Server

I have a webserver I want to backup weekly and keep 4 weeks of backup history.
The webserver runs CentOS 5.4 and Django.
In the event of a server crash I'd like to be able to recover my website rather easily.  I figure it would be relatively easy to reinstall the OS and install the applications.  Then all I would need to do is restore the configuration files and the database.

Assumptions:
You have django installed and working
$DBDUMPDIR = where ever you want the Database Dump files to go
$BKUPDIR = where ever you want the Backup files to go.  Note:  This backup directory could be a remote server such as an NFS mount or SMB mount.  This is suggested so if this server crashes, your backups would be on another server.
Edit the scripts below to for "your" appropriate directories and file names.



Here are the four files I will need to backup:
*  /etc/httpd/conf/httpd.conf
*  /etc/httpd/conf/mysite.conf
*  /etc/www/django
*  $DBDUMPDIR/data.json

I created a script called dumpfiles.bash and put it in root's bin directory "/root/bin/dumpfiles.bash".
Make sure that permissions are right to be able to execute the file.
chmod 770 /root/bin/dumpfiles.bash

Here is the script:
----- start of script -----
#!/bin/bash
#
# SCRIPT: dumpfiles.bash
# AUTHOR: Bob
# DATE: 07/01/2010
# REV: 1.blah
#
# PURPOSE: This script is used to backup webserver specific data
#
# set -x # Uncomment to debug this script
#
# set -n # Uncomment to check the script.s syntax
#        # without any execution. Do not forget to
#        # recomment this line!
#
####################
# Define Variables #
####################
# Capture the shell script file name
THIS_SCRIPT=$(basename $0)
#
# Define the start time of the script
STARTTIME=`date +%T`
#
#Set Backup and DB Dump Directories
#Change the directories below to match your environment
BKUPDIR=/mnt/backup/webserver
DBDUMPDIR=/root
#
##################
# Increment Backups #
##################
rm -f $BKUPDIR/bkup4.tar.gz
mv -f $BKUPDIR/bkup3.tar.gz $BKUPDIR/bkup4.tar.gz
mv -f $BKUPDIR/bkup2.tar.gz $BKUPDIR/bkup3.tar.gz
mv -f $BKUPDIR/bkup1.tar.gz $BKUPDIR/bkup2.tar.gz
#
###################
# Dump Database #
###################
# export PYTHONPATH for dumpdata script
export PYTHONPATH='/var/www/django':'/var/www/django/apps'
#
#Change Directories to /var/www/django/mysite
cd /var/www/django/mysite
#
#Backup the DJango database and files to a flat file
python manage.py dumpdata > $DBDUMPDIR/data.json
#
#Get out of the /var/www/django/mysite directory
#Let us go home
cd /root
#
###############################
# Backup and compress important files #
###############################
tar cvfz $BKUPDIR/bkup1.tar.gz /etc/httpd/conf/httpd.conf /etc/httpd/conf.d/mysite.conf /var/www/django $DBDUMPDIR/data.json
----- end of script -----

I want to schedule a weekly backup so I'll use root's cron to do this.
Edit root's cron (assuming you are logged in as root).

Enter the following line to root's cron.
0 4 * * 1 /root/bin/dumpfiles.bash

This will run the script every Monday morning at 4:00 AM.
Now each time the script runs bkup1.tar.gz will be created.  If it already exists the old files will be incremented up to the number 4 giving you four weeks of backup files.

In the event of a disaster and you rebuilt a new server, you'd untar the backup files and copy the files back to their appropriate place and you the manage.py script to restore the django database.

Hope this helps someone out there.

Expect - Using expect to Automate Processes or Generate Reports

I have 51 Linux servers that I manage (soon to grow to well over 70).  Over the past year the company I am with has moved and we have redesigned the network (a few times).  During this redesign we changed which servers provide DNS and NTP services.  I like to think I am a pretty thorough person and believe I updated all 51 servers with the correct DNS and NTP IP Addresses, but I also want to validate my thoroughness as a sanity check and a c.y.a. BTW - I use IP Addresses for the DNS and NTP settings just in case DNS is unavailable

I really don't want to log in to 51 different servers and verify the contents of 3 different configuration files on each of these servers.  It would be nice if I could spend a few minutes writing a script that could poll each server and write out a report that I could review.  So that is just what I did.

A few things I needed to have in place before I got started.
1.  A linux account defined on all 51 servers that has remote SSH permissions and the ability to read the three configuration files I am interested in.  I don't allow root to remotely SSH to any server.
2.  On the computer I will be running the script from (my Linux laptop) a linux utility called expect.
3.  A list of all 51 servers in a text file.

Number 1 is easy as I have a service account (we'll call it saccount) that has access to every server but has very little permissions (but enough to read the files I am interested in).  For number 2 I had to install expect on my laptop which is running a flavor/type-of Redhat Linux.  Expect should be available in your repository for updates.  Number 3 was easy too.  I had a file containing all of my Linux servers.

I ended up with 3 files (not including the report file generated after running the script/s).
File 1:  serverlist.txt - this file contains a list of my servers.  One server name per line.  Example:
serverA
serverB
serverC
server1
server2
server3
   you get the idea...

File 2:  dnsntpreport.exp - you can call it anything you want.  Just make sure it is executable.  the contents of the files are as follows:

   #!/usr/bin/expect -f
   spawn ./dnsntpreport.ksh
   expect {
   "*re you sure you want to continue connecting (yes/no)?"
   {send -- "yes\r\n"
   exp_continue}
   "*assword:*"
   {send "#######\r\n"
   exp_continue}
   }
   exit

where you see #######, you would put the actual password for the user you are using.  This script will watch for certain prompts and answer them with the text you entered automatically.

File 3:  dnsntpreport.ksh - you can call it whatever you want but notice that the above script will call this script so if you change the file name you will need to edit the script above.  The contents of this script are as follows:

   #!/bin/ksh
   for line in $(cat ./serverlist.txt)
   do
   echo -e "\n###$line###" >> dnsntp_report.txt
   echo -e "/etc/resolv.conf file" >> dnsntp_report.txt
   ssh saccount@$line grep -e "10\." /etc/resolv.conf >> dnsntp_report.txt
   echo -e "\n/etc/ntp.conf file" >> dnsntp_report.txt
   ssh saccount@$line grep -e "10\." /etc/ntp.conf >> dnsntp_report.txt
   echo -e "\n/etc/ntp/step-tickers file" >> dnsntp_report.txt
   ssh saccount@$line grep -e "10\." /etc/ntp/step-tickers >> dnsntp_report.txt
   echo -e "###" >> dnsntp_report.txt
   done

So what is going on here?  File 3 will SSH to a server and look through three files for IP Addresses starting with a "10" and record its finds to a file called dnsntp_report.txt.  During our moves and reconfigures the first octet has remained "10" but the others have changed.  Of course when you SSH to a server (assuming you do not have Passwordless SSH setup) you are sometimes prompted whether you trust the key and then for a password.  This is where File 2 comes in and is actually the file you execute from the command-line since it will call File 3.  This file (File 2) will look for two specific prompts and answer them automatically so we don't have to respond 51 or more times.  Obviously, where you see "saccount" in the above script replace with the account you are using.  Remember, the password is stored in File2.

Assuming you have all three files in the same directory and File 2 and File 3 executable all you need to do is run File 2 from the command line.  After the script runs you should have a text file called dnsntp_report.txt that indicates the settings you were (or in this case I was) interested in.

I hope this helps someone else out there.

snmpd Information Filling up the /var/log/messages File

I am using net-snmp on my linux servers so cacti can poll for data and graph statistics.  I noticed that the /var/log/messages file was filling up with snmpd messages.  All of which were merely informational and benign.  I know snmpd works and is configured properly and those log messages in my /var/log/messages file makes it hard to find anything useful in it.

I found that (at least in the version of net-snmp that I am using) debug logging is turned on by default.  Well, I don't want debug level logging.  In fact I don't want any logging for snmpd to go to my /var/log/messages file.

I run Oracle Enterprise Linux and Ubuntu.

On any flavor of Red Hat Enterprise Linux (example:  RHEL, OEL, CentOS) modify the /etc/sysconfig/snmpd.options file.  If it doesn't exist, create it.

The contents of that file should be changed to this:

     # snmpd command line options
     OPTIONS="-Lf /dev/null -p /var/run/snmpd.pid -a"

This will turn off all logging for snmpd.  Remember to restart snmpd for the changes to take affect.
     service snmpd restart

On Ubuntu edit the /etc/init.d/snmpd file and change the line that looks like this:
     SNMPDOPTS='-Lsd -Lf /dev/null -p /var/run/snmpd.pid'
to this
     SNMPDOPTS='-Lf /dev/null -p /var/run/snmpd.pid'

That's it.  Remember to restart snmpd for the changes to take affect
     /etc/init.d/snmpd restart

Interactive Tape Backups using TAR and Linux

I sometimes want to run an on-demand backup of either a particular directory or file system.  I wrote an interactive script to do this and thought I would share it.
Assumptions:
1.  You have a tape device attached to your Computer or Server.
2.  You know what device your tape drive is.  Example: /dev/st0
3.  You have the mt-st package installed to manage the tape device.
4.  The tape you are using will be overwritten.
5.  You copy the contents of the script below in to a utility like notepad and check the contents.  Then copy from there in to a script called (whatever you want).
6.  Pay close attention to the command that starts like this:  TAPECHK=$(mt  It show up correctly in this post but if you cut and past the script in to notepad the lines do not match.  Edit it so it looks like it does here in the post.
7.  You make the script executable.
8.  I placed the script in /usr/local/sbin but you can put it where ever it make sense to you.

Here is the script:

#!/bin/bash
#
# SCRIPT: Interactive_2_tape.bash
# AUTHOR: Bob
# DATE: 02/24/2010
# REV:
#
# PURPOSE: This script is used to backup files
# from $SOURCE to $TAPEDEV
#
# set -x # Uncomment to debug this script
#
# set -n # Uncomment to check the script.s syntax
#        # without any execution. Do not forget to
#        # recomment this line!
#
####################
# Define Variables #
####################

# Capture the shell script file name
THIS_SCRIPT=$(basename $0)

# Define the start time of the script
STARTTIME=`date +%T`

# Define current directory to return to at end of script
CURRENTDIR=$PWD

# Ask for the source of the backup
echo "What directory or filesystem do you want to backup?"
echo "Type the directory in this format /dir1/dir2 followed by [ENTER]:"
read SOURCE
echo "Using $SOURCE as the source directory you want to backup."

# Ask for tape device
TAPEDEV="/dev/st0"
echo "I assume your tape device is $TAPEDEV"
read -p "Am I correct? yes/no: "
if [ "$REPLY" = "no" ]; then
     echo "What is your tape device? "
     read TAPEDEV
     echo "Using $TAPEDEV as your tape device."
else
     echo "Using $TAPEDEV as your tape device."
fi


################
# Main Section #
################

# Verify there is a tape in the
# drive and rewind the tape
TAPECHK=$(mt -f $TAPEDEV rewind 2>&1 1>/dev/null)
# If there is no tape tell me and exit out
#  If the mt command return any data then there is an error
#  Check the results of the mt command
if [ "$TAPECHK" != "" ]; then
     echo $TAPECHK
     echo "Check to see if there is a tape in the drive or if the device you entered is valid."
     exit
fi

# If we made it here, there is a tape in the drive and it has rewinded.
# Change to the directory to be backed up
cd $SOURCE
echo "Changing to the $SOURCE directory."

# Back up data
tar cvf $TAPEDEV .

# Rewind the tape again
mt -f $TAPEDEV rewind

# Change back to the directory from where you came
cd $CURRENTDIR
echo "Changing back to the directory you started from: $CURRENTDIR"
# Define the end time of this script
ENDTIME=`date +%T`

# Display the start and end time of this script
echo "$THIS_SCRIPT began at $STARTTIME and finished at $ENDTIME"

exit
#################
# End of Script #
#################

I hope this helps others out there trying to do the same thing.

Using tar to Copy a Large File into a Tight Space

I do a lot of work with virtual machine images.  I ran in to a situation where I wanted to copy a file called System.img from one server to another and even though I knew I had enough room to do it, I would get messages stating that there was not enough space.  What in the world was going on?  The file system I wanted to copy the file to was 33G in size.  The file was just under 33G in size.  I knew it should fit.  I knew this because the file system this file is coming from is also 33GB in size (same identical size).  When it was all said and done I should of had about 150M of free space according to the source.

I tried FTP, SCP, and various other mechanisms to copy the file from the one server to the other.  No joy.
So I copied the file to the destination server but to a different and larger file system.  That obviously was successful, but I still wanted it on my 33G file system.  So I tried copying the file locally from the larger file system to the 33G file system.  No joy again... I got a message after a few minutes stating there was not enough space, and the process errored out.

I found a solution!  Now, to be honest, I do not know why it works, but it does.

Assumptions: You are in the directory the System.img file is located.  The file resides on the same server you are copying to.  You have done the math and according to the calculator the file will fit on the destination file system.

Run this command with the appropriate path of your destination.

Note:  The following command is all on one line.
# tar cvf - System.img | ( cd /destination file system/destination folder/;tar xvf - )

Works like a charm.  I have used this little gem a dozen times in the past few months.

This should be obvious but...  Remember, you can not copy/place a file that is larger than the space available on the destination.  Hope this helps others out there.

Managing and Archiving Log Files Using Find and Tar

You could probably write a script and put this in the cron scheduler...  Here is the quick and dirty manual way to do it.

I wanted a way to archive everything in a particular directory and remove files (and only files) in that directory.  I was running out of space on one of my filesystems and I knew "log" files were eating up most of my space.  I still had plenty of space on my /tmp filesystem.  I wanted to get rid of files older than 15 days after I archived them so here is what I did.

I created a place for my archive files.
# mkdir -p /tmp/logs

I then changed directories to the place the log files lived.
# cd /(path to log files)/

I then, as a sanity check, ran this command to make sure it included the files I wanted and excluded those I didn't.
# find . -mtime +15 | xargs ls -l

After I validated this list was the files I wanted to archive, I ran the following command to tar and compress the files.
# find . -mtime +15 | xargs tar cvfz /tmp/logs/111609logs.tar.gz

This will tar up and compress everything older than 15 days.  I named my log file using a date stamp 15 days in the past. Now I want to remove files older than 15 days, but only files, not directories.  I used this command.
# find . -type f -mtime +15 | xargs rm -f

The "find" command will find everything so using the "-type f" option it will only find files.

I was able to free up about 3GB.  I hope this helps others out there.

Copying Directory Structures Between Linux or UNIX Systems

As I build or rebuild servers that need a particular directory structure, I wanted a fast way to replicate or reproduce the empty directory structure with the appropriate owners and permissions.  Historically, I would have used the tar command for this and only selected directories.  There is another, and in my opinion more efficient, way to do this using the cpio command.

I wanted to recreate the following two directory structures (including all sub-directories, which there are many of):
/u02/prn/app
/u02/prn/oradata

On the server you want to model the directory structure(s) after you would run the following commands.
# find /u02/prn/app -type d | cpio -ov >/tmp/appdirs.cpio
# find /u02/prn/oradata -type d | cpio -ov >/tmp/oradatadirs.cpio

Now using "scp" I can copy these files to the server I want to recreate the directory structure on.
# scp /tmp/*.cpio destination_server_here:/tmp/.

Now I will extract the archive which will create the directory structures I want (with the appropriate owners and permissions).  Note:  run this command from the "/" filesystem.  If you run it from /tmp, it will look for u02 in tmp.  It obviously doesn't live there.  So, do it from /
# cpio -iv </tmp/appdirs.cpio
# cpio -iv </tmp/oradatadirs.cpio

Done!  Not quite magic, but almost.

Assumptions:  You have the same users and groups created on the destination server as you do on the source server.

Hope this helps someone out there.

Virtual File Systems: For Fun, Security, and Profit

Assumptions:  Your OS is Linux.
Do you need to bring up an FTP or NFS server on an existing system but want to keep things separated? Do you wanted to have a portable file system you can take with you? Do you want to "hide" things but are not worried about encryption? With Linux it is possible and easy. Here’s how.

Creating a virtual file system.

Assumptions: You have a large file system with plenty of free space. For this example, we’ll assume this file system is mounted on /home and there is well over 20GB of free space available.

Make a file in your home directory called portable.ext3 (you can call it whatever you want).
# touch /home/bob/portable.ext3

Now, let’s make this file a 16GB “empty” file. What you say? That’s right. We are going to take the file portable.ext3 and make is 16GB is size but completely empty. How?
# dd if=/dev/zero of=/home/bob/portable.ext3 bs=16G count=1
So we are creating a file with a 16GB block size at a count of 1. So… 1 block, 16GB in size.

We now have an “empty” 16GB file. Let’s format it.

Wait a minute. It is a file. You can’t format it.

Yes we can.
# mkfs.ext3 /home/bob/portable.ext3
You may get a warning, but it can be ignored.

So now we have a 16GB file that has been formatted as an ext3 filesystem.

What is left to do? Mount it.
Create an empty directory so you can mount the filesystem.
# mkdir -p /home/bob/mntdir (you can call the directory whatever you want).

Now let’s mount it.
# mount –o loop,rw /home/bob/portable.ext3 /home/bob/mntdir

Ta-Da. Do a “df -h” and you should see your “new” 16GB filesystem.

What can you do with it? You can share it out using NFS. Have it as your FTP root. Or (assuming you are going to unmount it first) copy it to a large enough flash drive and take it to a different linux system. If you are not going to move it between systems, and it will only live on one box, you may want to edit your /etc/fstab so that it will be mounted the next time the system reboots.

Linux Authentication Integration with Active Directory

Note:  Since I originally posted this, Likewise Open came out with version 6.  The instructions below work for version 5.3 and 5.4.

I manage a few dozen Oracle Enterprise Linux (OEL) servers. The timeline to implement these servers and bring them in to production was extremely short. I wanted to have these servers integrated with Active Directory for user authentication. We didn’t have the time to implement any of Oracle's Single Sign On solutions. I also didn’t have the time to properly setup LDAP/WinBind/Samba, so I opted to create a user setup script which would insure the UID would be the same on all the servers. The script worked great. User setup was a snap. The downside was passwords. I set everyone’s password to a default password and set it to expire immediately. Once a user would log in, they would be prompted to change their password. Doesn’t seem like a big deal, but there are close to 40 servers that a user would need to do this on. Not ideal for a long term solution.

So, now that these servers are running in production, I needed to go back and implement a better way to manage user accounts in Linux.

I needed to test my implementation on a non-production server. I installed VirtualBox on my Windows 7 PC and installed OEL as a virtual machine. Perfect. Now I have a box I can break without affecting anyone else.

Next, I did some reading on various ways to authenticate Active Directory accounts on a Linux server. I found a Microsoft TechNet article that looked promising. From what I read, LDAP and LADP/Kerberos were probably not the best solutions. The author suggested Winbind. The article walked me through the steps. I was able to join the server to the domain. Wow, that was pretty easy. Now the true test; logging in. I could not log in to the server from the GUI. I could, however, SSH to the server and log in as my Active Directory persona. I checked log files, tried a couple dozen different things and got nowhere. Maybe the fix was easy and I just missed it. In either case, after spending about two (work) days trying to get it to work, I needed to find a different/easier solution.

Enter LikeWise Open.

Right from their website, LikeWise Open
• Joins non-Windows systems to Active Directory domains in a single step from the command line or from a GUI
• Authenticates users with a single user name and password on both Windows and non-Windows
• Enforces the same password policies for non-Windows users and Windows users
• Supports multiple forests with one-way and two-way cross forest trusts
• Caches credentials in case your domain controller goes down
• Provides single sign-on for SSH and Putty
• Next-generation authentication engine that supports Kerberos, NTLM, and SPNEGO
• No schema changes to Active Directory required

Instructions for install:
1. Download the installer package and make it executable.
2. Double click the package and install.
3. Join the server to the AD domain (/opt/likewise/bin/domainjoin-cli join domainName joinAccount).
4. Reboot
5. Login as an AD user (domain\username) from GUI or (domain\\username) from the command line or SSH.

Yes. It was that easy. It worked.

I wanted to make sure that a specific Active Directory group had “sudo” privileges, so I (as root) ran visudo to edit the sudoers file. The line added looked like this.
%MYDOMAIN\\Info^Services ALL=(ALL) ALL

If your group name has a space in it use the ^ charterer in place of a space.
Example: Info Services would be Info^Services
Note the double \ or \\. On the command line “\” is interpreted as an escape charterer so you need two of them.

I tried to sudo as me and it worked!

I change the group on a directory to an Active Directory group.
Example: # chgrp MYDOMAIN\\Info^Services /tmp/testdir

Then I did a: # ls -l /tmp

There it was. The group on the directory was MyDomain\Info^Services

Slick.

I still need to do a little research to make sure this solution meets my security requirements, but so far I am impressed.

P.S. In no way am I associated with the company LikeWise. I like the solution and thought others may too.

Imaging Your PC or Server

I have been using an open source tool called G4L for a while to create images of my PCs and Servers.  I figured I would share my process to help others looking to get images of their Windows or Linux Servers or PCs.  Hope this helps some of you out there. Of course, do this at your own risk. If you are not careful you can really mess things up.

Creating a server Image:

Prerequisites:
1. Laptop on the same network as the device to be imaged
2. FTP server on the Laptop capable of supporting files over 4GB.
FileZilla recommended.
http://filezilla-project.org/download.php?type=server
3. USB Harddrive connected to the laptop with two directories: img and g4l (by default g4l will look for and create images in the /img directory)
4. Get the g4l scripts (files3.tar.gz). File can be obtained at: http://sourceforge.net/projects/g4l/files/
5. Unzip the zip file to the g4l directory on the USB drive.

Assumptions:
1. You are using a CDROM ISO that is appropriate for your hardware platform architecture.

Windows or Linux - Use the G4L ISO. If you run in to issues regarding drivers, etc use Knoppix or System Rescue ISO.
     http://sourceforge.net/projects/systemrescuecd/files/sysresccd-x86/1.3.0/
     http://sourceforge.net/projects/g4l/files/g4l%20ISO%20images/g4l-v0.30.iso/g4l-v0.30.iso/download
     http://knopper.net/knoppix-mirrors/index-en.html
2. Server can be booted from CDROM Drive
3. Server can see the network after being booted from CDROM
4. FTP Server is started on the laptop, anonymous access granted, read/write/delete access granted, and the laptop is connected to the network.
5. Root directory of your FTP Server is your external USB hard drive attached to the laptop.

Instructions:

1. Boot Server from CDROM. G4L-ISO, Knoppix or System Rescue CD
1a.  If you are using the G4L-ISO you can skip down to step 17 assuming you have a DHCP server handing out an IP address.
2. Set IP Address if one was not assigned via DHCP (ifconfig eth0 10.10.10.75 netmask 255.255.255.0) - use your own IP and netmask here.
3. Test network connectivity by pinging the FTP server
4. Create directory /tmp/g4l (mkdir -p /tmp/g4l)
5. Change directories to /tmp/g4l (cd /tmp/g4l)
6. FTP to the FTP Server (ftp 10.10.10.17) - Use the IP of your FTP server.
7. Log in (anonymous)
8. Change to the g4l directory (cd g4l)
9. Turn on binary mode (bin)
10. Turn on hash mode (hash)
11. Turn off prompt (prompt)
12. Get the g4l scripts (mget *)
13. quit
14. Change directories to / (cd /)
15. export PATH=$PATH:/tmp/g4l/
16. chmod 777 /tmp/g4l/*
17. Run G4L (/g4l)
18. Answer the following prompts: Yes, OK, OK
19. Config option D with the appropriate IP Address of the FTP Server
20. Config option E - Set the username and password (anonymous:foo)
21. Config option F - Set the name of the file you will be creating
22. Select Option H
23. Select the partition/drive you want to image
24. Confirm image process is under way
25. Wait.
26. When complete, you can exit the g4l utility and halt the system.

Restoring a Server Image:

Prerequisites:
Same as above

Assumptions:
Same as above AND
1. The drive you will restore the image to is the same size or larger than the size of the drive you took the image from.
2. You know that by restoring your image to a drive of larger size will not automagically make your partition larger. If you restore to a larger drive you will need to use another tool (like gparted live) to change the size of your partitions.
3. You are fully aware that any data that existed on the drives prior to doing the restore will be wiped out. Make sure you restore an image to new drives, drives that contain no data, or drives you don't mind being wiped out.

Instructions:
Follow the same steps above until you get to #21
1. Here for option F, instead of putting in a name of an image to create, you will select the name of the image already created.
2. Instead of selecting option H to do a backup, select option I to restore.