Articles

Thursday, October 17, 2013

The database user 'vpxuser' does not have the following privileges on the 'VCDB' database

I ran into a minor issue while updating my vCenter Server to version 5.5 tonight. Below is screenshot of the error:


Simply add the permissions to the database to fix it:

use MSDB
go
sp_addrolemember @rolename = 'db_owner', @membername = 'vpxuser'
go
GRANT EXECUTE ON msdb.dbo.sp_add_category TO vpxuser
go
GRANT SELECT on msdb.dbo.sysjobsteps to vpxuser
go
GRANT SELECT ON msdb.dbo.sysjobs to vpxuser

Tuesday, September 3, 2013

VMware ESXi - Changing Round Robin IOP limit

Get the current setting for each storage device:

for i in `fdisk -l | grep 'Disk /dev/disks/t10' | cut -f4 -d'/' | cut -f1 -d':'`; do esxcli storage nmp psp roundrobin deviceconfig get -d=$i | grep -A 1
 Device:; done

Set all storage devices to 1 IOP per path:

for i in `fdisk -l | grep 'Disk /dev/disks/t10' | cut -f4 -d'/' | cut -f1 -d':'`; do esxcli storage nmp psp roundrobin deviceconfig set -t=iops -I=1 -d=$i; done

FreeNAS - Replacing a Failed Disk

Tonight I had to replace a disk in my FreeNAS box that was completely dead, as in, not detected by the BIOS. Below are the steps to replace a completely failed disk. The FreeNAS docs have an article on replacing a failed disk but it does not cover replacing a disk that is no longer detected by the system. You can read that article here.

A zpool status shows the disk as unavailable:

[root@freenas] ~# zpool status -v zpool0
  pool: zpool0
 state: DEGRADED
status: One or more devices could not be opened.  Sufficient replicas exist for
        the pool to continue functioning in a degraded state.
action: Attach the missing device and online it using 'zpool online'.
   see: http://illumos.org/msg/ZFS-8000-2Q
  scan: scrub repaired 0 in 6h31m with 0 errors on Sun Jul 28 06:31:27 2013
config:

        NAME                                            STATE     READ WRITE CKSUM
        zpool0                                          DEGRADED     0     0     0
          mirror-0                                      DEGRADED     0     0     0
            3282272283788900661                         UNAVAIL      0     0     0  was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db
            gptid/398a9808-fec4-11d5-a8b2-001f2961db70  ONLINE       0     0     0
          mirror-1                                      ONLINE       0     0     0
            gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70  ONLINE       0     0     0
            gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70  ONLINE       0     0     0

errors: No known data errors

Next I took a screenshot of all my disks via the webGUI and noted the serial numbers for the disks in the pool. The failed disk will not show up in the list so we can use that to identify which physical disk we need to pull. Next shutdown the server and start pulling one disk at a time until you find the one with the serial number that is not in your list of serial numbers. When you find it, pull it out and replace it with your new one noting the serial number of the new disk. Next power on the system and login via SSH.

Next, offline the failed disk:

[root@freenas] ~# zpool offline zpool0 /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70

Check the status of the disk to ensure it's offline:

[root@freenas] ~# zpool status -v zpool0
  pool: zpool0
 state: DEGRADED
status: One or more devices has been taken offline by the administrator.
        Sufficient replicas exist for the pool to continue functioning in a
        degraded state.
action: Online the device using 'zpool online' or replace the device with
        'zpool replace'.
  scan: scrub repaired 0 in 6h31m with 0 errors on Sun Jul 28 06:31:27 2013
config:

        NAME                                            STATE     READ WRITE CKSUM
        zpool0                                          DEGRADED     0     0     0
          mirror-0                                      DEGRADED     0     0     0
            3282272283788900661                         OFFLINE      0     0     0  was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db
            gptid/398a9808-fec4-11d5-a8b2-001f2961db70  ONLINE       0     0     0
          mirror-1                                      ONLINE       0     0     0
            gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70  ONLINE       0     0     0
            gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70  ONLINE       0     0     0


errors: No known data errors

Now replace the disk in the pool with your new disk. You can use the webGUI to get the block device name, looking for the serial number of the new device you noted above:

[root@freenas] ~# zpool replace zpool0 /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70 /dev/ada2

Now just online the disk and ensure its says the new disk is resilvering:

[root@freenas] ~# zpool online zpool0 /dev/ada2
[root@freenas] ~# zpool status -v zpool0
  pool: zpool0
 state: DEGRADED
status: One or more devices is currently being resilvered.  The pool will
        continue to function, possibly in a degraded state.
action: Wait for the resilver to complete.
  scan: resilver in progress since Tue Sep  3 21:32:02 2013
        28.1M scanned out of 3.53T at 1.17M/s, (scan is slow, no estimated time)
        15.4M resilvered, 0.00% done
config:

        NAME                                            STATE     READ WRITE CKSUM
        zpool0                                          DEGRADED     0     0     0
          mirror-0                                      DEGRADED     0     0     0
            replacing-0                                 DEGRADED     0     0     0
              3282272283788900661                       OFFLINE      0     0     0  was /dev/gptid/3937b1c2-fec4-11d5-a8b2-001f2961db70
              ada2                                      ONLINE       0     0     0  (resilvering)
            gptid/398a9808-fec4-11d5-a8b2-001f2961db70  ONLINE       0     0     0
          mirror-1                                      ONLINE       0     0     0
            gptid/998b8dc4-ff2b-11d5-a8b2-001f2961db70  ONLINE       0     0     0
            gptid/99e507d9-ff2b-11d5-a8b2-001f2961db70  ONLINE       0     0     0


errors: No known data errors

Friday, April 5, 2013

Run ZNC IRC Bouncer as a Service

Below is a simple init script that will run your ZNC server as a service. Create a new file in /etc/init.d/ called znc and paste the following code in it. 


#!/bin/bash
### BEGIN INIT INFO
# Provides:          znc
# Required-Start:    $local_fs $syslog $network
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start ZNC at boot time
# Description:       Enable ZNC provided by /etc/init.d/znc.
### END INIT INFO

PID=`pidof znc`

case "$1" in
    start)
        if [[ $PID != "" ]]; then
            echo "ZNC is already running"
            exit 1
         else
            echo "Starting ZNC"
            sudo -u ubuntu znc > /dev/null 2>&1
        fi
        ;;
    stop)
        if [[ $PID != "" ]]; then
            echo "Stopping ZNC"
            kill -9 $PID > /dev/null 2>&1
        else
            echo "ZNC is not running"
            exit 1
        fi
        ;;
    restart|reload)
        if [[ $PID != '' ]]; then
            echo "Stopping ZNC"
            kill -9 $PID > /dev/null 2>&1
            echo "Starting ZNC"
            sudo -u ubuntu znc > /dev/null 2>&1
        else
            echo "ZNC is not running"
            exit 1
        fi
        ;;
    status)
        if [[ $PID != "" ]]; then
            echo "ZNC is running"
        else
            echo "ZNC is not running"
        fi
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|reload|status}"
        exit 2
        ;;
esac



After you've created the file you need to make it executable:

chmod +x /etc/init.d/znc

Then to add it to your runlevels run:

sudo update-rc.d znc defaults

Edit:

Apparently I should have read the docs. In the ZNC wiki are instructions for doing this. Ah well...

http://wiki.znc.in/Running_ZNC_as_a_system_daemon

Wednesday, February 13, 2013

Setting up Zarafa on Debian

This is just my personal documentation on the process I use. I had this in a text file and didn't want to lose it so I figured I'd post it here. If it helps someone out, great.


1 - Install OS - Choose SSH and Web Server during tasksel package selection
                 Make sure to enable the extra repos

2 - Configure networking
nano /etc/network/interfaces
nano /etc/resolv.conf

3 - Install MySQL
apt-get install mysql-server

4 - Create MySQL user
mysql -u root -p
CREATE USER 'zarafa'@'localhost' IDENTIFIED BY 'password';


4 - Test PHP/Apache
echo '<?php echo phpinfo(); ?>' >>/var/www/index.php
* Be sure to delete this file after successfully testing that PHP is working :: rm /var/www/index.php

5 - Install Zarafa Common Package
dpkg -i zarafa-common_7.1.2-39121_amd64.deb

6 - Install Dependencies
apt-get install libboost-system1.42.0 libboost-filesystem1.42.0 libicu44

7 - Install Zarafa Server
./install.sh

8 - Test Zarafa WebAccess
http://<ip address>/webaccess/

9 - Grant priveleges (documentation was wrong)
mysql -u root -p
GRANT alter, alter routine, create, create routine, delete, drop, index, insert, lock tables, select, update ON zarafa.* TO 'zarafa'@'localhost' IDENTIFIED BY 'password';

10 - Restart Zarafa Server
/etc/init.d/zarafa-server restart

13 - Create Public Store
zarafa-admin -s
* If you the message 'The server is not running, or not accessable through file:///var/run/zarafa.' try restarting the Zarafa Server

14 - Verify Public Store was created successfully
zarafa-admin -s
* Should tell you: 'Unable to create store, public already exists'

15 - Create OU in AD for Zarafa users

16 - Install ADS plugin on DC
* Make sure the user is part of the Schema Admins group
* Right click, Run as Administrator
* View the Properties of a user and verify the Zarafa tab is available in AD Users and Computer snap-in

17 - Change user store in server.cfg to use LDAP (Need to work on using LDAPS for LDAP over SSL)
nano /etc/zarafa/server.cfg
user_plugin             = ldap

18 - Verify the user plugin path is set correctly for x86_64 systems
plugin_path             = /usr/lib64/zarafa

19 - Create AD user that Zarafa will use to bind to the LDAP database (need to figure out the least priveleged permissions for this to work)
     Create the user in the same OU or Container that the rest of the Zarafa users will be in

20 - Configure Zarafa to use ADS for user store
nano /etc/zarafa/ldap.active-directory.cfg

21 - Configure AD user for LDAP bind (Must be in LDAP DN format)
nano /etc/zarafa/ldap.active-directory.cfg
ldap_bind_user = cn=Zarafa,ou=ZarafaUsers,dc=domain,dc=local
* Make sure none of the CN's in the DN contain spaces
ldap_bind_passwd = password

22 - Set the LDAP search base
ldap_search_base = ou=ZarafaUsers,dc=domain,dc=local

23 - Rename the LDAP config.
mv /etc/zarafa/ldap.active-directory.cfg /etc/zarafa/ldap.cfg

24 - Restart Zarafa Server
/etc/init.d/zarafa-server restart

25 - Test that you can authenticate to Zarafa webaccess with an AD account

26 - Install Postfix
apt-get install postfix postfix-ldap
* Choose Internet Site during setup

27 - Add MX record to DNS server

28 - Postfix main.cf config
http://doc.zarafa.com/7.1/Administrator_Manual/en-US/html-single/#_MTAIntegration

nano /etc/postfix/main.cf

echo 'virtual_mailbox_domains = domain.local' >> /etc/postfix/main.cf
echo 'virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf' >> /etc/postfix/main.cf
echo 'virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf, ldap:/etc/postfix/ldap-groups.cf' >> /etc/postfix/main.cf
echo 'virtual_transport = lmtp:127.0.0.1:2003' >> /etc/postfix/main.cf

29 - Configure Postfix for LDAP authentication
touch /etc/postfix/ldap-users.cf
nano ldap-users.cf

server_host = 192.168.0.100
search_base = ou=Users,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
scope = sub
query_filter = (&(objectClass=user)(mail=%s))
result_attribute = mail
 
 
touch /etc/postfix/ldap-groups.cf

server_host = 192.168.0.100
search_base = ou=groups,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
query_filter = (&(objectclass=group)(mail=%s))
leaf_result_attribute = mail
special_result_attribute = member


touch /etc/postfix/ldap-aliases.cf

server_host = 192.168.0.100
search_base = ou=Users,dc=example,dc=local
version = 3
bind = yes
bind_dn = cn=zarafa,ou=Users,dc=example,dc=local
bind_pw = secret
scope = sub
query_filter = (&(objectClass=user)(otherMailbox=%s))
result_attribute = mail

30 - Restart services for changes to take effect
/etc/init.d/postfix restart
/etc/init.d/zarafa-dagent restart

31 - Configure the Dagent to start at boot time
update-rc.d zarafa-dagent defaults



## Hardening Zarafa ##



32 - Configure Zarafa to run as non-root

addgroup --system zarafa
adduser --system --home /dev/null --no-create-home \
     --ingroup zarafa \
     --disabled-password --gecos 'Zarafa services' \
     --shell /bin/false zarafa
chown -R zarafa:zarafa /var/log/zarafa
chmod -R 710 /var/log/zarafa/
 
33 - Setup Certificate CA for SSL

mkdir /etc/zarafa/ssl
chmod -R 700 /etc/zarafa/ssl
cd /etc/zarafa/ssl
sh /usr/share/doc/zarafa/ssl-certificates.sh server
 * Organizational Unit names must be different
 * No public key is needed
nano /etc/zarafa/server.cfg
 * Configure SSL settings
cp /etc/zarafa/ssl/demoCA/cacert.pem /etc/zarafa/ssl
chown -R zarafa:zarafa /etc/zarafa/ssl/
 
34 - Restart Zarafa
/etc/init.d/zarafa-server restart