Split DNS (Zimbra)

2022-06-05T11:51:49Z

Sstrutt: /* DNS Records */ Updated

[http://en.wikipedia.org/wiki/Split-horizon_DNS Split DNS] is required for [[:Category:Zimbra|Zimbra]] where your server is on an internal ([http://www.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces private address range]) network<ref name="PrivAddr" />.

Zimbra needs to be able to resolve its own Mail Exchanger (MX) [[Acronyms#D|DNS]] record, otherwise its services will not start. Therefore if your server is known publicly by one IP address, but in fact has a different internal address (and the public IP is [[Acronyms#N|NAT]]'ed to the internal IP) you'll need to use split DNS. This allows your server to be known by one IP address on the internet, and a different address internally, but with the same hostname regardless of where you are. There are two methods described below that enable you to achieve this...
# [[#Localhost DNS Server Setup|Localhost DNS Server Setup]] - DNS server installed locally on the Zimbra server.
# [[#Local Network DNS Server Setup|Local Network DNS Server Setup]] - DNS server on your local network, if you have one available.

'''Note that Split DNS, Split-Horizon DNS, Split-Brain DNS all refer to the same technique''', and the terminology can be used interchangeably.

== DNS Records ==
Firstly, you need to own a public DNS domain name, then create two DNS records...
# '''MX record''' - Mail Exchanger (MX) record
#* EG <code> sandfordit.com [MX] -> mail.sandfordit.com </code>
#* where <code> sandfordit.com </code> is the domain you own, and <code> mail.sandfordit.com </code> is hostname of your email server (the can be anything you like). Email addressed to <code><anything>@sandfordit.com</code> will be directed to the server in this record.
#* You'll need to give the record a weighting (this allows you to have multiple email servers for the same domain). The lower the number the higher the server's priority, assuming you only have one email server, its common to use <code>10</code>
# '''A record''' - Standard DNS record
#* EG <code> mail.sandfordit.com [A] -> 158.25.34.124 </code>
#* <code> 158.25.34.124 </code> is the static IP address assigned to your email server. You'll need to set-up a NAT on your router (often called a virtual server in domestic firewalls/routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).

Note, instead of an A record, a CNAME record can be used instead (though the CNAME record will still need to point to a valid A record). Using a CNAME can be preferable, where you might, in the future, want to send inbound email traffic to another email server, addressed by a different A record.

== Localhost DNS Server Setup ==
In order to get round the fact that your exchange server won't have the same IP (or name even) on the public internet as it will on your internal network, a DNS server is installed on the exchange server to provide MX record resolution. Procedure assumes DNS (Bind) is already installed (use <code>apt-get install bind9</code>.

Terminology...
* '''Private''' = Home or internal network IP address and network name (eg <code>192.168.1.150</code> and <code>mail.home.int</code>)
* '''Public''' = Global internet, ISP assigned IP address and registered domain name (eg <code>158.25.34.124</code> and <code>mail.sandfordit.com</code>)

Firstly, add the IP('s) of the DNS servers you use for resolution on your other machines to your local DNS server's list of forwarders (so that your exchange server forwards DNS resolution requests for unknown names to your normal DNS servers), edit <code>/etc/bind/named.conf.options</code>
<pre>
options {
directory "/var/cache/bind";
query-source address * port 53;

forwarders {
192.168.1.1; 158.25.30.10;
};

auth-nxdomain no; # conform to RFC1035
};
</pre>

Edit <code>/etc/resolv.conf</code> to force the server to use its local DNS server for resolution
nameserver 127.0.0.1

Restart bind using <code> /etc/init.d/bind9 restart </code> and check you can resolve external addresses properly.

Now create the internal zone that will eventually contain the local MX record for your exchange server, append the following to <code> /etc/bind/named.conf.local </code>, using your publicly registered domain name
<pre>
zone "sandfordit.com" {
type master;
file "/etc/bind/db.sandfordit.com";
};
</pre>

Lastly create the database file for you DNS domain <code>/etc/bind/db.sandfordit.com</code>, using your publicly registered domain name and private (internal) IP address for your exchange server...
<pre>
;
; BIND data file for sandfordit.com
;
$TTL 604800
@ IN SOA mail.sandfordit.com. admin.sandfordit.com. (
070725 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS mail
IN MX 10 mail
IN A 192.168.1.150
mail IN A 192.168.1.150
</pre>

== Local Network DNS Server Setup ==
This is most appropriate to use if you have an existing internal DNS server, that internal clients are already using. Note that all clients
of the DNS server will use it to resolve '''all''' addresses for the domain that your Zimbra server is on. So if your domain is <code>sandfordit.com</code>, all name resolution for that zone will be handled by it. So if you have a server on the internet (eg <code> www.sandfordit.com </code>, you will need to have a local record for it added to your DNS. Otherwise local clients will request a DNS resolution with your local DNS, which will simply respond that there is no such host, and the local client will be unable to connect.

So if you have to create a new zone in order to get Split DNS working, you may need to add additional records that replicate existing public DNS records. If you already have a zone in your DNS server (which should already be up to date), or have no other device address in that DNS domain, then this shouldn't be a problem.

If you are in any doubt, installing a local DNS server on your Zimbra server is the safest way to proceed. Any problems you cause should be restricted to that server, and won't impact any other working servers. One of the biggest risks when tinkering with DNS is that records get cached, everywhere, so once you've fixed whatever problem you've caused, you may have to wait days for the fix to have rippled around.

# If it doesn't already exist, create a new zone for your domain, eg <code> sandfordit.com </code>
# Within that zone, create an
#* '''A record''' for your server's hostname and internal IP address
#* '''MX record''', pointing to the A record just created

== Additional Notes ==
<references>

<ref name="PrivAddr">For example, your Zimbra server may have an IP address of 10.0.1.5 or 192.168.3.7, but from the outside world its accessible via a public address such as 159.105.10.35</ref>

</references>

[[Category:Zimbra]]
[[Category:DNS]]

Main Page

2022-06-05T11:51:09Z

Sstrutt: Remove SEO

__NOTOC__


{| style="width: 100%; margin:4px 0 0 0; background:none; border-spacing: 0px;"


| style="width:33%; border:1px solid #9eb19e; background:#fafffa; vertical-align:top; color:#000;" |
{| style="width:100%; vertical-align:top; background:#fafffa;"
! style="padding:2px;" | <h2 style="margin:3px; background:#ddeddd; font-size:120%; font-weight:bold; border:1px solid #9eb19e; text-align:left; color:#000; padding:0.2em 0.4em;">[[:Category:VMware|VMware]]</h2>
|-
| style="color:#000;" | <div style="padding:2px 5px">
* '''[[:Category:vCentre|Virtual Centre]]'''
* '''[[:Category:ESX|ESX]]'''
** [[ESX On ESX]] - Lab in a box
* '''[[:Category:Virtual_Machine|Virtual Machines]]'''
** [[VMware Converter]], [[OVF Tool]]
* '''[[:Category:PowerCLI|PowerCLI]]''', '''[[RemoteCLI]]''', '''[[vSphere Management Assistant|vMA]]'''
* '''[[VMware Server]]'''
* '''[[Lab Manager]]'''
* '''[[:Category:VCP|Certification]]'''
** '''[[VCP5|VCP5 Study Notes]]'''
** '''[[VCP4|VCP4 Study Notes]]'''
** '''[[VCP3|VCP3 Study Notes]]'''
</div>
|-
! style="padding:2px;" | <h2 style="margin:3px; background:#ddeddd; font-size:120%; font-weight:bold; border:1px solid #9EB19E; text-align:left; color:#000; padding:0.2em 0.4em;">To do</h2>
|-
| style="color:#000; padding:2px 5px;" | <div>

</div>
|}
| style="border:1px solid transparent;" |


| style="width:33%; border:1px solid #9eb19e; background:#fafffa; vertical-align:top;"|
{| style="width:100%; vertical-align:top; background:#fafffa;"
! style="padding:2px;" | <h2 style="margin:3px; background:#ddeddd; font-size:120%; font-weight:bold; border:1px solid #9EB19E; text-align:left; color:#000; padding:0.2em 0.4em;">Tools</h2>
|-
| style="color:#000; padding:2px 5px 5px;" | <div>
* '''[[:Category:PowerShell|PowerShell]]''' - Windows PowerShell
** '''[[:Category:PowerCLI|PowerCLI]]''' - VMware PowerShell module
** '''[[SNMP and PowerShell]]''' - PS SNMP client
* [[AutoIT]]
* [[MS-DOS]]
* [[PHP]]
* [[RRDTool]]
</div>
|-
! style="padding:2px;" | <h2 style="margin:3px; background:#ddeddd; font-size:120%; font-weight:bold; border:1px solid #9EB19E; text-align:left; color:#000; padding:0.2em 0.4em;">Operating Systems</h2>
|-
| style="color:#000; padding:2px 5px;" | <div>
* '''[[Windows 7]]'''
* '''[[Windows 2008]]'''
* '''[[:Category:Ubuntu|Ubuntu]]'''
* '''[[Linux]]''' - Generic commands
* [[Red Hat]]
* [[BusyBox]] - Cut-down Linux
</div>
|}
| style="border:1px solid transparent;" |


| style="width:33%; border:1px solid #9eb19e; background:#fafffa; vertical-align:top;"|
{| style="width:100%; vertical-align:top; background:#fafffa;"
! style="padding:2px;" | <h2 style="margin:3px; background:#ddeddd; font-size:120%; font-weight:bold; border:1px solid #9eb19e; text-align:left; color:#000; padding:0.2em 0.4em;">[[:Category:Applications|Applications]]</h2>
|-
| style="color:#000; padding:2px 5px 5px;" | <div>
* '''[[:Category:Zimbra|Zimbra]]''' - Email / collaboration
** [[Z-Push_v2_with_Zimbra|Z-Push]] - [http://en.wikipedia.org/wiki/ActiveSync ActiveSync] for Zimbra [[Acronyms#F|FOSS]]
** [[Monitoring Zimbra with Nagios]]
* '''[[:Category:Apache|Apache]]''' - Web server
* '''[[:Category:MySQL|MySQL]]''' - MySQL
* '''[[MS SQL]]''' - Microsoft SQL
* '''[[AWStats]]''' - Website analytics reporting
* '''[[Cacti]]''' - Capacity logging system utilising RRDTool
* '''[[Nagios]]''' - Monitoring system
* [[Useful Software|Other Useful Software]]
</div>
|-
! style="padding:2px;" | <h2 style="margin:3px; background:#ddeddd; font-size:120%; font-weight:bold; border:1px solid #9EB19E; text-align:left; color:#000; padding:0.2em 0.4em;">Random Info</h2>
|-
| style="color:#000; padding:2px 5px 5px;" | <div>
* [[:Category:Networking|Networking]]
* [[Large Memory Pages]]
* [[Regular Expressions]]
* [[Acronyms]]
</div>
|}

|}

<table style="margin:4px 0 0 0; width:100%; background:none; border-spacing: 0px;">
<tr>
<td style="width:100%; border:1px solid #9EB19E; background:#fff5fa; vertical-align:top; color:#000;">
<table style="vertical-align:top; background:#fafffa; color:#000; width:100%">
<tr>
<th style="padding:2px;"><h2 style="margin:3px; background:#ddeddd; font-size:120%; font-weight:bold; border:1px solid #9EB19E; text-align:left; color:#000; padding:0.2em 0.4em">New Articles</h2></th>
</tr><tr>
<td style="color:#000;"><div style="padding:2px 5px;">
</div></td>
</tr>
</table>
</td>
</tr>
</table>

Virtual Machine (KVM)

2022-05-06T11:56:46Z

Sstrutt: /* Create Server (no GUI) */ Added "Eject CD-ROM"

Note that VMs are known as '''domains''' in the KVM world.

== Prerequisites ==
This guide assumes you have a basic working environment, run the <code>kvm-ok</code> command to sanity check...
<pre>
root@kvm-host:# kvm-ok
INFO: /dev/kvm exists
KVM acceleration can be used
</pre>

=== Install Media ===
You need to have a local copy of the appropriate ISO. If you have the ISO file already, upload to your KVM server, alternatively download from the site using <code>wget</code>
* '''Ubuntu Desktop LTS''' - http://releases.ubuntu.com/16.04.3/ubuntu-16.04.3-desktop-amd64.iso

== Create Virtual Machine ==

{| class="vwikitable"
|-
! Parameter !! Example !! Usage
|-
| <code>name</code> || VM-Name || Name of virtual machine (typically this should match the intended hostname of the VM)
|-
| <code>description</code> || "Test VM to be used for X" || Description of virtual machine's purpose etc
|-
| <code>os-type</code> || Linux || OS family, can be Linux, Solaris, Unix or Windows
|-
| <code>os-variant</code> || ubuntu16.04 || Distribution type for the above (run <code>osinfo-query os</code> to view what is available)
|-
| <code>ram</code> || 2048 || vRAM in GB
|-
| <code>vcpus</code> || 2 || vCPUs (cores)
|-
| <code>vcpus</code> || 2 || vCPUs (cores)
|-
| <code>disk path</code> || /vm-store/images/VM-Name.img,bus=virtio,size=50 || Virtual disk path, using virtio bus and with a 50GB disk
|-
| <code>graphics</code> || none || If noneset, VM will be created with a serial display output (as opposed to VNC window)
|-
| <code>cdrom</code> || /home/user/cdrom.iso || Path to installation ISO
|-
| <code>network</code> || bridge:br0 || Network connection details
|}

=== Create Server (no GUI) ===
Update paths to reflect where install ISO, and where VM disk files are intended to be.

The <code>--extra-args "console=ttyS0"</code> option allows a local console to be accessed from the host machine (to allow OS install etc before the VM is on a network), though note that it can't be used with <code>--cdrom</code>, so <code>--location</code> has been used instead.

<pre>
virt-install \
--virt-type=kvm \
--name server-name \
--ram 1024 \
--vcpus=1 \
--os-variant=ubuntu16.04 \
--network=bridge=br0,model=virtio \
--graphics none \
--disk path=/mnt/md0/kvm/vm/server-name.img,size=20,bus=virtio \
--extra-args "console=ttyS0" \
--location /mnt/md0/kvm/iso/ubuntu-16.04.3-server-amd64.iso
</pre>

You should be presented with the console of the VM as it installs, however if you lose connection etc, connect to the console of the server using <code>virsh console <server-name></code>. Make sure you set a static IP and install SSH during setup (select '''OpenSSH server''' during ''Software selection'' section). Once installation is completed, SSH to the server and setup normal console access (as the instructions in the section below). Its highly recommended that you follow the steps below to ensure that Console access is available via the KVM host if needed.

==== Eject CD-ROM ====
If you need to eject the CD-ROM towards the end o the installation process, first identify the disk target name (eg hda, hdb, etc) then eject
virsh edit server-name
virsh change-media server-name hda --eject

==== Console Access ====
# Update the <code>/etc/default/grub</code>
# Add <code>console=ttyS0</code> to the config line <code>GRUB_CMDLINE_LINUX_DEFAULT</code>
#* EG <code> GRUB_CMDLINE_LINUX_DEFAULT="quiet splash console=ttyS0" </code>
# Update grub
#* <code>update-grub</code>
# Restart the guest machine

Connect using <code>virsh console <server-name></code>, you may need to hit Return once to show the logon prompt.

=== Create Workstation (GUI) ===
<pre>
virt-install \
--virt-type=kvm \
--name ubuntu-desktop \
--ram 2048 \
--vcpus=1 \
--os-variant=ubuntu16.04 \
--cdrom=/mnt/md0/kvm/iso/ubuntu-16.04.3-desktop-amd64.iso \
--network=bridge=br0,model=virtio \
--graphics vnc,listen=0.0.0.0 \
--disk path=/mnt/md0/kvm/vm/ubuntu-desktop.img,size=40,bus=virtio
</pre>

Once the command has got as far as <code>Waiting for installation to complete.</code> you need to connect to the VNC console session, to find the port number to connect on query the config from ''another'' SSH session connected to the host (typically VNC uses ports starting from 5900 upwards). Cancelling the command causes the VM/domain to power off, which you won't want to happen until you've completed setup of the VM.
virsh dumpxml ubuntu-desktop | grep vnc

== Move Virtual Machine ==
If you want to move your domain/VM to another KVM host and don't have shared storage you can manually copy the data and VM config across to another host and import it.

# Shutdown the virtual machine
#* Preferably from the OS so it gets a graceful shutdown, alternatively stop the VM from KVM
# Export the config
#* EG <code> virsh dumpxl <VMname> > /tmp/VMName.xml</code>
# Copy the VM disk file(s) and config XML to their new host
#* Disk file(s) should go the location from which your VM's will run from
# Update the config, if necessary...
#* Disk file path - If the VM disks are in a different path on the new server up date the path in the XML file, look for <code>source file=</code>
#* CPU type - If the physical CPU type is different on the new host, you may need to update the VM config to allow for this, update the <code>cpu mode</code> config to match the capabilities of the destination host, or just set to <code><cpu mode='host-passthrough'/></code>. See https://www.berrange.com/posts/2018/06/29/cpu-model-configuration-for-qemu-kvm-on-x86-hosts/ for more info.
# Import the VM
#* EG <code> virsh define /path/to/VMName.xml </code>
# Start the VM
#* EG <code> virsh start <VMName> </code>

== Add Disk ==
# Create new disk image file
#* EG <code> qemu-img create -f qcow2 /var/lib/libvirt/images/vm-name-disk1.img 20G </code>
# Attach disk image to virtual machine
#* Use <code>df</code> in the VM to determine next disk label, eg <code>vdb</code>
#* EG <code> qemu-img create -f qcow2 /var/lib/libvirt/images/vm-name-disk1.img 20G -o preallocation=full </code>
#** To create a thin provisioned file use the following (however you may find the disk the OS sees is small (~200K), if so, use the command above)
#** EG <code> virsh attach-disk vm-name /var/lib/libvirt/images/vm-name-disk1.img vdb --cache none </code>
# Update file owner and group to match other disk images
#* EG <code> chown libvirt-qemu /var/lib/libvirt/images/vm-name-disk1.img </code>
#* EG <code> chgrp libvirt-qemu /var/lib/libvirt/images/vm-name-disk1.img </code>
# Attach disk
#* EG <code> virsh attach-disk --domain vm-name /var/lib/libvirt/images/vm-name-disk1.img --target vdb --persistent --config --live </code>
# In the VM, format the disk using defaults..
#* EG <code> fdisk /dev/vdb </code>
#** EG <code>Command: n </code>
#** EG <code>Partition type: p, </code>
#** EG <code>Partition number: <default>, </code>
#** EG <code>First sector: <default> </code>
#** EG <code>Last sector: <default> </code>
#** EG <code>Command: w </code>
# Format new partition
#* EG <code> mkfs.ext4 /dev/vdb1 </code>
# Create mount directory
#* EG <code> mkdir /vdb1/ </code>
# Mount the the disk
#* EG <code> mount /dev/vdb1 /vdb1/ </code>
# Add an appropriate entry to fstab so the disk gets mounted on next boot
#* EG <code> /dev/vdb1 /vdb1 ext4 defaults 0 0 </code>

== Other Config ==
=== Auto Start ===
To ensure that a VM domain starts with the host server issue the following commands (replace <code>vm-name</code> with the name of your VM
virsh autostart vm-name

To disable issue
virsh autostart vm-name --disable

[[Category:KVM]]

Ubuntu (PowerShell)

2021-12-05T13:19:02Z

Sstrutt: Added Path Permission Error

== Installation ==
For the latest info, see https://docs.microsoft.com/en-us/powershell/scripting/install/install-ubuntu

apt install wget apt-transport-https software-properties-common
wget https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb
dpkg -i packages-microsoft-prod.deb

=== Path Permission Error ===
If you get the following error whenever running a command - '''Error reading or writing history file'''. Its likely PowerShell was installed as root, but you're now running as a standard user, do the following...
sudo pwsh
$refDir = Resolve-Path '~'
$dstDir = Resolve-Path '~/.local/share/powershell'
chown -R --reference=$refDir $dstDir
exit

Above came from https://github.com/PowerShell/PowerShell/issues/10601

== Getting Started ==

To enter the PowerShell command line interface use the following command
pwsh

To run a PowerShell script
pwsh ./do-something.ps1

[[Category:Ubuntu]]
[[Category:PowerShell]]

2020-04-13T09:28:55Z

Sstrutt: /* Move Virtual Machine */ Updated CPU type / mode info

Note that VMs are known as '''domains''' in the KVM world.

== Prerequisites ==
This guide assumes you have a basic working environment, run the <code>kvm-ok</code> command to sanity check...
<pre>
root@kvm-host:# kvm-ok
INFO: /dev/kvm exists
KVM acceleration can be used
</pre>

=== Install Media ===
You need to have a local copy of the appropriate ISO. If you have the ISO file already, upload to your KVM server, alternatively download from the site using <code>wget</code>
* '''Ubuntu Desktop LTS''' - http://releases.ubuntu.com/16.04.3/ubuntu-16.04.3-desktop-amd64.iso

== Create Virtual Machine ==

{| class="vwikitable"
|-
! Parameter !! Example !! Usage
|-
| <code>name</code> || VM-Name || Name of virtual machine (typically this should match the intended hostname of the VM)
|-
| <code>description</code> || "Test VM to be used for X" || Description of virtual machine's purpose etc
|-
| <code>os-type</code> || Linux || OS family, can be Linux, Solaris, Unix or Windows
|-
| <code>os-variant</code> || ubuntu16.04 || Distribution type for the above (run <code>osinfo-query os</code> to view what is available)
|-
| <code>ram</code> || 2048 || vRAM in GB
|-
| <code>vcpus</code> || 2 || vCPUs (cores)
|-
| <code>vcpus</code> || 2 || vCPUs (cores)
|-
| <code>disk path</code> || /vm-store/images/VM-Name.img,bus=virtio,size=50 || Virtual disk path, using virtio bus and with a 50GB disk
|-
| <code>graphics</code> || none || If noneset, VM will be created with a serial display output (as opposed to VNC window)
|-
| <code>cdrom</code> || /home/user/cdrom.iso || Path to installation ISO
|-
| <code>network</code> || bridge:br0 || Network connection details
|}

=== Create Server (no GUI) ===
Update paths to reflect where install ISO, and where VM disk files are intended to be.

The <code>--extra-args "console=ttyS0"</code> option allows a local console to be accessed from the host machine (to allow OS install etc before the VM is on a network), though note that it can't be used with <code>--cdrom</code>, so <code>--location</code> has been used instead.

<pre>
virt-install \
--virt-type=kvm \
--name server-name \
--ram 1024 \
--vcpus=1 \
--os-variant=ubuntu16.04 \
--network=bridge=br0,model=virtio \
--graphics none \
--disk path=/mnt/md0/kvm/vm/server-name.img,size=20,bus=virtio \
--extra-args "console=ttyS0" \
--location /mnt/md0/kvm/iso/ubuntu-16.04.3-server-amd64.iso
</pre>

You should be presented with the console of the VM as it installs, however if you lose connection etc, connect to the console of the server using <code>virsh console <server-name></code>. Make sure you set a static IP and install SSH during setup (select '''OpenSSH server''' during ''Software selection'' section). Once installation is completed, SSH to the server and setup normal console access (as the instructions in the section below). Its highly recommended that you follow the steps below to ensure that Console access is available via the KVM host if needed.

==== Console Access ====
# Update the <code>/etc/default/grub</code>
# Add <code>console=ttyS0</code> to the config line <code>GRUB_CMDLINE_LINUX_DEFAULT</code>
#* EG <code> GRUB_CMDLINE_LINUX_DEFAULT="quiet splash console=ttyS0" </code>
# Update grub
#* <code>update-grub</code>
# Restart the guest machine

Connect using <code>virsh console <server-name></code>, you may need to hit Return once to show the logon prompt.

=== Create Workstation (GUI) ===
<pre>
virt-install \
--virt-type=kvm \
--name ubuntu-desktop \
--ram 2048 \
--vcpus=1 \
--os-variant=ubuntu16.04 \
--cdrom=/mnt/md0/kvm/iso/ubuntu-16.04.3-desktop-amd64.iso \
--network=bridge=br0,model=virtio \
--graphics vnc \
--disk path=/mnt/md0/kvm/vm/ubuntu-desktop.img,size=40,bus=virtio
</pre>

Once the command has got as far as <code>Waiting for installation to complete.</code> you need to connect to the VNC console session, to find the port number to connect on query the config from anothet SSH session connected to the host (typically VNC uses ports starting from 5900 upwards).
virsh dumpxml ubuntu-desktop | grep vnc

== Move Virtual Machine ==
If you want to move your domain/VM to another KVM host and don't have shared storage you can manually copy the data and VM config across to another host and import it.

# Shutdown the virtual machine
#* Preferably from the OS so it gets a graceful shutdown, alternatively stop the VM from KVM
# Export the config
#* EG <code> virsh dumpxl <VMname> > /tmp/VMName.xml</code>
# Copy the VM disk file(s) and config XML to their new host
#* Disk file(s) should go the location from which your VM's will run from
# Update the config, if necessary...
#* Disk file path - If the VM disks are in a different path on the new server up date the path in the XML file, look for <code>source file=</code>
#* CPU type - If the physical CPU type is different on the new host, you may need to update the VM config to allow for this, update the <code>cpu mode</code> config to match the capabilities of the destination host, or just set to <code><cpu mode='host-passthrough'/></code>. See https://www.berrange.com/posts/2018/06/29/cpu-model-configuration-for-qemu-kvm-on-x86-hosts/ for more info.
# Import the VM
#* EG <code> virsh define /path/to/VMName.xml </code>
# Start the VM
#* EG <code> virsh start <VMName> </code>

== Other Config ==
=== Auto Start ===
To ensure that a VM domain starts with the host server issue the following commands (replace <code>vm-name</code> with the name of your VM
virsh autostart vm-name

To disable issue
virsh autostart vm-name --disable

[[Category:KVM]]

Virtual Machine (KVM)

2020-04-12T19:43:44Z

Sstrutt: Added Move Virtual Machine

Installation (KVM)

2020-04-10T18:27:20Z

Sstrutt: /* Networking */ Added Ubuntu 18 instructions

== Prerequisites ==
This guide assumes you have a working Ubuntu Server with one physical NIC that will used for networking to the host server, and also for a bridged network for guest virtual machines.

Ensure your server has CPU's that support hardware virtualisation, you should get one output of flags per CPU (which will include either <code>svm</code> or <code>vmx</code>). If you don't, reboot the server into BIOS and see if there is an option to enable CPU Virtualisation features or VT, if you don't your hardware may too old to support virtualisation. If your hardware is recent, it should, so consult your vendors documentation (either for the server, or for the server's motherboard).
egrep '(vmx|svm)' /proc/cpuinfo

Ensure your server can run KVM hardware acceleration. Install <code>cpu-checker</code> and run as follows...
apt install cpu-checker
kvm-ok
...which should return...
INFO: /dev/kvm exists
KVM acceleration can be used

== Installation ==
Install using the following command
apt install qemu qemu-kvm libvirt-bin bridge-utils virt-manager

Once completed, ensure libvirtd is running
systemctl status libvirtd

== Networking ==
By default, you'll end up with a new <code>virbr0</code> interface, on which all virtual machines will be deployed to. These will not be accessible to the outside world, which is sometimes fine for a private lab environment, but otherwise fairly useless. In order to all your VMs to be accessible, you need to create a new bridge interface, and move your server's IP address onto that. Once done, VMs can also be provisioned onto the same interface, and will be as accessible as your KVM server.

=== Ubuntu 18.04 ===
Network config is achieved via Netplan, for an existing config such as show...
<pre>
root@kvm-svr:~# cat /etc/netplan/50-cloud-init.yaml.orig
# This file is generated from information provided by the datasource. Changes
# to it will not persist across an instance reboot. To disable cloud-init's
# network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
network:
ethernets:
eno1:
addresses:
- 192.168.1.50/24
gateway4: 192.168.10.1
nameservers:
addresses:
- 192.168.1.1
- 8.8.8.8
- 8.8.4.4
search:
- vwiki.co.uk
version: 2
</pre>

...add a new bridge network and move most of the config over...
<pre>
root@media-svr:~# cat /etc/netplan/50-cloud-init.yaml
# This file is generated from information provided by the datasource. Changes
# to it will not persist across an instance reboot. To disable cloud-init's
# network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
network:
version: 2
ethernets:
eno1:
dhcp4: no
dhcp6: no
bridges:
br0:
interfaces:
- eno1
dhcp4: no
addresses:
- 192.168.1.50/24
gateway4: 192.168.1.1
nameservers:
addresses:
- 192.168.1.1
- 8.8.8.8
- 8.8.4.4
search:
- vwiki.co.uk
</pre>

...and apply using...
netplan apply

== Configuration ==
=== Allow VNC Console Access ===
By default virtual machine consoles are bound to 127.0.0.1 on the host KVM server. So you can't connect from a remote machine using VNC to see the VM's console (unless you tunnel through SSH). Bind to 0.0.0.0 to make remote console access. Note that the VM configuration also needs to be changed to listen on 0.0.0.0.

# Edit <code>/etc/libvirt/qemu.conf </code> and uncomment the following line
#* <code> vnc_listen = "0.0.0.0" </code>
# Restart libvirtd
#* <code>service libvirtd restart</code>

[[Category:KVM]]
[[Category:Ubuntu]]

Installation (KVM)

2020-04-10T18:09:09Z

Sstrutt: /* Installation */ Updated

Installation (KVM)

2020-04-10T18:06:24Z

Sstrutt: /* Installation */ Updated

Installation (KVM)

2020-04-10T18:05:30Z

Sstrutt: /* Prerequisites */ Updated

Installation (PowerShell Core)

2020-03-09T10:53:18Z

Sstrutt: /* Procedure */ Added "Ubuntu 18 / Correct Culture"

Allows you to run PowerShell Core from a Linux or macOS host or even AWS Lambda .NET Core 2.1 runtime (as well on a Windows machine). Note that it is a significantly cut down environment from what you'd expect when running within a Windows OS. Part of the power of Windows PowerShell is that it makes anything that's exposed through the full .NET Framework is available to PowerShell, but much of this is specific to Windows. PowerShell Core is dependant on .NET Core, which is stripped down so that it can run on more platforms. This does cause some gotchas, for example cryptography is not available in .NET Core, therefore you can't create secure strings (which you'd normally use for handling passwords).

== Procedure ==
=== Linux ===
These instructions are for Ubuntu 16.04 LTS, but can be adapted for other versions as indicated, for other distributions see https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell-core-on-linux?view=powershell-6 for further info. The procedure below has been tested on both Ubuntu 14.04 and 16.04. However, be aware that if need to use a locale/culture other than en_US, you may find that the below won't install PowerShell with correct culture - see [[#Ubuntu 18 / Correct Culture|Ubuntu 18 / Correct Culture]] below.

# Register Microsoft repository GPG key
#* <code> curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add - </code>
# Add the Microsoft repository to aptitude sources (change the MS URL to fix your OS version)
#* <code> curl https://packages.microsoft.com/config/ubuntu/16.04/prod.list | sudo tee /etc/apt/sources.list.d/microsoft.list </code>
# Update list of available packages
#* <code> apt update </code>
# Install PowerShell Core
#* <code> apt install powershell </code>
# Launch PowerShell
#* <code> pwsh </code>

=== Ubuntu 18 / Correct Culture ===
You need to have the OS locale correct before you install PowerShell, as long as this is correct you should end up with the right version. The procedure below assumes '''en_GB''', use the correct code for you.

'''Check / correct locale'''
# Check Ubuntu is using the correct culture
#* <code> locale </code>
# If your locale is not displayed, if not check what is currently available
#* <code> locale -a </code>
# If your locale is not displayed, generate it
#* EG <code> locale-gen en_GB.UTF-8 </code>
# To set Ubuntu to use the correct locale use the following command
#* EG <code> update-locale LANG=en_GB.UTF-8 </code>
# Reboot for the change to take effect
#* <code> reboot </code>

'''Install PowerShell'''
# Install snap
#* <code>snap install powershell --classic</code>
# Go into PowerShell CLI and check culture
#* <code> powershell </code>
#* <code> Get-Culture </code>

=== Windows ===
Can be installed side by side with Windows PowerShell.

# Download latest win-x64.msi package from https://github.com/PowerShell/PowerShell/releases
# Install downloaded package

[[Category:PowerShell Core]]
[[Category:Linux]]
[[Category:Ubuntu]]

MS SQL

2019-09-22T13:42:18Z

Sstrutt: /* Commands and Maintenance */ Added "Show database recovery modes"

== Installation ==
=== SQL 2008 Standard ===
Instructions below made from MS SQL 2008 Standard install ISO. These notes were created when installing a SQL server for use with [[:Category:vCentre|VMware vCentre]], therefore may contain some specifics for that usage, see the following if you're installing for vSphere 5, it has much greater detail..
* http://lonesysadmin.net/2011/10/06/how-to-install-microsoft-sql-server-2008-r2-for-vmware-vcenter-5/

If installing in a [[Acronyms#V|VM]], perform a snapshot 1st in case you make a mistake and want to reattempt from scratch.

# Create a local user account for MS SQL<ref name="SQL-User" />, eg SQL-DB, with a nice long password with only the following options checked
#* ''User not allowed to change password''
#* ''Password never expires''
# Run the setup.exe from the root of the ISO (or allow to autorun)
# The installer may need to install .NET and upgrade Windows Installer
## Click '''OK''' if so to allow
## Accept the .NET Framework EULA
## On completion on .NET Framework install, click '''Exit''' to proceed
# Click on '''Installation''' to bring up the install options
# Click on '''New SQL Server stand-alone...''' to launch the install wizard
# Assuming the ''Setup Support Rules'' check succeeds, click '''OK''' to proceed
#* Fix any issues found in order to be able to proceed further
# If required, enter a valid product key, then click '''Next''' to proceed
# Accept the EULA, then click '''Next''' to proceed
# Click '''Install''' in order to install the Setup Support Files
# Assuming the ''Setup Support Rules'' check succeeds, click '''Next''' to proceed
#* Fix any issues found in order to be able to proceed further, warnings don't prevent installation, but should be read to understand why they have occurred
# On the Feature Selection page, select the following features, and change the install paths if required, then click '''Next''' to continue
#* ''Instance Features | Database Engine Services''
#* ''Shared Features | Client Tools Connectivity''
#* ''Shared Features | Integration Services''
#* ''Shared Features | Management Tools – Basic''
#* ''Shared Features | Management Tools – Complete''
# On the Instance Configuration page, change the Instance root directory if you want to store the database somewhere else, click '''Next''' to proceed
# Click '''Next''' past the ''Disk Space Requirements'' page
# On the ''Server Configuration'' page, change the following then click '''Next''' to proceed
## Select ''Use the same account for all SQL Server services'' and enter the local account created earlier (eg for SQL-DB)
## Change ''SQL Server Agent'' service startup type to ''Automatic''
# On the ''Database Engine Configuration'' page, change the following then click '''Next''' to proceed
#* Change to ''Mixed Mode'', and enter a nice long password for the SQL root account
#* Add SQL administrators (at minimum I'd suggest the machine's local admin and yourself)
# Click '''Next''' to proceed past the next few pages, and then '''Install''
# Install should complete successfully, then click '''Next''', and then '''Close''' to complete.
# Install the latest SQL service pack, then run Windows Update manually to ensure the install is fully patched
# Even if not asked to, reboot the machine, then log back in and ensure all SQL services have started correctly
# Limit memory available to SQL (optional)
## Start ''SQL Server Management Studio'' and login as one of the SQL administrators you added earlier
## Right-click over the SQL server and select '''Properties'''
## Go to ''Memory'' and set ''Maximum server memory (in MB)'' to something sensible <ref name="SQL-Mem" />
##* SQL will grab as much physical RAM as possible in order to cache and improve performance, therefore you need to limit what it can grab so that the OS, and any other applications will have enough space to run without paging
# Allow ''Local Launch'' (optional, but said to fix some scheduling and spurious event log error issues)
## Go into ''Component Services'' (Start | Administrative Tools | Component Services)
## Find, right-click and select ''Properties'' over ''Component Services'' | ''Computers'' | ''My Computer'' | ''DCOM Config'' | ''MsDtsServer100''
## Go to the ''Security'' tab and within the ''Launch and Activation Permission'' section, click '''Edit'''
## '''Add''' the local SQL user (eg SQL-DB), and ensure ''Local Launch'' is checked
## Click '''OK''' as required to apply and exit

Additional notes...
<references>

<ref name="SQL-User">If you're creating a SQL server for a front-end service, then its usual to use domain service accounts to run SQL under. However, if you're creating a SQL server back-end infrastructure purposes (such as [[:Category:vCentre|vCentre]]) which should be able to run as stand-alone services without dependence on services such as [[Acronyms#D|DNS]] or Active Directory servers then you ''must'' use a local account. Back-end core infrastructure should be as isolated as possible from other systems, so that when failures or disasters occur, impact is localised and you don't end up with the chicken and egg or deadlock situation where you can't bring one service up, because it depends on another, which can't be brought up because...[etc].</ref>

<ref name="SQL-Mem">If installing SQL on the same machine as [[:Category:vCentre|vCentre]], give SQL 25-50% of available RAM. For example, I'd use around 300 MB for a small lab/test environment of 1 or 2 ESX's, whereas if managing 40 ESX's with 1000 VM's you'd need around 2 GB.</ref>

</references>

== Standard Maintenance Plans ==
=== Daily Maintenance Plan ===
# '''History Cleanup Task'''
#* Delete all historical data (backup/restore, SQL Server Agent and Maintenance plan histories)
#* Older than 2 weeks
# '''Back Up Database Task'''
#* Backup type: Full
#* Databases: All databases
#* Backup will expire: Leave unticked
#* Create a backup file for every database: Update as appropriate
# '''Reorganise Index Task'''
#* All user databases
#* Compact large objects
# '''Update Statistics Task'''
#* All user databases
#* Update: All existing statistics
#* Scan type: Full scan
# '''Maintenance Cleanup Task'''
#* Delete files of the following type: Backup files
#* File extension: <code>bak</code>
#* File age: Select as appropriate

Be aware rhat the '''Reorganise Index Task''' can cause lots of activity to be generated in the transaction log, therefore if your recovery mode is ''Full'' (rather than ''Simple''), the transaction log can grow large very quickly. If performing on a database that's been running for some time this can be an issue. Consider setting the recovery mode to ''Simple'' for the first run, or perform at a time when if your transaction log fills you can recover without too much disruption to applications using the database.

=== Hourly Transaction Log Backup ===
# '''Back Up Database Task'''
#* Backup type: Transaction Log
#* Databases: All user databases
# '''Maintenance Cleanup Task'''
#* Delete files of the following type: Backup files
#* File extension: <code>trn</code>
#* File age: Select as appropriate

== Gain Sysadmin Rights ==
In order to gain sysadmin control over a SQL instance you need to have local administrator access over the server, and be able to shut the SQL service down. You should only need to do this if nobody has sysadmin rights, and trying to add gain sysadmin rights or perform other tasks fails with errors similar to...
* '''User does not have permission to perform this action. (Microsoft SQL Server, Error: 15247)'''

If your running in a virtual machine, take a snapshot 1st for piece of mind...!
# Login to the server as a local admin (any account with local admin rights)
# Stop the SQL Server service and any other SQL services
#* If the database is running as a named instance the name will appear in brackets in the service name - note the instance name
# Ensure that any ''Microsoft SQL Server Management Studio'' instances are closed
# Start the SQL instance in single-user mode
## Open a command prompt in the <code>Binn</code> folder of the instance
##* EG <code> C:\Program Files\Microsoft SQL Server\MSSQL10.DB\MSSQL\Binn </code>
## If running as a named instance noted above use (replace <code><Instance></code>)...
##* <code>sqlservr.exe -s<Instance> -m -c</code>
## Otherwise use...
##* <code>sqlservr.exe -s<Instance> -m -c</code>
## In amongst other messages you should see the following to state that the DB is up and ready
##* <code>SQL Server is now ready for client connections. This is an informational message; no user action is required.</code>
# Connect to the SQL instance (see [[#Unable_to_Connect_in_Single_User_Mode|below]] for probs)
## Open another command prompt in the <code>Binn</code> folder of the instance
## If running as a named instance noted above use (replace <code><ComputerName></code> and <code><Instance></code>)...
##* <code>sqlcmd -S<ComputerName>\<Instance></code>
## Otherwise use (replace <code><ComputerName></code>)...
##* <code>sqlcmd -S<ComputerName></code>
# Add the required accounts into the sysadmin role (replace <code><Login></code> with Windows account
## <code> sp_addsrvrolemember '<Login>', 'sysadmin'</code>
##* EG <code> sp_addsrvrolemember 'DOMAIN\user', 'sysadmin'</code>
## <code>GO</code>
## Repeat the above two steps as required
# Restart the server

Source - http://support.microsoft.com/kb/937682

=== Unable to Connect in Single User Mode ===
When trying to connect to a SQL server instance in single user mode you received an error similar to...
* '''Login failed for user 'DOMAIN\user'. Reason: Server is in single user mode. Only one administrator can connect at this time.

This is caused by another user (or piece of software) having already looged into the SQL instance. Ensure that...
* Any applications that use the SQL instance are not trying to connect (disconnect the SQL server from the network if required)
* No SQL services are running
* No ''Microsoft SQL Server Management Studio'' instances are running (including via RDP, check for <code>Ssms.exe</code> or <code>Ssms.exe *32</code> in ''Task Manager''

== Commands and Maintenance ==
For performance issues, see http://www.sqlskills.com/blogs/paul/wait-statistics-or-please-tell-me-where-it-hurts/

Crib sheet of some very basic stuff, the syntax isn't exactly the same, but see also [[MySQL]]

<source lang="sql">
SELECT * FROM MASTER..SYSDATABASES /* Show databases */
EXEC sp_databases; /* Show databases */
SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE '%' /* Show tables */
SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='BASE TABLE' /* Show base tables only (not views etc) */
EXECUTE sp_who2; /* Show current processes */
SELECT name,log_reuse_wait_desc FROM sys.databases; /* Show why transaction log can't grow */
SELECT name,recovery_model_desc FROM sys.databases ORDER BY name /* Show database recovery modes */
</source>

=== Manual Backup ===
<source lang="sql">
BACKUP DATABASE DatabaseName TO DISK='E:\bak\DatabaseName.bak'; /* Full database backup */
BACKUP LOG DatabaseName TO DISK='E:\bak\DatabaseName.trn'; /* Transaction log backup */
</source>

=== Database Sizes ===
Use the following in order to find the sizes of databases on your server.
<source lang="sql">
SELECT
DB_NAME(db.database_id) DatabaseName,
((CAST(mfrows.RowSize AS FLOAT)*8) + (CAST(mflog.LogSize AS FLOAT)*8))/1024 TotalSizeMB,
(CAST(mfrows.RowSize AS FLOAT)*8)/1024 RowSizeMB,
(CAST(mflog.LogSize AS FLOAT)*8)/1024 LogSizeMB,
(CAST(mfstream.StreamSize AS FLOAT)*8)/1024 StreamSizeMB,
(CAST(mftext.TextIndexSize AS FLOAT)*8)/1024 TextIndexSizeMB
FROM sys.databases db
LEFT JOIN (SELECT database_id, SUM(size) RowSize FROM sys.master_files WHERE type = 0 GROUP BY database_id, type) mfrows ON mfrows.database_id = db.database_id
LEFT JOIN (SELECT database_id, SUM(size) LogSize FROM sys.master_files WHERE type = 1 GROUP BY database_id, type) mflog ON mflog.database_id = db.database_id
LEFT JOIN (SELECT database_id, SUM(size) StreamSize FROM sys.master_files WHERE type = 2 GROUP BY database_id, type) mfstream ON mfstream.database_id = db.database_id
LEFT JOIN (SELECT database_id, SUM(size) TextIndexSize FROM sys.master_files WHERE type = 4 GROUP BY database_id, type) mftext ON mftext.database_id = db.database_id
</source>

Source: http://stackoverflow.com/questions/5945360/sql-server-2008-how-to-query-all-databases-sizes

=== Table Sizes ===
Replace '''DatabaseName''' in the query below
<source lang="sql">
USE <DataBaseName>
SELECT
t.NAME AS TableName,
i.name as indexName,
sum(p.rows) as RowCounts,
sum(a.total_pages) as TotalPages,
sum(a.used_pages) as UsedPages,
sum(a.data_pages) as DataPages,
(sum(a.total_pages) * 8) / 1024 as TotalSpaceMB,
(sum(a.used_pages) * 8) / 1024 as UsedSpaceMB,
(sum(a.data_pages) * 8) / 1024 as DataSpaceMB
FROM
sys.tables t
INNER JOIN
sys.indexes i ON t.OBJECT_ID = i.object_id
INNER JOIN
sys.partitions p ON i.object_id = p.OBJECT_ID AND i.index_id = p.index_id
INNER JOIN
sys.allocation_units a ON p.partition_id = a.container_id
WHERE
t.NAME NOT LIKE 'dt%' AND
i.OBJECT_ID > 255 AND
i.index_id <= 1
GROUP BY
t.NAME, i.object_id, i.index_id, i.name
ORDER BY
object_name(i.object_id)
</source>

Source: https://stackoverflow.com/questions/2094436/how-to-find-largest-objects-in-a-sql-server-database

=== Memory Usage ===
<source lang="sql">
DECLARE @total_buffer INT;

SELECT @total_buffer = cntr_value
FROM sys.dm_os_performance_counters
WHERE RTRIM([object_name]) LIKE '%Buffer Manager'
AND counter_name = 'Total Pages';

;WITH src AS
(
SELECT
database_id, db_buffer_pages = COUNT_BIG(*)
FROM sys.dm_os_buffer_descriptors
--WHERE database_id BETWEEN 5 AND 32766
GROUP BY database_id
)
SELECT
[db_name] = CASE [database_id] WHEN 32767
THEN 'Resource DB'
ELSE DB_NAME([database_id]) END,
db_buffer_pages,
db_buffer_MB = db_buffer_pages / 128,
db_buffer_percent = CONVERT(DECIMAL(6,3),
db_buffer_pages * 100.0 / @total_buffer)
FROM src
ORDER BY db_buffer_MB DESC;
</source>

=== Fragmentation ===
List index fragmentation within a particular database...
<source lang="sql">
USE database_name;
SELECT OBJECT_NAME(ind.OBJECT_ID) AS TableName,
ind.name AS IndexName, indexstats.index_type_desc AS IndexType,
indexstats.avg_fragmentation_in_percent
FROM sys.dm_db_index_physical_stats(DB_ID(), NULL, NULL, NULL, NULL) indexstats
INNER JOIN sys.indexes ind ON ind.object_id = indexstats.object_id AND ind.index_id = indexstats.index_id
WHERE indexstats.avg_fragmentation_in_percent > 50
ORDER BY indexstats.avg_fragmentation_in_percent DESC;
</source>

Indexes identified as being fragmented can defrag'ed by using either of the following command...
<source lang="sql">
ALTER INDEX IndexName ON TableName REORGANIZE; /* Online */
ALTER INDEX IndexName ON TableName REBUILD; /* Offline */
ALTER INDEX IndexName ON TableName REBUILD WITH (ONLINE = ON); /* Online - 2008 Ent and above only */
</source>

Alternatively, if you've got lots of indexes to defrag, you can create the REORGANIZE statements...
<source lang="sql">
SELECT 'ALTER INDEX ' + ind.name + ' ON ' + OBJECT_NAME(ind.OBJECT_ID) + ' REORGANIZE;'
FROM sys.dm_db_index_physical_stats(DB_ID(), NULL, NULL, NULL, NULL) indexstats
INNER JOIN sys.indexes ind ON ind.object_id = indexstats.object_id AND ind.index_id = indexstats.index_id
WHERE indexstats.avg_fragmentation_in_percent > 50;
</source>
...or the REBUILD statements...
<source lang="sql">
SELECT 'ALTER INDEX ' + ind.name + ' ON ' + OBJECT_NAME(ind.OBJECT_ID) + ' REBUILD WITH (ONLINE = ON);'
FROM sys.dm_db_index_physical_stats(DB_ID(), NULL, NULL, NULL, NULL) indexstats
INNER JOIN sys.indexes ind ON ind.object_id = indexstats.object_id AND ind.index_id = indexstats.index_id
WHERE indexstats.avg_fragmentation_in_percent > 50;
</source>

==== Rebuild All Indexes ====
Unless you are running SQL Enterprise, this needs to be run when your database is '''single-user mode'''.

<source lang="sql">
USE DatabaseName /* Change to database name! */

DECLARE @TableName varchar(255)
DECLARE TableCursor CURSOR FOR

SELECT table_name FROM information_schema.tables
WHERE table_type = 'base table'

OPEN TableCursor

FETCH NEXT FROM TableCursor INTO @TableName

WHILE @@FETCH_STATUS = 0
BEGIN
DBCC DBREINDEX(@TableName,' ',0)
FETCH NEXT FROM TableCursor INTO @TableName
END

CLOSE TableCursor

DEALLOCATE TableCursor
</source>

To put into Single-User Mode
# Take database offline
#* If database won't stop, look for processes still accessing the database and kill them
# Put into single-user mode
# Put database online
#* You can only run commands from one console window/connection

<source lang="sql">
/* Find processes and kill them*/
exec sp_who2
kill 32

/* Force offline - change database name */
USE master
ALTER DATABASE DatabaseName SET OFFLINE WITH ROLLBACK IMMEDIATE

/* Force into single-user */
USE master
ALTER DATABASE DatabaseName SET SINGLE_USER WITH ROLLBACK IMMEDIATE

/* Put back into multi-user */
USE master
ALTER DATABASE DatabaseName SET MULTI_USER
</source>

[[Category:Applications]]
[[Category:Microsoft]]

Getting Started (PowerShell)

2019-05-07T12:55:25Z

Sstrutt: /* Scripts */ Add "Scheduled Tasks"

== Installation ==
Subject specific useful links are listed in the sections below, the following provide links to installers and general documentation...
* '''Downloads'''
** [http://www.microsoft.com/windowsserver2003/technologies/management/powershell/download.mspx Windows PowerShell V1]
** [http://support.microsoft.com/kb/968929 Windows PowerShell V2]
** [http://www.microsoft.com/en-gb/download/details.aspx?id=34595 Windows PowerShell V3]
*** Requires .NET v4 to be installed - [http://www.microsoft.com/en-gb/download/details.aspx?id=17718 .NET v4 Standalone]
** [http://www.microsoft.com/en-gb/download/details.aspx?id=40855 Windows PowerShell V4]
* Documentation
** http://powershell.com/cs/ - Good all-round help
** http://technet.microsoft.com/en-us/library/bb978526.aspx - TechNet!

Whilst '''Win2008''' ships with Powershell V2, it isn't necessarily available, to install...
# Go to '''Server Manager'''
# Go into '''Features''', then '''Add Features'''
# Tick '''Windows Powershell''', and then '''Next'''
''Normally a restart isn't required''

If you're running scripts from a machine that does not have (or has dodgy) internet access, then running PowerShell scripts can mean a very long wait before they start to run. In which case you need to disable certificate checking (its the checking for certificate revocation that needs to time-out before a script will run)...
# In '''Internet Explorer'''
# Go to '''Internet Options''', and then '''Advanced'''
# Then under '''Security''' uncheck ''Check for publisher's certificate revocation''

=== User Profile ===
Its possible to create a customised profile so that modules, settings etc are available. This is achieved by running a PowerShell script whenever PowerShell starts
# Locate your profile path
#* <source lang=powershell>Write-Host $profile</source>
# Create a PowerShell script in the exact path

You could for example log all PowerShell activity to a OneDrive folder...
<source lang=powershell>
$today = (Get-Date).ToString("yyyy-MM-dd")
Start-Transcript -Path "$home\OneDrive\Scripts\transcripts\$env:computername-PID$pid-$today.txt" -Append -NoClobber
</source>

== Execution Policy ==
On the first run you need to allow Powershell to scripts to execute, otherwise you'll get an error that contains the following when trying to run a script...
* <code> cannot be loaded because the execution of scripts is disabled on this system.</code>

'''You need to run the command below as an administrator''', otherwise you'll get an error like...
* <code> Set-ExecutionPolicy : Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell' is denied. </code>

So if you're using Windows 7, for example, you'll need to start the Powershell console as an administrator (right-click ''Run as administrator''), regardless of whether you're currently logged in as an admin).
<source lang="powershell"> Set-ExecutionPolicy RemoteSigned </source>
It is possible to bypass the Execution Policy entirely (though you do so at your own risk, should only be used to run a script you trust where you haven't the time to fix the underlying problem, and should be reverted afterwards)...
<source lang="powershell"> Set-ExecutionPolicy Bypass </source>

'''If you have no admin rights''' over the PC you're using, then can try to use ''Suspend'' option rather than ''Yes'' (sets just for your current session, doesn't try to write to the registry), this doesn't work in all cases. Alternatively you can hack the Environment variable that controls the Execution Policy (again, this isn't permanent, and may not work in all versions)...
<source lang="powershell">
$env:PSExecutionPolicyPreference = "RemoteSigned"
</source>

To see your current execution policy use...
<source lang="powershell">
Get-ExecutionPolicy
</source>

To run a script, without tinkering with the Execution Policy first, run from a command prompt

<source lang="dos">
powershell.exe -executionpolicy remotesigned .\Example.ps1
</source>

== Installed Version ==
To check the main installed version use '''either''' of the following command lines...
<source lang="powershell">
Get-Host | Select version
$host.version
</source>

However, if you might have installed something other than the normal RTM or GA release version you'll need to the registry key <code>HKLM\Software\Microsoft\PowerShell\1</code>, which will have the following values of interest...
{|class="vwikitable"
|-
! Value !! Data !! Meaning
|-
|<code> Install </code> || <code>1</code> || Installed (not version number - Microsoft may have intended this to be a version marker at inception, but it is not used as such)
|-
|<code> PID </code> || <code>89383-100-0001260-04309</code> || RTM (Release to Manufacturing)
|-
|<code> PID </code> || <code>89393-100-0001260-00301</code> || RC2 (Release Candidate 2)
|}
For more info on release version acronyms, see [http://en.wikipedia.org/wiki/Software_release_life_cycle Software Release Life Cycle]

== Help Commands ==
<source lang="powershell">Get-Help <cmd> # Provides help for CmdLets, use wildcards to broaden results.
$object | Get-Member # Provides information about an object (variable)
$object.gettype() # Provides variable type info (string, array, etc)</source>

== Conditional Operators ==
=== Comparison ===
{|class="vwikitable"
|-
! Operator !! Description
|-
| <code> -eq </code> || Equal to (implied case insensitive)
|-
| <code> -ieq </code> || Equal to (case insensitive)
|-
| <code> -ceq </code> || Equal to (case sensitive)
|-
| <code> -lt </code> || Less than
|-
| <code> -gt </code> || Greater than
|-
| <code> -ge </code> || Greater than or Eqaul to
|-
| <code> -le </code> || Less than or equal to
|-
| <code> -ne </code> || Not equal to
|-
| <code> -match </code> || Match (ie string contains) anywhere within string (can be regex)
|-
| <code> -notmatch </code> || Does not match (ie string contains) (can be regex)
|-
| <code> -like </code> || Like (ie string is), stricter than match (can be regex)
|-
| <code> -notlike </code> || Not like (ie string is not) (can be regex)
|}

=== Logic ===
{|class="vwikitable"
|-
! Operator !! Description
|-
| <code> -not </code> || Not
|-
| <code> ! </code> || Not
|-
| <code> -and </code> || And
|-
| <code> -or </code> || Or
|}

== Useful One-Liners ==
{|class="vwikitable"
|-
! Command !! Description
|-
|<code> Get-Content <file-path> <nowiki>|</nowiki> Out-GridView </code> || Display (log)file in the nice Grid View window
|-
|<code> (Get-Location -PSProvider FileSystem).ProviderPath </code> || Current working directory
|-
|<code> $MyInvocation.MyCommand.Name </code> || Current script or function name (if in a function)
|-
|<code> $host.UI.RawUI.WindowTitle = "Wibble" </code> || Change command shell title (to ''Wibble'')
|}

== PowerShell Process ==
To get information about the current running PowerShell session process, use...
<source lang="powershell">
$proc = [System.Diagnostics.Process]::GetCurrentProcess()
</source>
...from which you can get all sorts of performance and other metrics such as total CPU time taken, various memory usage metrics and so forth. Which can be useful if you have a script that you want to run continuously, but you want to be able to monitor that its behaving (no excessive CPU usage or memory leaking).

The object type returned by the above is exactly the same as is returned by <code>[http://technet.microsoft.com/en-us/library/dd347630.aspx Get-Process]</code>.

=== Process Priority ===
In order to change the priority of the current PowerShell process, use...
<source lang="powershell">
( [System.Diagnostics.Process]::GetCurrentProcess() ).PriorityClass = "NewPriority"
</source>
...where NewPriority is any of (though I'd recommend limiting to either BelowNormal or AboveNormal)...
{|class="vwikitable"
|-
! Priority !! Description
|-
! Idle
| Only runs when system is idle, which may mean that the process never gets enough execution time to do anything useful.
|-
! BelowNormal
| Ensures that the process will yield to most other processes running on the system (good for background tasks).
By default, scheduled tasks run as Below Normal (in Win2008, and maybe others)
|-
! Normal
| Default - recommended for most tasks
|-
! AboveNormal
| Ensures that most other processes running on the system will yield to the PowerShell process (good for urgent, high priority tasks).
|-
! High
| Process will try to run immediately.<br>Can lead to a system having constant high CPU and sluggish overall performance.
|-
! RealTime
| Process overrides all other processes (including system tasks).<br>Can lead to an unresponsive, locked out system unless process has been specifically written to run in RealTime mode, or will only run for a very brief period.
|}

If you run scripts that can be CPU intensive, and/or run for a long time. This can lessen the impact on your desktop or server (wherever the script is running).

To check the current priority of your shell or script use...
<source lang="powershell">
( [System.Diagnostics.Process]::GetCurrentProcess() ).PriorityClass
</source>

== Scripts ==
=== Include Files ===
In order to include another Powershell script in a parent script, use a <code>.</code> and then the path to the file (there's a space between them), eg
<source lang="powershell">
. .\lib\include_file.ps1
</source>

=== Script Arguments ===
In order to be able to parameters to a script the <code>$args</code> variable can be used. Each argument is provided within the array in order, eg

<source lang="powershell">
# 1st param is send yes or no
# 2nd param is email address

if ($args[0]) {
Write-Host "Email sending enabled...!"
Write-Host "Will send to" $args[1]
} else {
Write-Host "Email sending disabled."
}
</source>

So for example...
<pre>
[PS > ./params.ps1 0
Email sending disabled.
[PS > ./params.ps1 1 test@abc.com
Email sending enabled...!
Will send to test@abc.com
</pre>

=== Logging ===
The easiest way to setup logging from with a script is to use the Transcript functionality which will log all output to a transcript file. Note that <code> Write-Host </code> only places line feeds at the end of lines, not carriage returns, therefore Notepad will display such output as one long line. You'll need to use an editor that can handle lines only terminated by LF's (WordPad if you can't install anything, otherwise get something better, eg http://www.scintilla.org/SciTE.html).

<source lang="powershell">
Start-Transcript -Path C:\Users\name\Scripts\script.log -Append -NoClobber
# script
Stop-Transcript
</source>

== Scheduled Tasks ==
To run a script as a scheduled task, complete the task config as normal, in the ''Action'' tab populate as follows...
* '''Program/Script''' - PowerShell
* '''AddArguments (optional)''' - As below (not optional!)
** Basic: <code>script.ps1</code>
** Where paths have spaces and your script takes parameters (eg '''ScriptParam'''): <code>"& 'C:\Path\To Script\script.ps1'" -ScriptParam ScriptParamData</code>
* '''Start in (optional)''' - As below (optional, but recommended)
** <code>C:\Path\To Script</code>
** Do not add quotes, even if your path has spaces

== Call External Process ==
Running an external executable is a bit of a faff, but it can be done...
<source lang="powershell">
$cmd = "rrdtool.exe update $rrd $updates"
$proc_res = &$executioncontext.InvokeCommand.NewScriptBlock($cmd)
</source>

== Slow Start-Up ==
PowerShell isn't the fastest thing in the world to start, the fact that a basic PowerShell command prompt uses of 50MB of RAM gives some indication that its not lean and mean (but once up and running, and when running efficient script it can be ''very'' fast). However if its taking minutes rather than seconds to start then there is something going wrong.

Normally this is due to the fact that the machine you're running from has no (or limited) internet access. To workaround the problem you need to disable Certificate Revocation Checking...

# In '''Control Panel''', open '''Internet Options'''
# Go to the '''Advanced''' tab, and scroll down to the '''Security''' section
# Untick the '''Check for publisher's certificate revocation'''

There is no increased security risk imposed by doing this on a machine with no/limited internet access, as the checks were previously timing-out and being bypassed anyway.

[[Category:PowerShell]]

Windows 2008

2019-05-07T11:52:56Z

Sstrutt: /* Scheduled Tasks */ Added note to 0x8007010B

== Build ==
Best practice for VMware VMs (take with a pinch of salt, one man's best practice can be another man's gotcha)
* http://communities.vmware.com/servlet/JiveServlet/downloadBody/12309-102-4-13348/vFiltered-windows2008best%20practices.pdf

=== Disable ASLR ===
Address space layout randomisation is a feature which involves randomly arranging the positions of key data areas, in order to mitigate memory snapshot image vulnerabilities (which is generally not a problem). There are suggestions that this can reduce reduce VMware's page sharing between VM's, increasing overall physical memory usage. However, its probably true that whilst memory page locations will be randomised, the VMkernel will still be able to match up identical pages between different OS instances.

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\"MoveImages"=dword:00000000

== Procedures ==
=== Sysprep ===
# Start sysprep from <code> C:\Windows\System32\sysprep\sysprep.exe </code>
# Leave action as '''Enter System Out-of-Box Experience (OOBE)''' and tick the poorly spelt '''Generalize''' tick-box, then hit '''OK'''
# Sysprep will run and reboot the OS
#* You'll need to provide a ''new'' password, and any hostname and IP details will need updating

=== NTP Client ===
Machines that are part of a domain will synchronise their time with the domain controllers, but standalone machines (or domain controllers) need to be configured to behave as NTP clients.

The server's NTP config in the registry hive '''<code>HKLM\SYSTEM\CurrentControlSet\Services\W32Time</code>''' needs to be updated as follows to enable the server's system clock to update via NTP. Restart the NTP service to apply.

{|class="vwikitable"
|-
! Key !! Name !! Value !! Notes
|-
| rowspan=2 | Parameters || Type || NTP
|-
| NtpServer || 192.168.206.25,0x1 192.168.206.26,0x1 || Space separated list, each name/IP must have <code>,0x1</code> appended to the end
|-
| TimeProviders \ NtpServer || Enabled || 1 || Only required if you wish other servers to be able to poll your server for time
|-
| TimeProviders \ NtpClient || SpecialPollInterval || 1800 || Secs. Interval between successive NTP polls
|-
| rowspan=4 |Config || AnnounceFlags || 5
|-
| MaxAllowedPhaseOffset || 30 || Secs. If clock if off by more, its' abruptly set rather than incremented
|-
| MaxPosPhaseCorrection || 5400 || Secs. Maximum positive phase correction allowed (if greater, no change occurs)
|-
| MaxNegPhaseCorrection || 5400 || Secs. Maximum negative phase correction allowed (if greater, no change occurs)
|}

Once completed, restart the Win32 Time service
* <code> net stop w32time </code>
* <code> net start w32time </code>

To locate suitable NTP servers to use, see http://www.pool.ntp.org/

See http://support.microsoft.com/kb/816042 for further info on setting the above parameters

== Network Connectivity Status Indicator (NCSI) ==
NCSI is the feature that causes the "No Internet Access" alert pop-up that can appear over your network connection.

* An HTTP request for http://www.msftncsi.com/ncsi.txt
** Which returns a single line <code>Microsoft NCSI</code>
* A DNS request for dns.msftncsi.com
** Which is expected to resolve to 131.107.255.255

To disable NCSI checks
# Start the relevant Group Policy editor (gpmc.msc or GPEdit.msc)
# Browse through to '''Internet Communication settings'''
#* '''Computer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication settings'''
# Set '''Turn off Windows Network Connectivity Status Indicator active tests''' to '''Enabled'''
# Run <code> gpupdate </code> to apply

To disable the "No Internet Access" pop-up
# Start the relevant Group Policy editor (gpmc.msc or GPEdit.msc)
# Browse through to '''Network Connections'''
#* '''Computer Configuration > Administrative Templates > Network > Network Connections'''
# Set '''Do not show the “local access only” network icon''' to '''Enabled'''
# Run <code> gpupdate </code> to apply

The underlying settings that govern how NCSI operates can be found in the following registry key
* <code> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet </code>

Further reading...
http://technet.microsoft.com/en-us/library/ee126135%28WS.10%29.aspx
http://defaultreasoning.wordpress.com/2010/05/14/disable-%E2%80%9Cno-internet-access%E2%80%9D-notification-on-windows-server-2008-r2/

== Troubleshooting ==
=== Default Gateway Loss ===
Known bug in Windows 2008 SP2 causes the default gateway of a machine to disappear on reboot. Resolved by resetting the IP stack and re-entering the IP config
# Record IP details
#* <code> ipconfig/all > C:\ipconfig.txt </code>
# Reset the IP stack
#* <code> netsh int ip reset </code>
# Restart server
# Re-enter IP config
# Reboot to confirm its held

There's a bugfix available from http://support.microsoft.com/kb/973243

=== Scheduled Tasks ===
More common scheduled task error codes...
{|class="vwikitable"
|-
! Code !! Constant || Cause / meaning
|-
| 0x0 || || Success / no error
|-
| 0x1 || || Incorrect function called or unknown function called. Can also be caused by file permission problems.
|-
| 0x2 || || File not found
|-
| 0xa || || The environment is incorrect
|-
| 0x41300 || SCHED_S_TASK_READY || Task is ready to run at its next scheduled time
|-
| 0x41301 || SCHED_S_TASK_RUNNING || Task is currently running
|-
| 0x41302 || SCHED_S_TASK_DISABLED || Task is disabled
|-
| 0x41303 || SCHED_S_TASK_HAS_NOT_RUN || Task has not yet run
|-
| 0x41304 || SCHED_S_TASK_NO_MORE_RUNS || No more scheduled runs for the task
|-
| 0x41305 || SCHED_S_TASK_NOT_SCHEDULED || One or more of the config properties needed to run the task on a schedule have not been set
|-
| 0x41306 || SCHED_S_TASK_TERMINATED || Task was terminated by user
|-
| 0x41307 || SCHED_S_TASK_NO_VALID_TRIGGERS || Task either has no triggers or the existing triggers are disabled or not set
|-
| 0x41308 || SCHED_S_EVENT_TRIGGER || Event triggers do not have set run times
|-
| 0x4131B || SCHED_S_SOME_TRIGGERS_FAILED || Task is registered, but not all specified triggers will start the task
|-
| 0x4131C || SCHED_S_BATCH_LOGON_PROBLEM || Task is registered, but may fail to start. Batch logon privilege needs to be enabled for the task principal.
|-
| 0x41325 || SCHED_S_TASK_QUEUED || Task Scheduler service has asked the task to run
|-
| 0x80041309 || SCHED_E_TRIGGER_NOT_FOUND || Task's trigger is not found
|-
| 0x8004130A || SCHED_E_TASK_NOT_READY || One or more of the properties required to run this task have not been set
|-
| 0x8004130B || SCHED_E_TASK_NOT_RUNNING || There is no running instance of the task
|-
| 0x8004130C || SCHED_E_SERVICE_NOT_INSTALLED || Task Scheduler service is not installed
|-
| 0x8004130D || SCHED_E_CANNOT_OPEN_TASK || Task object could not be opened
|-
| 0x8004130E || SCHED_E_INVALID_TASK || The object is either an invalid task object or is not a task object
|-
| 0x8004130F || SCHED_E_ACCOUNT_INFORMATION_NOT_SET || No account information could be found in the Task Scheduler security database for the task
|-
| 0x80041310 || SCHED_E_ACCOUNT_NAME_NOT_FOUND || Unable to establish existence of the account specified
|-
| 0x80041311 || SCHED_E_ACCOUNT_DBASE_CORRUPT || Task Scheduler security database has been reset due to detected corruption
|-
| 0x80041312 || SCHED_E_NO_SECURITY_SERVICES || Task Scheduler security services are available only on Windows NT
|-
| 0x80041313 || SCHED_E_UNKNOWN_OBJECT_VERSION || Task object version is unsupported or invalid
|-
| 0x80041314 || SCHED_E_UNSUPPORTED_ACCOUNT_OPTION || Task has unsupported/conflicting combination of account settings and run time options
|-
| 0x80041315 || SCHED_E_SERVICE_NOT_RUNNING || Task Scheduler Service is not running
|-
| 0x80041316 || SCHED_E_UNEXPECTEDNODE || Task's XML contains an unexpected node (corruption?)
|-
| 0x80041317 || SCHED_E_NAMESPACE || Task's XML contains an element or attribute from an unexpected namespace
|-
| 0x80041318 || SCHED_E_INVALIDVALUE || Task's XML contains a value which is incorrectly formatted or out of range
|-
| 0x80041319 || SCHED_E_MISSINGNODE || Task's XML is missing a required element or attribute
|-
| 0x8004131A || SCHED_E_MALFORMEDXML || Task's XML is malformed
|-
| 0x8004131D || SCHED_E_TOO_MANY_NODES || Task's XML contains too many nodes of the same type
|-
| 0x8004131E || SCHED_E_PAST_END_BOUNDARY || Task cannot be started after the trigger end boundary
|-
| 0x8004131F || SCHED_E_ALREADY_RUNNING || An instance of this task is already running
|-
| 0x80041320 || SCHED_E_USER_NOT_LOGGED_ON || Task will not run because the user is not logged on
|-
| 0x80041321 || SCHED_E_INVALID_TASK_HASH || Task image is corrupt or has been tampered with
|-
| 0x80041322 || SCHED_E_SERVICE_NOT_AVAILABLE || Task Scheduler service is not available
|-
| 0x80041323 || SCHED_E_SERVICE_TOO_BUSY || Task Scheduler service is too busy to handle request
|-
| 0x80041324 || SCHED_E_TASK_ATTEMPTED || Task Scheduler service attempted to run the task, but it did not run due to one of the constraints in the task definition
|-
| 0x80041326 || SCHED_E_TASK_DISABLED || Task is disabled
|-
| 0x80041327 || SCHED_E_TASK_NOT_V1_COMPAT || Task has properties that are not compatible with earlier versions of Windows
|-
| 0x80041328 || SCHED_E_START_ON_DEMAND || Task's settings do not allow the task to start on demand
|-
| 0x8007010B || || The ''start in'' folder path is invalid. Note that quotation marks around paths with spaces in are not required, and will cause this error if used.
|-
| 0x800704DD || || The service is not available (is ''Run only when an user is logged on'' checked?)
|-
| 0xC000013A || || The task was terminated, user pressed Ctrl+C
|-
| 0xC06D007E || || Unknown software exception
|}
The above was sourced from...
* http://msdn.microsoft.com/en-us/library/aa383604
* http://ict.ken.be/scheduled-task-exit-result-and-error-codes.aspx

Other scheduler errors...
* '''Error 2147943712'''
** You're trying to save a task that wants to save credentials (maybe because you want the task to run even when the user is logged off), but credential saving has been disabled by a GPO.
* '''Error 2147943785'''
** Logon failure: the user has not been granted the requested logon type at this computer. Grant the user ''log on as a batch job'' rights in Local Security Policy, User Rights Assignment

=== Extend Partition Fails ===
Disk looks to have extended in disk manager, but file manager/windows explorer still show the old size
# Start <code> diskpart </code> from a command line
# List the volumes, then select the appropriate one
#* <code> list volume </code>
#* <code> select volume 2 </code>
# Extend the volume
#* <code> extend filesystem </code>
# If this fails, select the partition and extend
#* <code> list partition </code>
#* <code> select partition 1 </code>
#* <code> extend filesystem </code>
# This can sometimes throw up disk errors, in which case you'll need to a check disk on the affected partition (if there are open file handles you'll either need to stop the applications or schedule after a reboot, and reboot)
#* EG <code> chkdisk d: /f </code>
# Then re-attempt the partition extension

=== Re-Add Server to Domain ===
Sometimes the domain membership of a server becomes broken, needing the server to be re-added to the domain. In order to perform you need...
* A domain administrator account
** Or at least a domain account with permissions to add/remove machines from the domain
* A local administrator account
** Or a domain account that has recently logged into the server, that has admin rights over it

If you don't have any account that can be a local administrator of the server, you'll need to break into your server. There are utilities on the web that let you boot to a recovery CD/ISO, and overwrite the admin password. I haven't used any of these since NT4 days, so can't comment how capable they are today.

# Log into the server as a local admin
#* If you don't have the password, but have logged on previously with a domain account that has admin rights over the server
#*# Disconnect the server from the network
#*# Login with the domain account that has admin rights (this forces the server to use locally cached credentials, rather than validating with the domain)
#*# Reconnect to network
#*# Change the local admin password to something you'll remember (you must do this otherwise you'll lose access once the machine is off the domain!)
# Go to '''System Properties''' and record the name of the current domain
# Then change the domain membership to '''Workgroup''' (provide a dummy workgroup name, ''WORKGROUP'' is the defalt for new machines)
# Provide a domain account that has rights to remove a server from the domain
# If successful you should get a pop-up stating ''Welcome to the WORKGROUP workgroup'', and then a prompt to restart
# Go back into '''System Properties''' and change the domain membership to '''Domain''', supplying the original domain name
# Provide a domain account that has rights to add a server to the domain
# If successful you should get a pop-up stating ''Welcome to the <domain> domain'', and then a prompt to restart

[[Category:Microsoft]]
[[Category:Windows]]
[[Category:Windows 2008]]

Data Types (MySQL)

2019-04-17T14:30:53Z

Sstrutt: /* Numbers */ Added Integers header

== Numbers ==

<code> BOOL </code> and <code> BOOLEAN </code> are synonyms for <code> TINYINT(1) </code>.

=== Integers ===

{|class="vwikitable"
! Type !! Bytes !! Min !! Max
|-
| <code> TINYINT </code> || 1 || -128 || 127
|-
| <code> TINYINT UNSIGNED </code> || 1 || 0 || 255
|-
| <code> SMALLINT </code> || 2 || -32768 || 32767
|-
| <code> SMALLINT UNSIGNED </code> || 2 || 0 || 65535
|-
| <code> MEDIUMINT </code> || 3 || -8388608 || 8388607
|-
| <code> MEDIUMINT UNSIGNED </code> || 3 || 0 || 16777215
|-
| <code> INT </code> || 4 || -2147483648 || 2147483647
|-
| <code> INT UNSIGNED </code> || 4 || 0 || 4294967295
|-
| <code> BIGINT </code> || 8 || -9223372036854775808 || 9223372036854775807
|-
| <code> BIGINT UNSIGNED </code> || 8 || 0 || 18446744073709551615
|}

For more info see - http://dev.mysql.com/doc/refman/5.0/en/numeric-types.html

== Strings ==
There's two main string types
* '''<code>VARCHAR</code>''' - Variable character length up a prescribed maximum (eg <code>VARCHAR(32)</code>). Max allowed is 65,535 (though in reality this max width is shared across all columns so is less in practice.
* '''<code>CHAR</code>''' - Fixed character length up a prescribed maximum (eg <code>CHAR(32)</code>). Max allowed is 255

== Dates and Times ==
Date and time values need to specified in the general format of <code>YYYY-MM-DD HH:MM:SS</code> (date or time components should be omitted if required for the table column. MySQL is relaxed on the usage of delimiters, so <code>YYYY^MM^DD HH-MM-SS</code>, or <code>YYYYMMDDHHMMSS</code> should be fine so long as the overall order of year, month, day, etc is correct and the values are valid.

{|class="vwikitable"
! Type !! Min !! Max !! Comments
|-
| <code> DATE </code> || 1000-01-01 || 9999-12-31
|-
| <code> TIME </code> || -838:59:59 || 838:59:59
|-
| <code> TIMESTAMP </code> || 1970-01-01 00:00:01 || 2038-01-19 03:14:07 || Stored as UTC (converted to during INSERT and from during SELECT)
|-
| <code> DATETIME </code> || 1000-01-01 00:00:00 || 9999-12-31 23:59:59
|-
| <code> YEAR </code> || 1901 || 2155 ||
|}

When querying data for use in PHP scripts, DATETIME values need to be converted into Unix Timestamp, for example...
<source lang="mysql">SELECT UNIX_TIMESTAMP(datetime) AS datetime FROM table;</source>

== NULL ==
NULL means "no data", it doesn't mean zero. Therefore 0 <> NULL in an numerical field, and "NULL" <> NULL in a string field.

To set a field to NULL, use NULL without any quotes eg...
<source lang="mysql">INSERT INTO table (col1, col2) VALUES ('data1', NULL); </source>

== IP Addresses ==
IP addresses are most efficiently stored as an UNSIGNED INT, though obviously this isn't particularly human readable, but it is beneficial in as much as that if you use a <code> SELECT ... ORDER BY ip </code> type of statement the IP's will be correctly sorted
MySQL will do the conversion between INT and dotted quad using the INET_ATON and INET_NTOA functions. For example;
<source lang="mysql">
INSERT INTO ips SET ip=INET_ATON('10.1.2.3');
SELECT INET_NTOA(ip) FROM ips;
SELECT INET_NTOA(ip) FROM ips WHERE INET_NTOA(ip) LIKE '10.1.2.%';
</source>
Alternatively, use <code>VARCHAR(15)</code> to store as text.

The data returned by <code> INET_NTOA() </code> is in binary string format, which can occasionally cause problems. If you're passing the data into PowerShell, for example, you end up by a <code> [byte] </code> object that is nigh on impossible to convert to a standard string. To force MySQL to return a string wrap the command in <code>CONVERT(x, CHAR)</code>, eg
<source lang="mysql">
SELECT CONVERT(INET_NTOA(ip), CHAR) AS ip FROM ips;
</source>

[[Category:MySQL]]

User Management (MySQL)

2019-03-15T08:58:11Z

Sstrutt: /* Create Users and Grant/Revoke Privileges */ Updated add new user

== Create Users and Grant/Revoke Privileges ==
To create a new user you need to specify the username, the location/IP address it will be connecting from (use <code>%</code> for any location), and their password
<source lang="mysql"> CREATE USER '<user>'@'localhost' identified by '<password>';</source>

You can then give permissions to that user
<source lang="mysql"> GRANT ALL ON <dayabase>.* TO '<user>'@'localhost';</source>

Depending on the version of MySQL running you can do this in one command (note that the <code>WITH GRANT OPTION</code> allows the user to create more users and/or grant privileges to users).
<source lang="mysql"> GRANT ALL PRIVILEGES on <database>.* to '<user>'@'%' identified by '<password>' WITH GRANT OPTION; </source>

To give no privileges to a new user coming from a specific host;
<source lang="mysql"> GRANT USAGE on <database>.* to '<user>'@'<host>' identified by '<password>'; </source>

To give an existing user read-only access;
<source lang="mysql"> GRANT SELECT on <database>.* to '<user>'@'<host>';</source>

To give an existing user ''web-user'', read-only access to local database ''webdb'';
<source lang="mysql"> GRANT SELECT ON webdb.* TO 'web-user'@'localhost';</source>

To remove/revoke a privilege from an existing user ''web-user'';
<source lang="mysql"> REVOKE SELECT ON webdb.* FROM 'web-user'@'localhost';</source>

After making any changes to user privilages, you need to flush them to ensure they're applied...
<source lang="mysql"> FLUSH PRIVILEGES; </source>

== Delete Users ==
To remove an existing user use the following...
<source lang="mysql"> DROP USER '<user>'@'<host>'; </source>
* You need to specify the full <code>user@host</code> entry (or MySQL assumes the wild-card host <code>%</code>)
* Existing users sessions are not dropped, but will be unable to re-establish

== Display Users ==
To display all configured users;
<source lang="mysql">
SELECT CONCAT('SHOW GRANTS FOR \'', user ,'\'@\'', host, '\';') FROM mysql.user;
</source>
Then use the displayed lines to see the detail of each user

== Change User Password ==
<source lang="mysql">
SET PASSWORD FOR 'user'@'%' = PASSWORD('newpass');
</source>

[[Category:MySQL]]

Percona NRPE Install (MySQL)

2019-03-15T08:57:46Z

Sstrutt: /* Percona Repository */ Updated

Instructions on installed the Percona NRPE plugin in order to be able to monitor a MySQL server from Nagios. See the following page for more info - https://www.percona.com/doc/percona-monitoring-plugins/1.1/nagios/index.html

== Ubuntu Install ==
=== Percona Repository ===
If you don't have it available already, you'll need to add the Percona repository (if it is you should have the following file - <code>/etc/apt/sources.list.d/percona-release.list</code>
# Download appropriate pagckage
#* <code> wget https://repo.percona.com/apt/percona-release_latest.$(lsb_release -sc)_all.deb </code>
# Install package
#* <code> dpkg -i percona-release_latest.$(lsb_release -sc)_all.deb </code>
# Enable the repository
#* <code>percona-release setup ps80</code>
# Update cache
#* <code> apt-get update </code>

=== Install Plugins ===
<code>apt-get install percona-nagios-plugins</code>

== Red Hat Install ==
Note that the instructions below were written for an older version than is current, please check the Percona site (URL above) for up to date info.
# Add the Percona repository
#* <code> yum install http://www.percona.com/downloads/percona-release/redhat/0.1-3/percona-release-0.1-3.noarch.rpm </code>
# Install the Percona NRPE Nagios plugins
#* <code> yum install percona-nagios-plugins percona-toolkit</code>

== Plugin Setup ==
Change the user/pass used in the example below
# Append checks to NRPE config file (see below - change user/pass as required)
#* <code> vi /usr/local/nagios/etc/nrpe.cfg </code>
# Check NRPE is set to allow parameters
#* <code> dont_blame_nrpe=1</code>
# Create MySQL user
#* <code> mysql -u root -p </code>
#* <code> GRANT SELECT, PROCESS, SUPER ON *.* to 'nagios'@'localhost' IDENTIFIED BY 'nagios123'; </code>
# Create credentials config file for checks to use
#* <code> vi /etc/nagios/mysql.cnf </code>
#* Add the following lines
#* <code> [client] </code>
#* <code> user = nagios </code>
#* <code> password = nagios123 </code>
# Change owner and permissions of credentials config file
#* <code> chown root:nagios /etc/nagios/mysql.cnf </code>
#* <code> chmod 640 /etc/nagios/mysql.cnf </code>

<pre>
# Example MySQL checks
command[check_mysql_status]=/usr/lib64/nagios/plugins/pmp-check-mysql-status $ARG1$
command[check_mysql_processlist]=/usr/lib64/nagios/plugins/pmp-check-mysql-processlist
command[check_mysql_innodb]=/usr/lib64/nagios/plugins/pmp-check-mysql-innodb -C $ARG1$
command[check_mysql_status_uptime]=/usr/lib64/nagios/plugins/pmp-check-mysql-status x Uptime -C '<' -w $ARG1$ -c $ARG2$
command[check_mysql_status_connx]=/usr/lib64/nagios/plugins/pmp-check-mysql-status -x Threads_connected -o / -y max_connections -T pct -w $ARG1$ -c $ARG2$
command[check_mysql_status_threadrun]=/usr/lib64/nagios/plugins/pmp-check-mysql-status -x Threads_running -w $ARG1$ -c $ARG2$
command[check_mysql_slave_running]=/usr/lib64/nagios/plugins/pmp-check-mysql-replication-running
command[check_mysql_slave_delay]=/usr/lib64/nagios/plugins/pmp-check-mysql-replication-delay
</pre>

== NRPE Compiled Without Argument Support ==
Sometime Nagios has been compiled and installed so that it will never accept arguments (regardless of <code>dont_blame_nrpe</code> config).
<pre>
cd /root/nrpe/nrpe-2.13/
./configure --enable-command-args
/etc/init.d/nrpe stop
make
make install
/etc/init.d/nrpe start
</pre>

{{#seo:
|title=Percona MySQL NRPE plugin install
|keywords=mysql,nrpe,nagios,monitor,percona, plugin
|description=Instructions on installing the Percona NRPE plugin in order to be able to monitor a MySQL server from Nagios
}}

[[Category:MySQL]]
[[Category:Nagios]]
[[Category:NRPE]]
[[Category:Ubuntu]]

Virtual Machine (KVM)

2018-12-23T17:57:09Z

Sstrutt: Added Auto Start

Virtual Machine (KVM)

2018-12-21T13:52:36Z

Sstrutt: /* Create Server (no GUI) */ Edited Console note

== Prerequisites ==
This guide assumes you have a basic working environment, run the <code>kvm-ok</code> command to sanity check...
<pre>
root@kvm-host:# kvm-ok
INFO: /dev/kvm exists
KVM acceleration can be used
</pre>

=== Install Media ===
You need to have a local copy of the appropriate ISO. If you have the ISO file already, upload to your KVM server, alternatively download from the site using <code>wget</code>
* '''Ubuntu Desktop LTS''' - http://releases.ubuntu.com/16.04.3/ubuntu-16.04.3-desktop-amd64.iso

== Create Virtual Machine ==

{| class="vwikitable"
|-
! Parameter !! Example !! Usage
|-
| <code>name</code> || VM-Name || Name of virtual machine (typically this should match the intended hostname of the VM)
|-
| <code>description</code> || "Test VM to be used for X" || Description of virtual machine's purpose etc
|-
| <code>os-type</code> || Linux || OS family, can be Linux, Solaris, Unix or Windows
|-
| <code>os-variant</code> || ubuntu16.04 || Distribution type for the above (run <code>osinfo-query os</code> to view what is available)
|-
| <code>ram</code> || 2048 || vRAM in GB
|-
| <code>vcpus</code> || 2 || vCPUs (cores)
|-
| <code>vcpus</code> || 2 || vCPUs (cores)
|-
| <code>disk path</code> || /vm-store/images/VM-Name.img,bus=virtio,size=50 || Virtual disk path, using virtio bus and with a 50GB disk
|-
| <code>graphics</code> || none || If noneset, VM will be created with a serial display output (as opposed to VNC window)
|-
| <code>cdrom</code> || /home/user/cdrom.iso || Path to installation ISO
|-
| <code>network</code> || bridge:br0 || Network connection details
|}

=== Create Server (no GUI) ===
Update paths to reflect where install ISO, and where VM disk files are intended to be.

The <code>--extra-args "console=ttyS0"</code> option allows a local console to be accessed from the host machine (to allow OS install etc before the VM is on a network), though note that it can't be used with <code>--cdrom</code>, so <code>--location</code> has been used instead.

<pre>
virt-install \
--virt-type=kvm \
--name server-name \
--ram 1024 \
--vcpus=1 \
--os-variant=ubuntu16.04 \
--network=bridge=br0,model=virtio \
--graphics none \
--disk path=/mnt/md0/kvm/vm/server-name.img,size=20,bus=virtio \
--extra-args "console=ttyS0" \
--location /mnt/md0/kvm/iso/ubuntu-16.04.3-server-amd64.iso
</pre>

You should be presented with the console of the VM as it installs, however if you lose connection etc, connect to the console of the server using <code>virsh console <server-name></code>. Make sure you set a static IP and install SSH during setup (select '''OpenSSH server''' during ''Software selection'' section). Once installation is completed, SSH to the server and setup normal console access (as the instructions in the section below). Its highly recommended that you follow the steps below to ensure that Console access is available via the KVM host if needed.

==== Console Access ====
# Update the <code>/etc/default/grub</code>
# Add <code>console=ttyS0</code> to the config line <code>GRUB_CMDLINE_LINUX_DEFAULT</code>
#* EG <code> GRUB_CMDLINE_LINUX_DEFAULT="quiet splash console=ttyS0" </code>
# Update grub
#* <code>update-grub</code>
# Restart the guest machine

Connect using <code>virsh console <server-name></code>, you may need to hit Return once to show the logon prompt.

=== Create Workstation (GUI) ===
<pre>
virt-install \
--virt-type=kvm \
--name ubuntu-desktop \
--ram 2048 \
--vcpus=1 \
--os-variant=ubuntu16.04 \
--cdrom=/mnt/md0/kvm/iso/ubuntu-16.04.3-desktop-amd64.iso \
--network=bridge=br0,model=virtio \
--graphics vnc \
--disk path=/mnt/md0/kvm/vm/ubuntu-desktop.img,size=40,bus=virtio
</pre>

Once the command has got as far as <code>Waiting for installation to complete.</code> you need to connect to the VNC console session, to find the port number to connect on query the config from anothet SSH session connected to the host (typically VNC uses ports starting from 5900 upwards).
virsh dumpxml ubuntu-desktop | grep vnc

[[Category:KVM]]

Troubleshooting (Fortigate)

2018-12-19T12:44:53Z

Sstrutt: /* Change Priority */ typo

== Basic Commands ==
=== Ping / Trace Route ===
execute ping 10.10.1.10
execute traceroute 10.52.56.20

=== Shutdown / Restart ===
execute shutdown
execute reboot

=== Process Management ===
* Show top processes, refresh every 2 secs
** <code> diagnose sys top 2 </code>
* Kill a process
** <code> diagnose sys kill 9 <PID> </code>
** Most processes will restart, but use with caution!
** <code> diagnose sys kill 11 <PID> </code>
*** <code>kill 11</code> supposedly restarts a process

Killing off processes can cause unexpected results, so only perform if service through the firewall is being impacted (you may drop all existing connections through the firewall, or cause all IPsec tunnels to drop, if the process you are killing is responsible for those functions, for example). Its common for other processes to briefly show high CPU after you've killed a CPU hogging process, give it 30 secs or so to calm down.

Some discussion groups mention an issue when killing off <code>cmdbsvr</code> as it manages the config, and killing caused config corruption. It can be killed off, but may cause the loss/corruption of any recently edited config.

== VPN ==
=== IPsec (Site 2 Site) ===
Show status of a tunnel, using Phase 1 name, <code>sa=0</code> means no security associations, ie no connection
diagnose vpn tunnel list name P1-NAME

Bring a phase 2 up or down
diag vpn tunnel up P2-NAME P1-NAME
diag vpn tunnel down P2-NAME P1-NAME

Note that the below only debugs Phase 2 problems
<pre>
diag debug reset
diagnose vpn ike log-filter name VPN-NAME
diagnose debug enable
diagnose debug application ike -1
</pre>

The <code>diagnose vpn ike log-filter name VPN-NAME</code> line is optional, but if there's more than one VPN in operation the screen will be filled with output. You need a quick copy and paste into notepad when there's something interesting whizzing up the screen! Replace <code>VPN-NAME</code> with the name of the Phase 1.

Run <code>diag debug reset</code> once complete

=== SSL (User) ===
<pre>
diag debug reset
diag debug enable
diag debug application fnbamd -1
diag debug appl sslvpn -1
</pre>

Run <code>diag debug reset</code> once complete

== High Availability ==
{| class="wikitable"
|-
! Command !! Action
|-
| <code> show system ha </code> || Show HA config
|-
| <code> get system ha status </code> || Show master/slave status
|-
| <code> execute ha manage 1 </code> || Change console to master/slave
|-
| <code> diagnose sys ha dump-by all-vcluster </code> || Show HA cluster status
|-
| <code> diagnose sys ha reset-uptime </code> || Reset HA uptime timer - causes failover to standby as that will have the higher uptime
|}

=== Console to Slave ===
Once SSH'ed to the master firewall, its possible to jump onto the slave (to run diag stats, reboot etc)
# <code> get system ha status </code>
#* Gives output as shown below
# <code> execute ha manage 0 </code>
#* Normally 0 or 1, 0 in example below to switch to primary

<pre>
Model: 200
Mode: a-p
Group: 40
Debug: 0
ses_pickup: enable, ses_pickup_delay=disable
Master: 90 PROD-FW01 FG200C4151018656 1
Slave : 50 PROD-FW02 FG200C4151018713 0 <-- ID to use in "execute ha manage"
number of vcluster: 1
vcluster 1: work 169.254.0.2
Master:0 FG200C4151018656
Slave :1 FG200C4151018713
</pre>

=== Change Heartbeat ports ===
This needs to be done on both firewalls! The command sets the ports and their priorities.
<pre>
config system ha
set hbdev "port1" 50 "port2" 60
end
</pre>

=== Change Priority ===
By default a FortiGate only fails over during a problem, but you can override so that the higher priority is always active. Therefore you can force fail-overs

You need to override on both master and slave firewalls...
<pre>
PROD-FW01 # config system ha
PROD-FW01 (ha) # set override enable
PROD-FW01 (ha) # end
</pre>

=== Check Master/Slave Config Replication ===
The configuration should replicate from the master to the slave, to ensure this is running correctly, run the following command and ensure the checksum's match between the units
diagnose sys ha cluster-csum

=== Force Failover ===
HA will put the unit with longest uptime live, therefore if you reset the timer on the master unit, it will failover to the standby

diagnose sys ha reset-uptime

[[Category:Fortigate]]

Troubleshooting (Fortigate)

2018-12-19T12:44:27Z

Sstrutt: Initial creation

== Basic Commands ==
=== Ping / Trace Route ===
execute ping 10.10.1.10
execute traceroute 10.52.56.20

=== Shutdown / Restart ===
execute shutdown
execute reboot

=== Process Management ===
* Show top processes, refresh every 2 secs
** <code> diagnose sys top 2 </code>
* Kill a process
** <code> diagnose sys kill 9 <PID> </code>
** Most processes will restart, but use with caution!
** <code> diagnose sys kill 11 <PID> </code>
*** <code>kill 11</code> supposedly restarts a process

Killing off processes can cause unexpected results, so only perform if service through the firewall is being impacted (you may drop all existing connections through the firewall, or cause all IPsec tunnels to drop, if the process you are killing is responsible for those functions, for example). Its common for other processes to briefly show high CPU after you've killed a CPU hogging process, give it 30 secs or so to calm down.

Some discussion groups mention an issue when killing off <code>cmdbsvr</code> as it manages the config, and killing caused config corruption. It can be killed off, but may cause the loss/corruption of any recently edited config.

== VPN ==
=== IPsec (Site 2 Site) ===
Show status of a tunnel, using Phase 1 name, <code>sa=0</code> means no security associations, ie no connection
diagnose vpn tunnel list name P1-NAME

Bring a phase 2 up or down
diag vpn tunnel up P2-NAME P1-NAME
diag vpn tunnel down P2-NAME P1-NAME

Note that the below only debugs Phase 2 problems
<pre>
diag debug reset
diagnose vpn ike log-filter name VPN-NAME
diagnose debug enable
diagnose debug application ike -1
</pre>

The <code>diagnose vpn ike log-filter name VPN-NAME</code> line is optional, but if there's more than one VPN in operation the screen will be filled with output. You need a quick copy and paste into notepad when there's something interesting whizzing up the screen! Replace <code>VPN-NAME</code> with the name of the Phase 1.

Run <code>diag debug reset</code> once complete

=== SSL (User) ===
<pre>
diag debug reset
diag debug enable
diag debug application fnbamd -1
diag debug appl sslvpn -1
</pre>

Run <code>diag debug reset</code> once complete

== High Availability ==
{| class="wikitable"
|-
! Command !! Action
|-
| <code> show system ha </code> || Show HA config
|-
| <code> get system ha status </code> || Show master/slave status
|-
| <code> execute ha manage 1 </code> || Change console to master/slave
|-
| <code> diagnose sys ha dump-by all-vcluster </code> || Show HA cluster status
|-
| <code> diagnose sys ha reset-uptime </code> || Reset HA uptime timer - causes failover to standby as that will have the higher uptime
|}

=== Console to Slave ===
Once SSH'ed to the master firewall, its possible to jump onto the slave (to run diag stats, reboot etc)
# <code> get system ha status </code>
#* Gives output as shown below
# <code> execute ha manage 0 </code>
#* Normally 0 or 1, 0 in example below to switch to primary

<pre>
Model: 200
Mode: a-p
Group: 40
Debug: 0
ses_pickup: enable, ses_pickup_delay=disable
Master: 90 PROD-FW01 FG200C4151018656 1
Slave : 50 PROD-FW02 FG200C4151018713 0 <-- ID to use in "execute ha manage"
number of vcluster: 1
vcluster 1: work 169.254.0.2
Master:0 FG200C4151018656
Slave :1 FG200C4151018713
</pre>

=== Change Heartbeat ports ===
This needs to be done on both firewalls! The command sets the ports and their priorities.
<pre>
config system ha
set hbdev "port1" 50 "port2" 60
end
</pre>

=== Change Priority ===
By default a FortiGate only fails over during a problem, but you can override so that the higher priority is always active. Therefore you can force fail-overs

You need to override on both master and slave firewalls...
<pre>
CDS-PROD-FW01 # config system ha
CDS-PROD-FW01 (ha) # set override enable
CDS-PROD-FW01 (ha) # end
</pre>

=== Check Master/Slave Config Replication ===
The configuration should replicate from the master to the slave, to ensure this is running correctly, run the following command and ensure the checksum's match between the units
diagnose sys ha cluster-csum

=== Force Failover ===
HA will put the unit with longest uptime live, therefore if you reset the timer on the master unit, it will failover to the standby

diagnose sys ha reset-uptime

[[Category:Fortigate]]

Category:Fortigate

2018-12-19T12:34:45Z

Sstrutt: Added category

[[Category:Firewall]]

Category:Vyatta

2018-12-19T12:34:18Z

Sstrutt: Added category

Linux based Open Source firewall router that used to see itself in competition with Cisco, and saw its popularity increase as its usage in the virtual world made for a very flexible firewall/router networking appliance. More recently Vyatta was acquired by Brocade, and the supported version (Vyatta Subscription Edition) to the Brocade Vyatta 5400 vRouter, the open source version is no longer available, however a fork of Vyatta lives on, [https://vyos.io/ VyOS].

[[Category:Firewall]]

Getting Started (AWS PowerShell)

2018-11-20T09:17:15Z

Sstrutt: Added "Get Instances"

== Setup Credentials ==
PowerShell Core can't store credentials securely by itself (the encryption used by Windows PowerShell is dependant on Windows DLL's, the Secure String object is not available in PowerShell Core), therefore AWS provide a method of storing AWS credentials securely for use which replicates how you'd do this in Windows PowerShell whereby credentials are stored in an encrypted file that can only be decrypted by the logged in user. You need the Access Key ID and Secret for your account. If you don't have an ''Access Key ID'', go to '''IAM > Users''' and locate your account and select '''Create access key''' (the secret will not be accessible again, make a note of it somewhere secure).

The following command stores your credentials in the default profile, meaning that they will be used for operations where credentials are required, unless you specify a different profile of credentials to use

<source lang="PowerShell">
Set-AWSCredential -AccessKey <your-access-key> -SecretKey <your-secret> -StoreAs default
</source>

{| class="vwiki-note"
|-
| '''Credentials file is not encrypted in Linux systems'''
|-
| When using the <source lang="PowerShell" inline>Set-AWSCredential</source> CmdLet on Linux systems the credentials file created is not encrypted (it is on Windows systems). Therefore you need to ensure you secure the file, ideally store in an encrypted path accessible by only you.
|}

== Set Default Region ==
Most commands need to be run against a specific region. You can either specify this each time you run CmdLet, or if you predominantly run in one region, its more convenient to set a default region

<source lang="PowerShell">
Set-DefaultAWSRegion -Region eu-west-1
</source>

Other useful region commands...
<source lang="PowerShell">
Clear-DefaultAWSRegion # Clear default region
Get-AWSRegion # Get list of regions, including what is default
</source>

== Get Instances ==
Example commands to get instances..
<source lang="PowerShell">
# Get running instances with Production tag
$instances = Get-EC2Instance -Filter @(@{Name="tag:Function";Values="Production"};@{Name="instance-state-name";Values="running"}) | Select-Object -ExpandProperty instances

# Get specific instance
$instance = Get-EC2Instance -Filter @(@{Name="instance-id";Values="i-012345678abcdef01"}) | Select-Object -ExpandProperty instances
</source>

[[Category: AWS PowerShell]]

Getting Started (AWS PowerShell)

2018-11-20T09:00:08Z

Sstrutt: Added "Set Default Region"

NRPE Installation (Ubuntu 18.04)

2018-11-02T13:59:51Z

Sstrutt: Typo fix

The default deployment of Ubuntu 18.04 (Bionic Beaver) does not allow installation of NRPE (package nagios-nrpe-server) without modifying the apt sources. Trying to install results in the following error
<pre>
me@server:~$ sudo apt install nagios-nrpe-server
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Unable to locate package nagios-nrpe-server
</pre>

In order to fix you need to add the <code>universe</code> component to the OS repository source
# Edit the repository sources file
#* EG <code>sudo vi /etc/apt/sources.list</code>
# Append <code>universe</code> to the first line (your file should look like the below)
# Update the local cache
#* <code> sudo apt update </code>
# Install NRPE as normal
#* <code> udo apt install nagios-nrpe-server </code>

<pre>
me@server:~$ cat /etc/apt/sources.list
deb http://archive.ubuntu.com/ubuntu bionic main universe
deb http://archive.ubuntu.com/ubuntu bionic-security main
deb http://archive.ubuntu.com/ubuntu bionic-updates main
</pre>

[[Category:Ubuntu]]
[[Category:NRPE]]