HP-2530-24G QOS by IP

The phone system will use the ip 192.168.x.21 or .22 (x=2 in branch 1, 6 in branch 2, 8 in branch 3)
The packets coming from those IPs are marked on the switch with DSCP code "EF" (dec 46  bin 101110) - Priority 7 High and treated by Bell's MPLS equipment as class C5 (Voice Signaling and Voice/Telephony)


Running configuration:

; J9776A Configuration Editor; Created on release #YA.15.12.0007
; Ver #04:01.ff.37.XX.XX
hostname "HP-2530-24G"
qos device-priority 192.168.8.20/30 dscp 101110
qos type-of-service ip-precedence
snmp-server community "public" unrestricted
vlan 1
    name "DEFAULT_VLAN"
    untagged 1-28
    ip address 192.168.8.3 255.255.255.0
    exit

Branch 2:

Running configuration:

; J9775A Configuration Editor; Created on release #YA.15.12.0007
; Ver #04:01.ff.37.XX.XX
hostname "HP-2530-48G"
qos device-priority 192.168.6.20/30 dscp 101110
qos type-of-service ip-precedence
ip default-gateway 192.168.6.1
snmp-server community "public" unrestricted
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-52
   ip address 192.168.6.3 255.255.255.0
   exit

ChangeSN Windows XP

' WMI Script - ChangeSN.vbs
'
'sorinakis@g***.com
'**************************

ON ERROR RESUME NEXT
Dim VOL_PROD_KEY
VOL_PROD_KEY = "12345123451234512345" 'put here the real license without dashes
Dim WshShell
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\WPAEvents\OOBETimer"
'delete OOBETimer registry value
for each Obj in 
GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf 
("win32_WindowsProductActivation")
result = Obj.SetProductKey (VOL_PROD_KEY)
if err <> 0 then
WScript.Echo Err.Description, "0x" & Hex(Err.Number)
Err.Clear
end if
next

Recreate Offline Address Book - Exchange 2010

1.    Create a new OAB.

a.    Open Exchange Management Console, expand “Organization Configuration” ->”Mailbox”.
b.    Click “Offline Address Book” tab. Right click the blank area and click “New Offline Address Book”.
c.    Type a different OAB name and click “Browse” to select the Exchange 2010 mailbox server as OAB generation server.
d.    Checked “Include the default Global Address Lists” option. As shown below:
e.    Click Next and checked “ Enable Web-base distribution” option and “ Enable public folder distribution” option. Click “Add” to select the default OAB virtual directory.
f.     Click “Next”, click “New” and click “Finish” to complete the creating process.

 

2.    Restart related services.

a.    Restart the “Microsoft Exchange System Attendant” service.
b.    Restart “Microsoft Exchange File Distribution” service.

 

3.    Update the new OAB and set it as default.

a.    Right click the new create OAB and click “Update” to update it manually. Waiting 15-30 minutes for the OAB generate finished.
b.    Right click the new OAB and click “set as default”. Click “Yes” to confirm it.

 

4.    Associate the new OAB to all the users’ mailbox databases.

a.    Expand “Server Configuration” ->”Mailbox”. Right click “mailbox database” and select “Properties”.
b.    Click “Client Settings” tab, under “Offline Address Book” option, click “Browse” button to choose the new created OAB. It will associate the new OAB to the mailbox store. Click “OK”. As shown below.
c.    Let problematic users click “Send/Receive” button on their Outlook client to download OAB, check whether the problem is resolved.

Install HPSUM on an rpm base distro

mount /dev/cdrom /mnt

cp /mnt/compaq/psp/linux /tmp/

cd /tmp/linux

./hpsum

- check for the prerequisite, usually you need expect, kernel-headers, rpm-build, gcc, libnl, redhat-rpm-config, openipmi and net-snmp  either form the redhat installation dvd (rpm -Uvh package), or you can use "yum install package" if you have yum repositories configured.

- you need to manually install hp-snmp-agents package from the hp dvd, it is not installed by hpsum (I presume it's a glitch). hp-snmp-agents needs hp-health (you find them both in the /tmp/linux directory that you just copied from the dvd)

- re-run ./hpsum untill you have no conflicts/unresolved dependecies!

- after installation and reboot run /sbin/hpsnmpconfig - you have to provide only the readonly (public) and the read/write (private) comunity for snmp.

- if everything seems ok, edit /opt/hp/hp-snmp-agents/cma.conf lin 22: trapemail . at the end of the line replace root with your email address - REMEMBER: you need a functional sendmail in order to be able to send emails!

HP Important Note:   The server needs to have 'sudo' installed in order to start or stop the snmp daemon and to send test traps.   'sudo' grants controlled root access to groups or users.   If installed after hp-snmp-agents please run a '/sbin/hpsnmpconfig'. In case of VMware ESX 3.x series, please run '/etc/init.d/hpasm reconfigure' after installation of hpasm.   These buttons will NOT work if 'sudo' is configured to only run when the user is logged into a 'real' tty.   To be able to perform the operations of start, stop, restart of the snmpd daemon, the user must comment out the line 'Defaults requiretty' in the /etc/sudoers file.   See man sudoers for details about the 'requiretty' flag.   If present, this flag will need to be removed from the '/etc/sudoers' configuration file.   The 'send trap' button also requires a tool snmptrap to be present on the system.   This tool is often bundled with the snmp stack (Suse) or in a package called 'net-snmp-util' (Red Hat).

10

Already 10. Looks like yesterday to me :)

Authentify linux users to a windows 2012 R2 domain controller

As root type:
rpm –Uvh  samba-winbind samba-winbind-clients pam_krb5 krb5-libs

Then:
authconfig --enablekrb5 --krb5kdc=2k12srv.domain.local --krb5adminserver=2k12srv.domain.local --krb5realm=DOMAIN.LOCAL --enablewinbind --enablewinbindauth --smbsecurity=ads --smbrealm=DOMAIN.LOCAL --smbservers=2k12srv.domain.local --smbworkgroup=DOMAIN --winbindtemplatehomedir=/home/%U --winbindtemplateshell=/bin/bash --enablemkhomedir --enablewinbindusedefaultdomain –update && net ads join -U administrator -D DOMAIN

vi smb.conf
[global]
   workgroup = DOMAIN
   password server = 2k12srv.domain.local
   realm = DOMAIN.LOCAL
   security = ads
   idmap config * : range = 16777216-33554431
   template homedir = /home/%U
   template shell = /bin/bash
   winbind use default domain = true
   winbind offline logon = true

Restart and enable winbind:
chkconfig winbind on
service winbind restart

-----------------------------------------------------------------------------------------------------------------------------






The old way, for a 2008 Server was:
rpm -Uvh samba-winbind-clients samba-winbind samba-client

service winbind start
chkconfig winbind on

authconfig --enablewinbind --enablewinbindauth --enablelocauthorize --enablemkhomedir --updateall

vi smb.conf:
# Any modification may be deleted or altered by authconfig in future
   workgroup = DOMAIN
   password server = 2008dc 2008R2dc
   realm = DOMAIN.LOCAL
   security = ads
   idmap config * : range = 16777216-33554431
   template homedir = /home/%D/%U
   template shell = /bin/bash
   winbind use default domain = true
   winbind offline logon = true
#--authconfig--end-line--

vi /etc/openldap/ldap.conf:
TLS_CACERTDIR   /etc/openldap/cacerts
SASL_NOCANON    on

cp shared_DOMAIN_cert.cer /etc/openldap/cacerts/
cacertdir_rehash /etc/openldap/cacerts/

net join -w DOMAIN -S 2008dc.domain.tld -U Administrator
systemctl restart winbind.service

In order to allow certain AD Groups to login:
vi /etc/login.group.allowed
A_CERTAIN_AD_GROUP

vi /etc/pam.d/sshd
auth       required     pam_listfile.so item=group sense=allow onerr=fail file=/etc/login.group.allowed

vi /etc/pam.d/login
auth       required     pam_listfile.so item=group sense=allow onerr=fail file=/etc/login.group.allowed

cd /home
mkdir DOMAIN

Map remote printer

map a local printer to TS session when "bring local printers to TS" fails miserably and start the App only after the printer is available

@echo off
setlocal enableextensions enabledelayedexpansion
set result=0
ser printer=oj100
Title Adding Printer. Be patient...
echo Adding printer. Do not start App yet...
ping -n 2 1.1.1.1 >nul 2>nul
taskkill /fi "username eq %username%" /im app.exe 2>nul
%userprofile%\delprint.vbs
ping -n 2 1.1.1.1 >nul 2>nul
echo Please wait. Starting Installation...
echo ..
for /F "tokens=2 delims=/: " %%f in ('%userprofile%\gettscip.exe') do (
echo Your IP is: %%f
:loop
net use \\%%f\ipc$ /d /y >nul 2>nul
ping -n 1 1.1.1.1 >nul 2>nul
net use \\%%f\ipc$ && set result=1
echo Result: !result!
if not !result! equ 1 goto :loop
Echo Add printer. This is going to take up to 5 minutes, be patient...
rundll32 printui.dll,PrintUIEntry /in /n "\\%%f\!printer!" /u /q /Gw
echo Setting default printer...
echo.
rundll32 printui.dll,PrintUIEntry /y /n  "\\%%f\!printer!" /q
echo.
)
Echo Starting App...
ping -n 3 1.1.1.1 >nul 2>nul
taskkill /fi "username eq %username%" /im app.exe >nul 2>nul
endlocal
C:\Users\Public\Desktop\App.lnk

DNS Adbock on router

In case you have, like me, a secodary dns on your DD-WRT router, you need a dns adblock on it too. By modifying the excellent tutorial from http://www.howtogeek.com/51477/how-to-remove-advertisements-with-pixelserv-on-dd-wrt/ I came to this script:

#!/bin/sh
########Functions setup#########################
logger_ads()
{
logger -s -p local0.notice -t ad_blocker $1
}

softlink_func()
{
ln -s /tmp/$1 /jffs/dns/$2
if [ "`echo $?`" -eq 0 ] ; then
logger_ads "Created $3 softlink to RAM on JFFS"
else
logger_ads "The attempt to create $3 softlink to RAM on JFFS *FAILED*"
logger_ads "it is obvious something IS *terribly wrong*. Will now exit... bye (ads will not be blocked)"
exit 1
fi
}

note_no_space()
{
logger_ads "I assure you this only takes $1 blocks, but I guess your too close to the edge for JFFSs comfort"
logger_ads "deleting the half witted file, as to not confuse the DNS service and free up the JFFS space for other uses."
}
##################################################
nvram set aviad_changed_nvram=0
logger_ads "########### Ads blocker script starting ###########"

if [[ -z "$1" ]]; then
logger_ads "Sleeping for 30 secs to give time for router boot"
sleep 30
else
logger_ads "override switch given"
[[ $1 = "-h" || $1 = "/?" ]] && echo "use -m to override the 30 seconds delay and -f to force a list refresh" && exit 0
[ $1 = "-f" ] && rm /jffs/dns/dnsmasq.adblock.conf && rm /jffs/dns/dlhosts
fi

while ! ping www.google.com -c 1 > /dev/null ; do
logger_ads "waiting for the internet connection to come up"
sleep 5
done

logger_ads "Adding a refresh cycle by puting the script in cron if it isnt there yet"
if [[ -z "`cat /tmp/crontab | grep "/jffs/dns/disable_adds.sh"`" ]] ; then
echo '0 0 * * * root /jffs/dns/disable_adds.sh -m' > /tmp/crontab
stopservice cron && logger_ads "stopped the cron service" startservice cron && logger_ads "started the cron service"
else
logger_ads "The script is already in cron"
fi

logger_ads "New IP and ports setup. Reserve the IP .100 for pixelserv"
pixel="`ifconfig br0 | grep inet | awk '{ print $2 }' | awk -F ":" '{ print $2 }' | cut -d . -f 1,2,3`.100"
mgmtip="`ifconfig br0 | grep inet | awk '{ print $2 }' | awk -F ":" '{ print $2 }'`"

# In my case, on IP .100 I have an apache serving null.html as error page. Comment
next 3 paragraphs, as I don't need pixelserv
#logger_ads "Move http interface to $mgmtip:88"
#if [[ -z "`ps | grep -v grep | grep "httpd -p 88"`" && `nvram get http_lanport` -ne 88 ]]
; then
# logger_ads "it seems that the http is not setup yet on port :88"
# stopservice httpd
# nvram set http_lanport=88
# nvram set aviad_changed_nvram=1
# startservice httpd
#else
# logger_ads "The http is already setup on $mgmtip:88"
#fi

#logger_ads "Redirect setup IP/Port from $mgmtip:80 to $mgmtip:88"
#[[ -z "`iptables -L -n -t nat | grep $mgmtip | grep 80`" ]] && logger_ads "did NOT find an active redirect rule with the iptable command, injecting it now." && /usr/sbin/iptables -t nat -I PREROUTING 1 -d $mgmtip -p tcp --dport 80 -j DNAT --to $mgmtip:88
#nvram get rc_firewall > /tmp/fw.tmp
#if [[ -z "`cat /tmp/fw.tmp | grep "/usr/sbin/iptables -t nat -I PREROUTING 1 -d $mgmtip  p tcp --dport 80 -j DNAT --to $mgmtip:88"`" ]] ; then
# echo "/usr/sbin/iptables -t nat -I PREROUTING 1 -d $mgmtip -p tcp --dport 80 -j DNAT --to $mgmtip:88" >> /tmp/fw.tmp
# nvram set rc_firewall="`cat /tmp/fw.tmp`"
# logger_ads "DONE appending forwarding to FW script"
# nvram set aviad_changed_nvram=1
#else
# logger_ads "The redirection $mgmtip:80 -> $mgmtip:88 in FW script is already in place"
#fi
#rm /tmp/fw.tmp

#logger_ads "Starting or ReSpawning pixelsrv on $pixel IP :80"
#/sbin/ifconfig br0:1 $pixel netmask "`ifconfig br0 | grep inet | awk '{ print $4 }' | awk -F ":" '{ print $2 }'`" broadcast "`ifconfig br0 | grep inet | awk '{ print $3 }' | awk -F ":" '{print $2 }'`" up
#if [[ -n "`ps | grep -v grep | grep /jffs/dns/pixelserv`" ]]; then
# logger_ads "the pixelserv is already up"
#else
# logger_ads "it seems that the pixelserv isnt up. starting it now"# /jffs/dns/pixelserv $pixel -p 80
#fi

logger_ads "Get the online dns blocking lists"
[ ! -e /jffs/dns/whitelist ] && echo google-analytics > /jffs/dns/whitelist && echo toma.guru >> /jffs/dns/whitelist
if [[ -n "$(find /jffs/dns/dlhosts -mtime +7)" || -n "$(find /jffs/dns/dnsmasq.adblock.conf mtime +7)" || ! -e /jffs/dns/dlhosts || ! -e /jffs/dns/dnsmasq.adblock.conf ]]; then
logger_ads "The lists are NOT setup at all yet, or more then 7 days old, will now retrieve them from the web"
logger_ads "Retrieving the MVPS hosts list..."
wget -q -O - http://www.mvps.org/winhelp2002/hosts.txt | grep "^127.0.0.1"
| grep -v localhost | tr -d '\015' >/tmp/dlhosts.tmp
logger_ads "adjusting the MVPS hosts list for our use"
cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /tmp/dlhosts.tmp
; done
sed -i s/127.0.0.1/$pixel/g /tmp/dlhosts.tmp
logger_ads "done adjusting the MVPS hosts list."
logger_ads "Retrieving the Yoyo domain list..."
wget -q
"http://pgl.yoyo.org/adservers/serverlist.php?hostformat=dnsmasq&showintro=0&mietype=plaintext" -O /tmp/adblock.tmp
logger_ads "adjusting the Yoyo domain list for our use"
cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /tmp/adblock.tmp
; done
sed -i s/127.0.0.1/$pixel/g /tmp/adblock.tmp
if [ "`df| grep /jffs | awk '{ print $4 }'`" -ge 65 ] ; then
logger_ads "Moving the Yoyo list to JFFS (as it looks that there is enough space for it)"
mv /tmp/adblock.tmp /jffs/dns/dnsmasq.adblock.conf
if [ "`echo $?`" -eq 0 ] ; then
logger_ads "Moving the YoYo domain list to JFFS operation was successful"
else
note_no_space 20
rm /jffs/dns/dnsmasq.adblock.conf
softlink_func adblock.tmp dnsmasq.adblock.conf YoYo
fi
else
logger_ads "*NOT* Moving the Yoyo list to JFFS (as it looks that there is *NOT* enough space for it)"
softlink_func adblock.tmp dnsmasq.adblock.conf YoYo
fi
if [ "`df| grep /jffs | awk '{ print $4 }'`" -ge 100 ] ; then
logger_ads "Moving the MVPS hosts list to JFFS (as it looks like there is enough space for it)"
mv /tmp/dlhosts.tmp /jffs/dns/dlhosts
if [ "`echo $?`" -eq 0 ] ; then
logger_ads "Moving the MVPS hosts list to JFFSoperation was successful"
else
note_no_space 72
rm /jffs/dns/dlhosts
softlink_func dlhosts.tmp dlhosts MVPS
fi
else
logger_ads "*NOT* Moving the MVPS list to JFFS (as it looks that there is *NOT* enough space for it)"
softlink_func dlhosts.tmp dlhosts MVPS
fi
else
logger_ads "The lists are less then 7 days old, saving on flash erosion and NOT refreshing them."
fi

logger_ads "Injecting the DNSMasq nvram options with the dynamic block lists"
nvram get dnsmasq_options > /tmp/dns-options.tmp
if [[ -z "`cat /tmp/dns-options.tmp | grep "/jffs/dns/dnsmasq.adblock.conf"`" || -z "`cat /tmp/dns-options.tmp | grep "/jffs/dns/dlhosts"`" && -e /jffs/dns/dnsmasq.adblock.conf ]] ; then
logger_ads "Did not find DNSMsaq options in nvram, adding them now"
echo "conf-file=/jffs/dns/dnsmasq.adblock.conf" >> /tmp/dns-options.tmp
echo "addn-hosts=/jffs/dns/dlhosts" >> /tmp/dns-options.tmp
nvram set aviad_changed_nvram=1
logger_ads "Added options to nvram DNSMasq options"
else
logger_ads "The DNSMaq options are already in place"
fi

logger_ads "Checking if the personal list is a file"
if [[ -z "`cat /tmp/dnsmasq.conf | grep conf-file=/jffs/dns/personal-ads-list.conf`" && -z "`nvram get dnsmasq_options | grep "/jffs/dns/personal-ads-list.conf"`" && -e /jffs/dns/personal-ads-list.conf ]] ; then
logger_ads "Yes the personal list is in the form of a file"
logger_ads "Removing whitelist from the personal file"
cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /jffs/dns/personal ads-list.conf ; done
echo "conf-file=/jffs/dns/personal-ads-list.conf" >> /tmp/dns-options.tmp
nvram set aviad_changed_nvram=1
else
[ ! -e /jffs/dns/personal-ads-list.conf ] && logger_ads "The personal list (assuming there is one) is not in a file"
[ -n "`nvram get dnsmasq_options | grep "/jffs/dns/personal-ads-list.conf"`" ] && logger_ads "The personal list is a file, and... it is already in place according to the NVRAM options readout"
[ "$1" = "-f" ] && cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /jffs/dns/personal-ads-list.conf ; done && logger_ads "overide switch given so removed whitelist from personal file"
fi
logger_ads "Final settings implementer"
if [ "`nvram get aviad_changed_nvram`" -eq 1 ] ; then
nvram set dnsmasq_options="`cat /tmp/dns-options.tmp`"
logger_ads "Found that NVRAM was changed and committing changes
now"
nvram commit
nvram set aviad_changed_nvram=0
logger_ads "Refreshing DNS settings"
stopservice dnsmasq && logger_ads "stopped the dnsmasq service"
startservice dnsmasq && logger_ads "started the dnsmasq service"
else
logger_ads "Nothing to commit"
fi
rm /tmp/dns-options.tmp
logger_ads "######### Ads blocker script has finished and you should be up and running ##########

Using Intel AMT’s embedded VNC server

Intel Chipsets with vPro/Intel AMT, paired with a Core i5/i7 or Xeon with integrated graphics, have a feature called Remote KVM.

To activate it, press Ctrl-P at the BIOS - this brings you to the MEBx menu, set a password (minimum 8 characters, mixed case, numbers and special characters are enforced - try to avoid #@$% - use star or exclamation), configure the network settings (DHCP, or static - it can even match the OS’s IP address!), enable Remote KVM and disable User Opt-In.

in order to set it up, download the Intel AMT SDK from http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk/ extract the ZIP and open ./Windows/Intel_AMT/Bin/KVM/KVMControlApplication.exe. (I had to install .net 2.0 in my wine in order to be able to run it.)
There, you can enable KVM by clicking "Edit Machine Settings" as seen in the following screenshot:

KVM Status can either be set to
-“redirection ports” (meaning it will only be accessible to clients that specifically support Intel AMT, such as RealVNC Viewer Plus or Intel’s KVM Console, the former of which costs $100, the later constantly overlays a RealVNC logo on the screen), or to
-“default port” (meaning it will be accessible on TCP port 5900 with any VNC client), or to
-“all ports” (which is the combination of both).
If you enable VNC access, you will also need to set an RFB Password. Warning, the password gets truncated at 8 characters but     at the same time has the security requirements identical to the general AMT password (Capital, small letter, number and special-character - WARNING: underscore is not special char, @$%&| are NOT allowed, choose star or exclamation to play safe).
If you disabled User Opt-In in the MEBx menu, you can disable it here as well.

Now you can use almost any VNC client you like (KRDC, Real, Ultra, and Tight VNC works fine, while TigerVNC seems to be unable to auth, and Apple Remote Desktop appears to cause the VNC server to freeze - it's Apple crap, what do you expect?).

Two things worth mentioning:
1: the initial BIOS splash screen is not visible during a KVM connection (not even on a directly-attached screen), so to get to the BIOS, you needed to blindly hit the F10.
2: it is not possible to enter the MEBx menu during a KVM connection (probably for security reasons), if you hit the corresponding CTRL+P key, it immediately exits and continues normal boot; if you establish a KVM connection while already in MEBx, you get disconnected immediately.

 If you’re building a home server, you should definitely consider getting system with Intel vPro/AMT 6.0 or later, you get ILO-like remote management capabilities for free.

Oh yeah, http://your_machine:16992 gives you access to logs, power control, network setup, users, exactly the same way ILO does!

And of course the OS has no idea something is running below him, there is no CPU load, on the host netstat shows no other connections except my ssh:
 tcp        0      0 192.168.aaa.xxx:22          192.168.aaa.yyy:49506       ESTABLISHED 2314/sshd

while from my workstation we can see a second connection to the VNC port 5900:
tcp        0      0 192.168.aaa.yyy:49506       192.168.aaa.xxx:22          ESTABLISHED 13362/ssh   
tcp        0      0 192.168.aaa.yyy:43311       192.168.aaa.xxx:5900        ESTABLISHED 29457/krdc

 Note the black blinking monitors in the upper-right corner - that screams "AMT":

Error 512 - rear chassis fan not detected on a Small Form Factor

as per hp site:
"Although the HP Compaq 8200 Elite Small Form Factor PC has no rear chassis fan installed, this error message may arise when the front panel cable assembly was damaged after a system repair attempt.
In a HP Compaq 8200 Elite Small Form Factor PC, Pin10 on the front panel cable connector is used to tell the system BIOS, that the chassis is a Desktop model, not Microtower model. This is necessary because the system board is also used in HP Compaq 8200 Elite Microtower PC, which has a rear chassis fan installed. Pin10 is not connected there.
If the cable on Pin10 of the connector in a HP Compaq 8200 Elite Small Form Factor PC was damaged accidently and therefore has no connection to the system board, the BIOS assumes that it is a Microtower model and therefore checks for a rear chassis fan."

There is a problem with the front panel connector:

Let's remove it and look, the pin 10 is not connected while pin 5 (usually unused) it is:

We just need to remove the plug from pin 5 and move it to pin10:

Finally the ground is moved from pin 5 to pin 10: