Home of online tutorial

How to configure varnishd to log client IP addresses in Apache log

2012-01-04T10:38:00.001+06:00

Step-1: Add this line to "/etc/httpd/conf/httpd.conf" under the LogFormat Section.

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" varnishcombined

Step-2: Add the varnishcombined to CustomLog

CustomLog /var/log/apache2/www.example.com/access.log varnishcombined

A Default Catchall Virtual Host For Nginx

2011-11-28T12:52:00.001+06:00

default virtual host to catch all domains without a proper match. Thankfully this is as simple as adding the default_server flag to the listen directive. This causes all request without a HOST header or without another vhost matching the HOST header to be sent to this vhost instead. Examples are requests accessing the IP directly or if someone points a random domain at your IP. The server_name _; which you will see mentioned in a lot of guides means nothing and does nothing. It’s just a bogus invalid HOST header that can be used to make sure nothing ever matches it. You should be able to simply not define a server_name.

server {
listen          80 default_server;
server_name     _;

index           index.html;
root            /var/www/default;
}

How to add second IP address to Debian Linux Using Command-Line

2011-10-13T22:43:00.000+06:00

If you are a server system administrator or normal user some time you need to assign a second ipaddress to your server.For this you need to
edit the /etc/network/interfaces file and you need to add the following syntax.

#vi /etc/network/interfaces

auto eth0:1
iface eth0:1 inet static
address 192.168.1.60
netmask 255.255.255.0

After entering all the details you need to restart networking services using the following command

#/etc/init.d/networking restart

Wordpress Permalink on Nginx

2011-10-08T16:35:00.000+06:00

Permalink wordpress
0. Go to Permalinks
1. Common settings – Custom Structure : /%postname%/ or /%category%/%postname%/
2. Save Changes

Setup nginx for permalink on wordpress:

add this line on nginx.conf or vhost conf file:

location / {
root /var/html;
index index.php index.html index.htm;

# permalink wp
if (!-e $request_filename) {
rewrite ^(.*)$ /index.php?q=$1 last;
break;
}
}

Restarting nginx

# /etc/init.d/nginx restart

ERROR 1548 (HY000): Cannot load from mysql.proc. The table is probably corrupted

2011-06-21T10:30:00.000+06:00

A simple command may solve the problem, just issue the command show below
#mysql_upgrade -uroot -p password

How to Disable SSLv2 and Weak Ciphers(PCI Compliance )

2011-06-16T10:43:00.002+06:00

According to section 4.1 of the the Payment Card Industry Data Security Standard (PCI-DSS) v1.2, merchants handling credit card data are required to “use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.”

What does this mean? In order to validate your PCI DSS compliance in this area you will need to ensure that your relevant server(s) within your PCI environment are configured to disallow Secure Sockets Layer (SSL) version 2 as well as "weak" cryptography. You are also required to have quarterly PCI security vulnerability scans conducted against your externally facing PCI systems. Without disabling SSLv2 and weak ciphers you are almost guaranteed to fail the scans. In turn this will lead to falling out of compliance along with the associated risks and consequences.

The SSLv2 Conundrum

Does your server support SSLv2?

How to test:

You will need to have OpenSSL installed on the system that you will perform the tests from. Once installed, use the following command to test your web server, assuming port 443 is where you're providing https connections:

# openssl s_client -ssl2 -connect SERVERNAME:443

If the server does not support SSLv2 you should receive an error similar to the following:

# openssl s_client -ssl2 -connect SERVERNAME:443

CONNECTED(00000003)

458:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:

How to configure Apache v2 to not accept SSLv2 connections:

You will need to modify the SSLCipherSuite directive in the httpd.conf or ssl.conf file.

An example would be editing the following lines to look similar to:

SSLProtocol -ALL +SSLv3 +TLSv1

Restart the Apache process and ensure that the server is functional. Also retest using OpenSSL to confirm that SSLv2 is no longer accepted.

How to configure Microsoft IIS to not accept SSLv2 connections:

You will need to modify the system’s registry.

Merge the following keys to the Windows registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]

"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]

"Enabled"=dword:00000000

Restart the system and ensure that the server is functional. Also retest using OpenSSL to confirm that SSLv2 is no longer accepted.

Those Pesky Weak SSL Ciphers

Does your server support weak SSL ciphers?

How to test:

You will need to have OpenSSL installed on the system that you will perform the tests from. Once installed, use the following command to test your web server, assuming port 443 is where you're providing https connections:

# openssl s_client -connect SERVERNAME:443 -cipher LOW:EXP

If the server does not support weak ciphers you should receive an error similar to the following:

# openssl s_client -connect SERVERNAME:443 -cipher LOW:EXP

CONNECTED(00000003)

461:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226:

How to configure Apache v2 to not accept weak SSL ciphers:

You will need to modify the SSLCipherSuite directive in the httpd.conf or ssl.conf file.

An example would be editing the following lines to look similar to:

SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

Restart the Apache process and ensure that the server is functional. Also retest using OpenSSL to confirm that weak SSL ciphers are no longer accepted.

How to configure Microsoft IIS to not accept weak SSL ciphers:

You will need to modify the system’s registry.

Merge the following keys to the Windows registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]

"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]

"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]

"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]

"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]

"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]

"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]

"Enabled"=dword:0000000

Restart the system and ensure that the server is functional. Also retest using OpenSSL to confirm that weak SSL ciphers are no longer accepted..

At this point have your Approved Scanning Vendor (ASV) scan your external facing PCI environment to validate. Making the above changes should cause the ASV scans to not tag and fail you on the following vulnerabilities:

SSL Server Supports Weak Encryption
SSL Server Allows Cleartext Encryption
SSL Server May Be Forced to Use Weak Encryption
SSL Server Allows Anonymous Authentication

How to disable TCP/IP timestamps

2011-06-16T10:38:00.001+06:00

The Problem:
TCP timestamps are enabled on the remote host. This could allow a remote attacker to estimate the amount of time since the remote host was last booted.

Resolution:

TCP timestamps are generally only useful for testing, and support for them should be disabled if not needed.

To disable TCP timestamps on Linux, add the following line to the /etc/sysctl.conf file:

net.ipv4.tcp_timestamps = 0

To disable TCP timestamps on Windows, set the following registry value:

Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters

Value: Tcp1323Opts

Data: 0 or 1

To disable TCP timestamps on Cisco, use the following command:

no ip tcp timestamp

VSFTP with virtual users on CentOS 5.6

2011-05-06T11:51:00.001+06:00

A virtual user is a user login which does not exist as a real user in the system in /etc/passwd and /etc/shadow file. Virtual users can therefore be more secure than real users, because a compromised account can only use the FTP server but cannot login to system to use other services. As vsftpd supports virtual users with PAM, we can take full advantages of it.

Requirements:

1. Berkeley DB (version 4) databases
2. pam_userdb.so

Step-1: Install Vsftpd, Berkeley DB And Utilities

Type the following command as root user

# yum install db4-utils db4 vsftpd

Step-2: Create The Virtual Users Database

To create a "db4" format file, first create a plain text files with the usernames and password on alternating lines.

For e.g. create user called "ftpuser1" with password called "ftpuserpass1"
# cd /etc/vsftpd
# vi vsftpd.passwd.raw

ftpuser1

ftpuserpass1

ftpuser2

ftpuserpass2

Save the file and Exit. Next, we need to create the actual database file like this way:
# db_load -T -t hash -f vsftpd.passwd.raw vsftpd.passwd.db
# chmod 600 vsftpd.passwd.db

Step-3: Configure Vsftpd for virtual user

#cd /etc/vsftpd/

Add and modify the following settings in vsftpd config file.

#vi vsftpd.conf

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
Local_enable=YES
# Virtual users will use the same privileges as local users.
# It will grant write access to virtual users. Virtual users will use the
# same privileges as anonymous users, which tends to be more restrictive
# (especially in terms of write access).
virtual_use_local_privs=YES
write_enable=YES
#Get chmod Right for Apache,This will set new uploaded files chmod to 644 and folders to 755.
file_open_mode=0666
local_umask=0022

# Set the name of the PAM service vsftpd will use
# RHEL / centos user should use /etc/pam.d/vsftpd
pam_service_name=vsftpd.virtual

# Activates virtual users
guest_enable=YES

#Specify Guest user name

guest_username=apache
# Chroot user and lock down to their home directories
chroot_local_user=YES
# User Level configuration file such as user home directory.

user_config_dir=/etc/vsftpd/user_conf

## Hide ids from user, all user and group information in directory listings will be hidden

hide_ids=YES

Save and exit the file.

Step-4Create a PAM File Which Uses Your New Database

The following PAM is used to authenticate users using your new database. Create /etc/pam.d/vsftpd.virtual:

#vi /etc/pam.d/vsftpd.virtual

Append the following:

#%PAM-1.0

auth required pam_userdb.so db=/etc/vsftpd/vsftpd.passwd

account required pam_userdb.so db=/etc/vsftpd/vsftpd.passwd

session required pam_loginuid.so

Save & Exit.

Step-5: Creating User Configuration file

#cd /etc/vsftpd

#mkdir user_conf

#vi ftpuser1

local_root=/var/www/vhosts/domain1.com/public_html

#vi ftpuser2

local_root=/var/www/vhosts/domain2.com/public_html

for each user, you have to create one file.

Create The Location Of The Files

Step-7: You need to set up the location of the files / dirs for the virtual users. Type the following command:

# mkdir -p /var/www/vhosts/domain1.com/public_html

# mkdir -p /var/www/vhosts/domain2.com/public_html

# chown -R apache:apache /var/www/vhosts

Step-8:Restart The FTP Server

Type the following command:

# service vsftpd restart

Step-9: Test Your Setup

Test with your favorite ftp client program.

How to install Apache Solr on CentOS 5.5

2011-04-27T11:54:00.001+06:00

Requirements:

Java 1.6 or greater. Running java -version at the command line should indicate a version number starting with 1.6. Gnu's GCJ is not supported and does not work with Solr

Step-1: Install sun Jdk

First remove the openjdk if already installed with the following command:

#yum remove java

Download the sun jdk from this location http://download.oracle.com/otn-pub/java/jdk/6u25-b06/jdk-6u25-linux-i586-rpm.bin

#cd /tmp

#wget http://download.oracle.com/otn-pub/java/jdk/6u25-b06/jdk-6u25-linux-i586-rpm.bin

#chmod +x jdk-6u25-linux-i586-rpm.bin

#./jdk-6u25-linux-i586-rpm.bin

#java -version

Output should be something like this:-

java version "1.6.0_25"
Java(TM) SE Runtime Environment (build 1.6.0_25-b06)
Java HotSpot(TM) Client VM (build 20.0-b11, mixed mode, sharing)

Step-2: Install Tomcat 6

We will use jpackage repository for installing tomcat rpm as latest version of tomcat not present in centos base repos. Go to /etc/yum.repos.d/ and issue the following command.

#cd /etc/yum.repos.d/

# wget http://jpackage.org/jpackage50.repo

#yum install tomcat6 tomcat6-webapps tomcat6-admin-webapps

Step-3: Setting up Tomcat Manager account

Go to /etc/tomcat6 directory and edit the tomcat-users.xml file

#cd /etc/tomcat6/

#vi tomcat-users.xml

Add the following line just before the end tag of

Finally start tomcat with the following command and test it with any browser.

#service tomcat6 start

Open your favorite internet browser and browse the tomcat url http://serverip:8080

Step-5: Download & Setup Apache Solr
Download the latest stable version of Solr, in this tutorial, i have used 3.1.0, you can download it from http://mirrors.bd-servers.net/apache//lucene/solr/3.1.0/apache-solr-3.1.0.tgz
#cd /tmp
#wget http://mirrors.bd-servers.net/apache/lucene/solr/3.1.0/apache-solr-3.1.0.tgz
#tar -zxvf apache-solr-3.1.0.tgz
#mv apache-solr-3.1.0 apache-solr
#mv apache-solr /etc/
#cp /etc/apache-solr/dist/apache-solr-3.1.0.war /usr/share/tomcat6/webapps/solr.war
#vi /etc/tomcat6/Catalina/localhost/solr.xml [This will be a new file]
Add the following lines

#vi /etc/apache-solr/example/solr/conf/solrconfig.xml
# Fine $ {solr.data.dir:} and modify to
$ {solr.data.dir: /etc/apache-solr/solr/example/solr/data}

Save the file
Make sure /etc/apache-solr/example/solr/data directory is writable by tomcat user and finally restart Tocamt6 and browse http://serverip:8080/solr

You should see the solr page

Hope this tutorial helps.

Thanks

How To Install Sun Java JDK on CentOS 5.5

2011-04-06T12:15:00.001+06:00

Installing Sun Java JDK in CentOS 5.2

Download the Sun Java JDK from the Java SE Downloads page.

Using your root account, or the sudo command, run the jdk-6u11-linux-i586-rpm.bin (chmod it if necessary). This will install Java packages.

Type java -version. In my case, it show gcj info instead of Sun one.
For selecting the java command, we can use the alternatives program. Use:

/usr/sbin/alternatives --install /usr/bin/java java /usr/java/latest/bin/java 2

Now run

/usr/sbin/alternatives --config java

and select option 2.

Running java -version now should show Sun JVM info.

Remember that maybe you want to do the same with javac and other Java commands.

Hope this helps.

How To Synchronize the Windows 2003 Domain controller with an external time source

2011-04-06T12:14:00.000+06:00

To synchronize the domain controller with an external time source
1.
Click Start, and then click Command Prompt.
2.
In the Command Prompt window, type the following line, where peers is a comma-separated list of IP addresses of the appropriate time sources, and press ENTER:

w32tm /config /manualpeerlist: peers /syncfromflags:MANUAL

The time sources you choose depend on your time zone. For example, if your domain controller is located in the Pacific Time zone, this line might read:

w32tm /config /manualpeerlist:131.107.1.10 /syncfromflags:MANUAL

In this example, the IP address of the timeserver is used instead of the fully qualified domain name for security purposes.

3.
Press ENTER. You should get a message that the command completed successfully.

4.
Type w32tm /config /update

5.
Press ENTER. You should get a message that the command completed successfully.

W32time uses a variable poll interval based on the quality of timesync with the server. On DCs, this interval defaults to between 64 and 1024 seconds.

6.
To immediately synchronize with the external time server, type w32tm /resync and press ENTER. You should get a message that the command completed successfully.

7.
Type Exit and press ENTER.

How to Reset MySql root password in Debian

2011-03-16T20:36:00.000+06:00

Login as root to the machine where your MySQL server is installed

Stop the MySQL server by using either of the following command

#/etc/init.d/mysql stop

Now you need to Start MySQL server without password

# mysqld_safe --skip-grant-tables &

Connect to mysql server using mysql client with the following command

# mysql -u root

Now you should be having mysql prompt

mysql>

Now you need to Setup new MySQL root user password

mysql> use mysql;

mysql> update user set password=PASSWORD(“newrootpassword”) where user=’root’;

mysql> flush privileges;

mysql> quit

Note: Replace newrootpassword with the new root password for MySQL server. Flush Privileges is needed to making the password change effect immediately.

Now you need to Stop MySQL Server using the following command

# /etc/init.d/mysql stop

Test Your New Mysql root password

How to change email envelope from address using PHP mail

2011-02-15T20:51:00.000+06:00

Recently i had to configure one of my email server to relay all email through a third party email service provider name Authsmtp. Authsmtp email server has sender verification policy enabled. so all the email generating from my php application had to use pre defined from address for successful email delivery, my php application was using php mail function to send email. But by default phpmail doesn't change email envelope from address, so though i was using required from address, still the mail server was getting email from apache@localhost. After some search i have found this solution to overwrite email envelope from address.

mail(‘to@somedomain.com’,'subject!’,'body!’,'From: from@yourdomain.com’,'-f from@example.com’);

Hope this will save some ones precious time.

How to masquerade or change outgoing SMTP email or from mail address in postfix

2011-02-11T10:00:00.000+06:00

address rewriting allows changing outgoing email ID or domain name itself. This is good for hiding internal user names. For example:
SMTP user: jack
EMAIL ID: jack @domain.com
Server name: srv01.domain.com

Postfix MTA offers smtp_generic_maps parameter. You can specify lookup tables that replace local mail addresses by valid Internet addresses when mail leaves the machine via SMTP.

Open your main.cf file
# vi /etc/postfix/main.cf

Append following parameter
smtp_generic_maps = hash:/etc/postfix/generic

Save and close the file. Open /etc/postfix/generic file:
# vi /etc/postfix/generic

jack@domain.com mamun@example.com

Save and close the file. Create or update generic postfix table:
# postmap /etc/postfix/generic

Restart postfix:
# /etc/init.d/postfix restart

When mail is sent to a remote host via SMTP this replaces jack@domain.com by mamun@example.com mail address. You can use this trick to replace address with your ISP address if you are connected via local SMTP.

How to setup smart hosts with authentication in postfix

2011-02-10T12:01:00.000+06:00

Step-1: Create a text file as follows:

# P=/etc/postfix/password
# vi $P

The format of the client password file is as follows:

#smtp.isp.com username:password
new.smtp.com jack:pass123

Save and close the file. Set permissions:

Step-2: Make the password file readable only to root

# chown root:root $P
# chmod 0600 $P
# postmap hash:$P

Step-3: Enable relayhost with authentication.

Open main.cf file, enter:
# vi /etc/postfix/main.cf

Append following config directives:

relayhost = new.smtp.com
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/password
smtp_sasl_security_options =

Save and close the file.

Step-4: Restart Postfix:
# /etc/init.d/postfix reload

Multiple FTP Accounts for a single Domain in Linux

2011-01-26T15:28:00.000+06:00

Login to server via SSH as root.
Issue the shell command:

#cat /etc/passwd |grep ‘jerry’

This will show you a line similar to the following:

jerry:x:10041:10001::/var/www/vhosts/example.com:/bin/false

The first number (after the 2nd colon : ) is 10041, so this is the UID of user jerry. You will need this in the ‘useradd’ lines since useradd wants a number for the UID.

Then run the following shell commands to create the users and passwords:
#useradd -u 10041 -o -d /var/www/vhosts/example.com -g jerry -s /bin/false mouse

#useradd -u 10041 -o -d /var/www/vhosts/example.com -g jerry -s /bin/false tomcat

#passwd mouse (enter the new password and confirm it)
#passwd tomcat (enter the new password and confirm it)

You should now be able to use an FTP client to login with that user’s name and password.

User jerry and tomcat should be able to see the example.com docroot just as user jerry can. You should NOT be able to browse above the example.com docroot directory. All 3 users should have the same access to the files since they belong to the same group, so no matter which of the users created or edited the file(s), all should be able to access/edit/whatever the same files.

If you wanted to change their default directory and limit them to a subdomain docroot, in the useradd line above, you would change “/var/www/vhosts/example.com” to “/var/www/vhosts/example.com/subdomains/subname”. So if you wanted to create the same users, but for a subdomain called ‘admin’:
Then do the following shell commands to create the users and passwords:

#useradd -u 10041 -o -d /var/www/vhosts/example.com/subdomains/admin -g jerry -s /bin/false mouse
#useradd -u 10041 -o -d /var/www/vhosts/example.com/subdomains/admin -g jerry -s /bin/false tomcat

#passwd jill (enter the new password and confirm it)
#passwd bob (enter the new password and confirm it)

Deleting an FTP user:

#userdel fptusername

MySQL Db backups using PHP script

2011-01-13T09:18:00.002+06:00

Yesterday, i was transferring one of my php/mysql site to another hosts, at the time of migration i found that i forgot the control panel password, but luckily my ftp password were working. So i could transfer my files to the new server but then i face problem transferring the mysql database, as i don't have the PC/PhpMyAdmin access, i was thinking its impossible, latter i found that its very simple to take the db backup with a small php scripts. I am posting it here so that it can be helpful to others if ever needed.

------$results = exec('mysqldump -uUserName --pPassword dbname > --dbname.sql');

---?>

I wrote this simple php script and uploaded to my old server, and browsed the page, it backed up my db and placed it on my webroot.

mysqldump: Got error: 145: Table './dbname/tablename' is marked as crashed and should be repaired when using LOCK TABLES

2011-01-05T13:13:00.000+06:00

If you get this error message while backing up mysql database with mysqldump, you can fix it simply using a command.
# myisamchk -r /var/lib/mysql/dbname/tablename.MYI
- recovering (with sort) MyISAM-table '/var/lib/mysql/dbname/tablename.MYI'
Data records: 4301
- Fixing index 1
Found block that points outside data file at 2051036
Found block that points outside data file at 2051040

Here is myisamchk is the utility tool that we need to use and "/var/lib/mysql/dbname/tablename.MYI" is the physical path of the table.

Hope this will help you to solve your problem.

Mount directory with another directory in Linux

2010-11-03T11:04:00.000+06:00

To mount a linux directory with another directory on the same system, issue the following command:
#mount --bind /source/directory/ /destination/directory

To unmount, issue the following command:
#umount /destination/directory

How to move SSL from windows to linux

2010-11-01T10:16:00.000+06:00

Step-1: First Export your IIS certificate into a pfx file
Run mmc.exe from command prompt
Click the 'Console' menu and then click 'Add/Remove Snap-in'.
Click the 'Add' button and then choose the 'certificates' snap-in and click on 'Add'.
Select 'Computer Account' then click 'Next'.
Select 'Local Computer' and then click 'OK'.
Click 'Close' and then click 'OK'.
Expand the menu for 'Certificates' and click on the 'Personal' folder.
Right click on the certificate that you want to export and select 'All tasks' -> 'Export'.
A wizard will appear. Make sure you check the box to include the private key and continue through with this wizard until you have a .PFX file.

Step-2: Next run openssl to extract the private key, and the cert file.
# Export the private key file from the pfx file
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
# Export the certificate file from the pfx file
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem
# This removes the passphrase from the private key so Apache won't
# prompt you for your passphase when it starts
openssl rsa -in key.pem -out server.key

Only 480 error messages, but it should contain at least 641 error messages

2010-10-15T16:02:00.000+06:00

Error message file '/usr/share/mysql/english/errmsg.sys' had only 480 error messages,
but it should contain at least 641 error messages.

#yum list installed | grep mysql

In my case, the both package mysql.i386 and mysql.x86_64 is installed. So, i have to remove the mysql.i386 package (old version) and reinstall mysql.x86_64.

#yum remove mysql.i386
#yum install --enablerepo=remi mysql.x86_64

then run mysql_install_db, then mysqld start to get the server running

How To Install MS-Sql extension for php on CentOS 5.4

2010-06-14T11:52:00.029+06:00

If you want your php application to connect to MSSQL database on windows server, then you need to install mssql extension(php-mssql) for php and also a tool named FreeTDS. Its very simple, just follow the steps provided below:

Step-1: Install php-mssql modules using the yum tools as a root user. This will enable php application mssql extension for php.
#yum install php-mssql

Step-2: Now we need to install the freeTDS tools, To install freeTDS on CentOS 5, install the following packages as root:

Before installing FreeTDS, It may be necessary to install CentOS Development tools for the installation to work properly:
#yum groupinstall 'Development Tools'

#yum install freetds freetds-devel unixODBC unixODBC-devel php-devel

Installing these packages will install freetds, unixODBC and development components. The ‘libtdsodbc.so’ library will also be installed in /usr/lib (32bit) or /usr/lib64 (64bit) depending on the version of OS you are using.

Step-3:Configuration freeTDS
In the config file, default TDS version for all database servers is set to 4.2 and we will overwrite this setting using our own setting.For a typical Microsoft SQL Server 2005 configuration, add these lines. Look at the tds version number which is 8.0 works fine with sql server 2000, 2005.

Note: the host need to be the same as the declaration. ie if you have [hostname1], ur host will be = hostname1

#vi /etc/freetds.conf

[HOSTNAME]
   host = HOSTNAME
   port = 1433
   tds version = 8.0

Step-4: Configuration – unixODBC

vi /etc/odbcinst.ini
- add a freeTDS entry:

[TDS]
Description = FreeTDS driver
Driver = /usr/lib/libtdsodbc.so
Setup = /usr/lib/libtdsodbc.so
Trace = Yes
TraceFile = /tmp/freetds.log
FileUsage = 1

Note: Before making above entries, make sure libtdsodbc.so exists in the /usr/lib dir.
In the above configuration, we have define TDS as driver.

The second file is odbc.ini. This file has information about your MS SQL database.

#vi /etc/odbc.ini

[HOSTNAME]
Driver = TDS
Description = Test DB
Trace = Yes
TraceFile = /tmp/mstest.log
Servername = SERVER_IP_ADDRESS
Database = DATABASE_NAME
Port = 1433

Step-5: Testing you configuration
To test, create a connection to a SQL Server instance:

tsql -S -U -P

Once connected, a command prompt should be displayed. Issue test commands:

use dbname
go
select * from tablename
go
To exit the connection, type exit.

If everything goes as expected, then you are done.

How to run java application as a service in debian

2010-06-06T12:51:00.000+06:00

Here is the scrtip, modify it as need.

#! /bin/sh

#Original /etc/init.d/skeleton modified for http://mydebian.blogdns.org

# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="Description"
NAME="Name"
DAEMON=/usr/bin/java
DAEMON_ARGS="-jar yourjar.jar"
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/YourScriptName
#the user that will run the script
USER=UserName

# NO NEED TO MODIFY THE LINES BELOW

# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
. /lib/lsb/init-functions

#
# Function that starts the daemon/service
#
do_start()
{

 start-stop-daemon -b --start --quiet --chuid $USER -m -p $PIDFILE --exec $DAEMON -- $DAEMON_ARGS \
  || return 2
}

#
# Function that stops the daemon/service
#
do_stop()
{
 start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE
 RETVAL="$?"
 rm -f $PIDFILE
 return "$RETVAL"
}

case "$1" in
  start)
 [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
 do_start
 case "$?" in
  0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
  2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
 esac
 ;;
  stop)
 [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
 do_stop
 case "$?" in
  0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
  2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
 esac
 ;;
  restart)
 #
 # If the "reload" option is implemented then remove the
 # 'force-reload' alias
 #
 log_daemon_msg "Restarting $DESC" "$NAME"
 do_stop
 case "$?" in
   0|1)
  do_start
  case "$?" in
   0) log_end_msg 0 ;;
   1) log_end_msg 1 ;; # Old process is still running
   *) log_end_msg 1 ;; # Failed to start
  esac
  ;;
   *)
    # Failed to stop
  log_end_msg 1
  ;;
 esac
 ;;
  *)
 echo "Usage: $SCRIPTNAME {start|stop|restart}" >&2
 exit 3
 ;;
esac

How to Install JDK 1.6 on Debian

2010-06-03T17:17:00.000+06:00

If you want to install JDK 1.6 on debian 5, then you can use etch-backports repositories. You have to add the etch-backports repository to your apt sourcelist first. First you must add this line to your /etc/apt/sources.list

Login to system as root
#vi /etc/apt/sources.list
Then add this line
deb http://www.backports.org/debian/ etch-backports main contrib non-free

Save the file. Now issue
#apt-get update

Then you imports the keyring:
#apt-get install debian-backports-keyring

Enter this command to update apt-get application:
#apt-get update

Now you will gain access to the Backport repository. Finally issue the following command
#apt-get install sun-java6-jdk
This will download and install jdk 1.6

To verify the installation run the following command
# java -version

You should get this:
java version "1.6.0_07"
Java(TM) SE Runtime Environment (build 1.6.0_07-b06)
Java HotSpot(TM) Client VM (build 10.0-b23, mixed mode, sharing)

Next, we need to setup the environment variable JAVA_HOME for java to find it's libraries.

#JAVA_HOME=/usr/lib/jvm/java-6-sun
#export JAVA_HOME
#echo $JAVA_HOME
/usr/lib/jvm/java-6-sun

You are done.

How to configure SSH on Debian Linux

2010-06-02T21:27:00.000+06:00

By default Debian does note install the ssh server if you start with just a base install of the OS. But we can install it later with a very simple and easy steps.

Step-1: First verify if ssh is installed, you can easily find it with this command. Login to your debian box from the console and issue the following command.
#dpkg -l ssh
If the output is something like this "No packages found matching ssh" then the ssh package is not installed. If your box is has internet connection then you can easily install it with "apt-get"

Step-2: Install ssh with the following command.
#apt-get install ssh
This will download and install ssh server on your box.

Step-3: Verify if ssh is running with the following command.
#netstat -nlp | grep ::22
If the output is something like this, then your ssh server is running.

tcp6 0 0 :::22 :::* LISTEN 3270/sshd

Now you can connect to your server with any ssh client.

How to configure Sun VirtualBox on CentOS 5.4

2010-05-28T10:57:00.000+06:00

This article will briefly cover the installation process of VirtualBox on a fresh centos5.4 server. The installation of VirtualBox will require the building of kernel modules. If the development environment and kernel source are not already installed:
Step-1: Install the necessary tools, just issue the following command from command prompt, you must have root privilege for this.

#yum groupinstall "Development Tools"
#yum install kernel-devel

Step-2: Download the rpm from VirtualBox.org Site

#wget http://download.virtualbox.org/virtualbox/3.2.0/VirtualBox-3.2-3.2.0_61806_rhel5-1.i386.rpm

Step-3: Install the VirtualBox
#rpm -Uvh VirtualBox-3.2-3.2.0_61806_rhel5-1.i386.rpm

This will install the VirtualBox into the system

Step-4: We need to assign user to vboxusers group which is created by the installation now who will run VirtualBox
#usermod -G vboxusers username

Step-5: Run the VirtualBox
#VirtualBox &

Now from GNOME or KDE run under "Applications / System Tools / Sun xVM VirtualBox" and start using it.

How to configure Debin linux to run in text mode

2010-05-26T16:19:00.000+06:00

By default debin linux runs in run level 2 which is full multi-user mode. Most installation comes with default login to graphical user mode, but it is possible to change the run level so that it starts with text mode instead of graphical mode. To configure a debian system run in text mode, we can take help of some useful tools like sysvconfig, rccconf, sysv-rc-conf etc. In this tutorial, i will use "rcconf" to configure debian to run in text mode when it boots.

Step-1: Install the rcconf tool
Run the following command to install the tools into your system
#apt-get install rcconf
Step-2: Run the following command to run rcconf
#rcconf
This will open the debian run level configuration window, from list, un-check the gdm or kdm then select ok
Step-3: Reboot your system
#reboot

when the system will boot again, it will boot into text mode. If you want to enable graphical mode again, then just execute the "rcconf" again the check the gdm or kdm and reboot again.

How to Configure Squid Proxy on Windows 2003

2010-05-25T17:28:00.001+06:00

Most of the network admin today knows that Squid is the best and widely used proxy server in the world. In this tutorial, i will show you how to configure Squid proxy server on windows 2003 server. When Squid came, it has only linux version, now we have windows version too. Windows version of squid can be downloaded from this link http://squid.acmeconsulting.it/download/squid-2.6.STABLE23-bin-DELAYP.zip . Download this to your local drive.

Server Requirements:
1. Windows 2003 Server
2. Two Network Interface Card
3. Internet Connection

Preparing the server:
First we need to configure the server so that it has internet connection. Suppose we have internet connection on network interface card1. other card is attached to our local LAN.

coming soon....

How to configure additional IP address on NIC under Red Hat Linux or CentOS

2010-05-22T00:43:00.000+06:00

In this tutorial, i am going to show you how to add a second ip address on nic under RedHat linux or CentOS

The following tutorial uses eth0 as an example for assigning a second TCP/IP address.From the command prompt, issue the following command as root

#ifconfig eth0:1 xxx.xxx.xxx.xxx

Where xxx.xxx.xxx.xxx is the second IP address.

Note that eth0:1 is in case you add only a second IP address. Same way you can add eth0:2, eth0:3 and so on.

To make the changes permanent you will need to add the IP also in the network scripts which are being started on system boot.

1. Verify that your /etc/sysconfig/network-scripts/ifcfg-eth0 file does not have a GATEWAY= parameter in it. If it does, remove it and add that parameter to /etc/sysconfig/network.

2. Copy your /etc/sysconfig/network-scripts/ifcfg-eth0 file to a new file called: /etc/sysconfig/network-scripts/ifcfg-eth0:1

#cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0:1

3. In /etc/sysconfig/network-scripts/ifcfg-eth0:1 change DEVICE=eth0 to DEVICE=eth0:1

4. In /etc/sysconfig/network-scripts/ifcfg-eth0:1 modify IPADDR= to match the additional TCP/IP address you wish to use.

5. Start the secondary interface:

ifup eth0:1

6. Restart the server if necessary.

Hope this tutorial helps,,

How to configure PPTP with freeradius and mysql

2010-03-11T14:16:00.000+06:00

Poptop (http://www.poptop.org/) is the PPTP server solution for Linux and is used for establishing VPN (Virtual Private Network) tunnels across the Internet.
It uses pppd to establish the network link and thus can benefit the radius pppd-radius plugin to work with FreeRADIUS:
authorization of the access can be done on several parameters (username, user group, VPN server IP address or name, VPN client IP address, connection time...)
authentication of the user can be delegated to the radius server (which can use several backends to store user profiles)
IP pool management for the VPN client can be delegated to the FreeRADIUS server
if MPPE encryption is required, MPPE keys can be generated by the FreeRADIUS server
Accounting data can be sent to FreeRADIUS
In order to use MPPE, authentication must be setup to use MS-CHAP or MS-CHAPv2 which requires the user password to be stored in NTLM hashed format or in cleartext format in the FreeRADIUS backend.

How to install Denyhosts on CentOS 5.4 to block SSHD attack

2010-03-08T13:12:00.002+06:00

DenyHosts is a script intended to be run by Linux system administrators to prevent SSH server attacks (also known as dictionary based attacks and brute force attacks).

In this tutorial, i am going to show you how to configure denyhosts in centos 5.4. We will use yum to install the software, but centos base repository doesn't have the denyhosts software, so in this case we can use Rpmforge repository because they maintain this software in their repositories.

Installing Rpmforge repository:

RPMforge is a collaboration of Dag, Dries, and other packagers. They provide over 4000 packages for CentOS, including mplayer, xmms-mp3, and other popular media tools. It is not part of RedHat or CentOS but is designed to work with these major distributions.

Packages are supplied in RPM format and in most cases are ready to use. Beware that some packages are newer than the official CentOS version and you should not blindly install those packages. Before you replace a CentOS package you should make sure that will not break anything important. In most cases you can revert any mistakes but it is best to avoid the mess.

Step-1: Install the Rpmforge repo
#rpm -Ivh http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.1-1.el5.rf.i386.rpm

Step-2: Installation of denyhosts:
#yum install denyhosts

Step-3: Starting the service and marking it to run at boot time
#chkconfig --level 2345 denyhosts on
#service denyhosts start
[note: It could take a minute or 2 start start initially, give this command at least 2-3 min to return you to a bash prompt]

Step-5: Allowing yourself unrestricted access with the allowed-hosts and hosts.allow lists:
# vi /var/lib/denyhosts/allowed-hosts
192.168.4.10
# vi /etc/hosts.allow
192.168.4.10

[note: you'll want to add in these 2 files the IP(s) you will use to connect to your system that's running Denyhosts so that you aren't inadvertently denied access to your own system(s).]

Step-6: Configuration of denyhosts:

#vi /etc/denyhosts/denyhosts.cfg

   ############ THESE SETTINGS ARE REQUIRED ############

########################################################################
#
# SECURE_LOG: the log file that contains sshd logging info
# if you are not sure, grep "sshd:" /var/log/*
#
# The file to process can be overridden with the --file command line
# argument
#
# Redhat or Fedora Core:
SECURE_LOG = /var/log/secure
#
# Mandrake, FreeBSD or OpenBSD:
#SECURE_LOG = /var/log/auth.log
#
# SuSE:
#SECURE_LOG = /var/log/messages
#
# Mac OS X (v10.4 or greater -
# also refer to: http://www.denyhosts.net/faq.html#macos
#SECURE_LOG = /private/var/log/asl.log
#
# Mac OS X (v10.3 or earlier):
#SECURE_LOG=/private/var/log/system.log
#
########################################################################

########################################################################
#
# HOSTS_DENY: the file which contains restricted host access information
#
# Most operating systems:
HOSTS_DENY = /etc/hosts.deny
# Defines the active ban list.
# Some BSD (FreeBSD) Unixes:
#HOSTS_DENY = /etc/hosts.allow
#
# Another possibility (also see the next option):
#HOSTS_DENY = /etc/hosts.evil
#######################################################################

########################################################################
#
# PURGE_DENY: removed HOSTS_DENY entries that are older than this time
# when DenyHosts is invoked with the --purge flag
#
# format is: i[dhwmy]
# Where 'i' is an integer (eg. 7)
# 'm' = minutes
# 'h' = hours
# 'd' = days
# 'w' = weeks
# 'y' = years
#
# never purge:
PURGE_DENY = 6y
# I figure the average hardware lifecycle of servers is 2 years or less
# so 6 years should be plenty if i want an IP permanently banned.
# purge entries older than 1 week
#PURGE_DENY = 1w
#
# purge entries older than 5 days
#PURGE_DENY = 5d
#
# For the default Fedora Extras install, we want timestamping but no
# expiration (at least by default) so this is deliberately set high.
# Adjust to taste.
#PURGE_DENY = 4w
#######################################################################

#######################################################################
#
# PURGE_THRESHOLD: defines the maximum times a host will be purged.
# Once this value has been exceeded then this host will not be purged.
# Setting this parameter to 0 (the default) disables this feature.
#
# default: a denied host can be purged/re-added indefinitely
PURGE_THRESHOLD = 1
#
# a denied host will be purged at most 2 times.
#PURGE_THRESHOLD = 2
# This step assures a repeat offender is forever banned and maintained in /etc/hosts.deny
#######################################################################

#######################################################################
#
# BLOCK_SERVICE: the service name that should be blocked in HOSTS_DENY
#
# man 5 hosts_access for details
#
# eg. sshd: 127.0.0.1 # will block sshd logins from 127.0.0.1
#
# To block all services for the offending host:
BLOCK_SERVICE = ALL
# To block only sshd:
#BLOCK_SERVICE = sshd
# To only record the offending host and nothing else (if using
# an auxilary file to list the hosts). Refer to:
# http://denyhosts.sourceforge.net/faq.html#aux
#BLOCK_SERVICE =
# I've set this to "ALL" because if any user is attempting malicious entry to the system,
# I want all potential avenues of damage to be cut-off instantly. Bans can easily be lifted,
# a compromised system could rob you of a lifetime of work and effort.
#######################################################################

#######################################################################
#
# DENY_THRESHOLD_INVALID: block each host after the number of failed login
# attempts has exceeded this value. This value applies to invalid
# user login attempts (eg. non-existent user accounts)
#
DENY_THRESHOLD_INVALID = 1
# I've set this value to 1 attempt for a user without an account on the system
# attempting to login, they obviously have no right even trying to login so they
# should be blocked immediately.
#######################################################################

#######################################################################
#
# DENY_THRESHOLD_VALID: block each host after the number of failed
# login attempts has exceeded this value. This value applies to valid
# user login attempts (eg. user accounts that exist in /etc/passwd) except
# for the "root" user
#
DENY_THRESHOLD_VALID = 3
# I've set known user login attempts to 3 for increased security in a login/pass scenario.
# For added security you can restrict access only to users with the proper ssh id_dsa or
# id_rsa keys. (see fedorasolved.org for more info on setting this up.)
#######################################################################

#######################################################################
#
# DENY_THRESHOLD_ROOT: block each host after the number of failed
# login attempts has exceeded this value. This value applies to
# "root" user login attempts only.
#
DENY_THRESHOLD_ROOT = 1
# Since i've set my sshd_config to refuse root logins, I want this set to only 1 attempt
# at root login before the offending IP is banned since no one should be logging in as root.
#######################################################################

#######################################################################
#
# DENY_THRESHOLD_RESTRICTED: block each host after the number of failed
# login attempts has exceeded this value. This value applies to
# usernames that appear in the WORK_DIR/restricted-usernames file only.
#
DENY_THRESHOLD_RESTRICTED = 1
# This refers to /var/lib/denyhosts/hosts-restricted, I don't want these people logging in
# at all so i set the failed threshold to 1 attempt before banning the IP.
#######################################################################

#######################################################################
#
# WORK_DIR: the path that DenyHosts will use for writing data to
# (it will be created if it does not already exist).
#
# Note: it is recommended that you use an absolute pathname
# for this value (eg. /home/foo/denyhosts/data)
#
WORK_DIR = /var/lib/denyhosts
# This defines the working directory for Denyhosts
#######################################################################

#######################################################################
#
# SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS
#
# SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES|NO
# If set to YES, if a suspicious login attempt results from an allowed-host
# then it is considered suspicious. If this is NO, then suspicious logins
# from allowed-hosts will not be reported. All suspicious logins from
# ip addresses that are not in allowed-hosts will always be reported.
#
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
# This (YES) setting monitors all IPs (even allowed IPs) for suspicious connections
# or attempts and logs/reports this activity for investigation.
####################################################################

######################################################################
#
# HOSTNAME_LOOKUP
#
# HOSTNAME_LOOKUP=YES|NO
# If set to YES, for each IP address that is reported by Denyhosts,
# the corresponding hostname will be looked up and reported as well
# (if available).
#
HOSTNAME_LOOKUP=YES
# This setting allows for hostname lookup on all IPs reported by denyhosts.
######################################################################

######################################################################
#
# LOCK_FILE
#
# LOCK_FILE=/path/denyhosts
# If this file exists when DenyHosts is run, then DenyHosts will exit
# immediately. Otherwise, this file will be created upon invocation
# and deleted upon exit. This ensures that only one instance is
# running at a time.
#
# Redhat/Fedora:
LOCK_FILE = /var/lock/subsys/denyhosts
#
# Debian
#LOCK_FILE = /var/run/denyhosts.pid
#
# Misc
#LOCK_FILE = /tmp/denyhosts.lock
#
######################################################################

   ############ THESE SETTINGS ARE OPTIONAL ############

#######################################################################
#
# ADMIN_EMAIL: if you would like to receive emails regarding newly
# restricted hosts and suspicious logins, set this address to
# match your email address. If you do not want to receive these reports
# leave this field blank (or run with the --noemail option)
#
# Multiple email addresses can be delimited by a comma, eg:
# ADMIN_EMAIL = foo@bar.com, bar@foo.com, etc@foobar.com
#
ADMIN_EMAIL = put the email address here you want mailed when new IP entries are added.
#
#######################################################################

#######################################################################
#
# SMTP_HOST and SMTP_PORT: if DenyHosts is configured to email
# reports (see ADMIN_EMAIL) then these settings specify the
# email server address (SMTP_HOST) and the server port (SMTP_PORT)
#
#
SMTP_HOST = localhost
#SMTP_HOST = smtp1.your_server_here.net
SMTP_PORT = 25
#
#######################################################################

#######################################################################
#
# SMTP_USERNAME and SMTP_PASSWORD: set these parameters if your
# smtp email server requires authentication
#
#SMTP_USERNAME=foo
#SMTP_PASSWORD=bar
#
######################################################################

#######################################################################
#
# SMTP_FROM: you can specify the "From:" address in messages sent
# from DenyHosts when it reports thwarted abuse attempts
#
SMTP_FROM = DenyHosts
#
#######################################################################

#######################################################################
#
# SMTP_SUBJECT: you can specify the "Subject:" of messages sent
# by DenyHosts when it reports thwarted abuse attempts
SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]
#
######################################################################

######################################################################
#
# SMTP_DATE_FORMAT: specifies the format used for the "Date:" header
# when sending email messages.
#
# for possible values for this parameter refer to: man strftime
#
# the default:
#
SMTP_DATE_FORMAT = %a, %d %b %Y %H:%M:%S %z
#
######################################################################

######################################################################
#
# SYSLOG_REPORT
#
# SYSLOG_REPORT=YES|NO
# If set to yes, when denied hosts are recorded the report data
# will be sent to syslog (syslog must be present on your system).
# The default is: NO
#
SYSLOG_REPORT=YES
#
#SYSLOG_REPORT=NO
# Obvious.
######################################################################

######################################################################
#
# ALLOWED_HOSTS_HOSTNAME_LOOKUP
#
# ALLOWED_HOSTS_HOSTNAME_LOOKUP=YES|NO
# If set to YES, for each entry in the WORK_DIR/allowed-hosts file,
# the hostname will be looked up. If your versions of tcp_wrappers
# and sshd sometimes log hostnames in addition to ip addresses
# then you may wish to specify this option.
#
ALLOWED_HOSTS_HOSTNAME_LOOKUP=YES
# This section refers to /var/lib/denyhosts/allowed-hosts file, which adds in a hostname
# lookup into the log entry.
######################################################################

######################################################################
#
# AGE_RESET_VALID: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to login attempts
# to all valid users (those within /etc/passwd) with the
# exception of root. If not defined, this count will never
# be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_VALID=5m
# This section refers to resetting the allowed login attempts to 0 for valid users
# on the system after being locked out or using any of the 3 given attempts in the
# "DENY_THRESHOLD_VALID" variable above. Currently, this is set to reset to 0 after
# 5 minutes of inactivity (i.e. logging into the system).
######################################################################

######################################################################
#
# AGE_RESET_ROOT: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to all login
# attempts to the "root" user account. If not defined,
# this count will never be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_ROOT=6y
# This essentially is another step to make *sure* a specific banned IP *stays* banned.
######################################################################

######################################################################
#
# AGE_RESET_RESTRICTED: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to all login
# attempts to entries found in the WORK_DIR/restricted-usernames file.
# If not defined, the count will never be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_RESTRICTED=25d
# This section refers to login attempts made by the IPs listed in the
# /var/lib/denyhosts/hosts-restricted file. This lets us specify a time period
# after which the login attempts defined in the variable DENY_THRESHOLD_RESTRICTED
# is reset to 0 failed attempts.
######################################################################

######################################################################
#
# AGE_RESET_INVALID: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to login attempts
# made to any invalid username (those that do not appear
# in /etc/passwd). If not defined, count will never be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_INVALID=10d
# Same as DENY_THRESHOLD_RESTRICTED above but for the variable DENY_THRESHOLD_INVALID
# which defines login attempts by usernames nonexistent on the system.
######################################################################

######################################################################
#
# RESET_ON_SUCCESS: If this parameter is set to "yes" then the
# failed count for the respective ip address will be reset to 0
# if the login is successful.
#
# The default is RESET_ON_SUCCESS = no
#
RESET_ON_SUCCESS = yes
# This basically tells us if a valid user on the system accidentally fails logging
# in twice but then has success on the third attempt that we should immediately reset
# his faulty login attempt threshold to 0 again. (even admins forget logins ;))
#####################################################################

######################################################################
#
# PLUGIN_DENY: If set, this value should point to an executable
# program that will be invoked when a host is added to the
# HOSTS_DENY file. This executable will be passed the host
# that will be added as it's only argument.
#
#PLUGIN_DENY=/usr/bin/true
#
######################################################################

######################################################################
#
# PLUGIN_PURGE: If set, this value should point to an executable
# program that will be invoked when a host is removed from the
# HOSTS_DENY file. This executable will be passed the host
# that is to be purged as it's only argument.
#
#PLUGIN_PURGE=/usr/bin/true
#
######################################################################

######################################################################
#
# USERDEF_FAILED_ENTRY_REGEX: if set, this value should contain
# a regular expression that can be used to identify additional
# hackers for your particular ssh configuration. This functionality
# extends the built-in regular expressions that DenyHosts uses.
# This parameter can be specified multiple times.
# See this faq entry for more details:
# http://denyhosts.sf.net/faq.html#userdef_regex
#
#USERDEF_FAILED_ENTRY_REGEX=
#
#
######################################################################

   ######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE ##########

#######################################################################
#
# DAEMON_LOG: when DenyHosts is run in daemon mode (--daemon flag)
# this is the logfile that DenyHosts uses to report it's status.
# To disable logging, leave blank. (default is: /var/log/denyhosts)
#
DAEMON_LOG = /var/log/denyhosts
#
# disable logging:
#DAEMON_LOG =
#
######################################################################

#######################################################################
#
# DAEMON_LOG_TIME_FORMAT: when DenyHosts is run in daemon mode
# (--daemon flag) this specifies the timestamp format of
# the DAEMON_LOG messages (default is the ISO8061 format:
# ie. 2005-07-22 10:38:01,745)
#
# for possible values for this parameter refer to: man strftime
#
# Jan 1 13:05:59
DAEMON_LOG_TIME_FORMAT = %b %d %H:%M:%S
#
# Jan 1 01:05:59
#DAEMON_LOG_TIME_FORMAT = %b %d %I:%M:%S
#
######################################################################

#######################################################################
#
# DAEMON_LOG_MESSAGE_FORMAT: when DenyHosts is run in daemon mode
# (--daemon flag) this specifies the message format of each logged
# entry. By default the following format is used:
#
# %(asctime)s - %(name)-12s: %(levelname)-8s %(message)s
#
# Where the "%(asctime)s" portion is expanded to the format
# defined by DAEMON_LOG_TIME_FORMAT
#
# This string is passed to python's logging.Formatter contstuctor.
# For details on the possible format types please refer to:
# http://docs.python.org/lib/node357.html
#
# This is the default:
DAEMON_LOG_MESSAGE_FORMAT = %(asctime)s - %(name)-12s: %(levelname)-8s %(message)s
#
#
######################################################################

#######################################################################
#
# DAEMON_SLEEP: when DenyHosts is run in daemon mode (--daemon flag)
# this is the amount of time DenyHosts will sleep between polling
# the SECURE_LOG. See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
#
DAEMON_SLEEP = 30s
#
#######################################################################

#######################################################################
#
# DAEMON_PURGE: How often should DenyHosts, when run in daemon mode,
# run the purge mechanism to expire old entries in HOSTS_DENY
# This has no effect if PURGE_DENY is blank.
#
DAEMON_PURGE = 1h
#
#######################################################################

   ######### THESE SETTINGS ARE SPECIFIC TO ##########
   ######### DAEMON SYNCHRONIZATION ###########
# Note: I do *not* recommend using this "feature". With security it's good to be paranoid.
# The function of this setting is to talk to other servers and share ban lists.
# I do not want other remote systems altering ban settings for core security
# programs (i.e. Denyhosts).
#######################################################################
#
# Synchronization mode allows the DenyHosts daemon the ability
# to periodically send and receive denied host data such that
# DenyHosts daemons worldwide can automatically inform one
# another regarding banned hosts. This mode is disabled by
# default, you must uncomment SYNC_SERVER to enable this mode.
#
# for more information, please refer to:
# http:/denyhosts.sourceforge.net/faq.html#sync
#
#######################################################################

#######################################################################
#
# SYNC_SERVER: The central server that communicates with DenyHost
# daemons. Currently, denyhosts.net is the only available server
# however, in the future, it may be possible for organizations to
# install their own server for internal network synchronization
#
# To disable synchronization (the default), do nothing.
#
# To enable synchronization, you must uncomment the following line:
#SYNC_SERVER = http://xmlrpc.denyhosts.net:9911
#
#######################################################################

#######################################################################
#
# SYNC_INTERVAL: the interval of time to perform synchronizations if
# SYNC_SERVER has been uncommented. The default is 1 hour.
#
#SYNC_INTERVAL = 1h
#
#######################################################################

#######################################################################
#
# SYNC_UPLOAD: allow your DenyHosts daemon to transmit hosts that have
# been denied? This option only applies if SYNC_SERVER has
# been uncommented.
# The default is SYNC_UPLOAD = yes
#
#SYNC_UPLOAD = no
#SYNC_UPLOAD = yes
#
#######################################################################

#######################################################################
#
# SYNC_DOWNLOAD: allow your DenyHosts daemon to receive hosts that have
# been denied by others? This option only applies if SYNC_SERVER has
# been uncommented.
# The default is SYNC_DOWNLOAD = yes
#
#SYNC_DOWNLOAD = no
#SYNC_DOWNLOAD = yes
#
#
#
#######################################################################

#######################################################################
#
# SYNC_DOWNLOAD_THRESHOLD: If SYNC_DOWNLOAD is enabled this parameter
# filters the returned hosts to those that have been blocked this many
# times by others. That is, if set to 1, then if a single DenyHosts
# server has denied an ip address then you will receive the denied host.
#
# See also SYNC_DOWNLOAD_RESILIENCY
#
#SYNC_DOWNLOAD_THRESHOLD = 10
#
# The default is SYNC_DOWNLOAD_THRESHOLD = 3
#
#SYNC_DOWNLOAD_THRESHOLD = 3
#
#######################################################################

#######################################################################
#
# SYNC_DOWNLOAD_RESILIENCY: If SYNC_DOWNLOAD is enabled then the
# value specified for this option limits the downloaded data
# to this resiliency period or greater.
#
# Resiliency is defined as the timespan between a hackers first known
# attack and it's most recent attack. Example:
#
# If the centralized denyhosts.net server records an attack at 2 PM
# and then again at 5 PM, specifying a SYNC_DOWNLOAD_RESILIENCY = 4h
# will not download this ip address.
#
# However, if the attacker is recorded again at 6:15 PM then the
# ip address will be downloaded by your DenyHosts instance.
#
# This value is used in conjunction with the SYNC_DOWNLOAD_THRESHOLD
# and only hosts that satisfy both values will be downloaded.
# This value has no effect if SYNC_DOWNLOAD_THRESHOLD = 1
#
# The default is SYNC_DOWNLOAD_RESILIENCY = 5h (5 hours)
#
# Only obtain hackers that have been at it for 2 days or more:
#SYNC_DOWNLOAD_RESILIENCY = 2d
#
# Only obtain hackers that have been at it for 5 hours or more:
#SYNC_DOWNLOAD_RESILIENCY = 5h
#
#######################################################################

Default web site on apache when browsing with IP

2010-01-26T16:17:00.007+06:00

Default Vhost

Remember that although we created a vhost for domain1.com and domain2.com, if someone enters the IP address of the Slice they are served the contents of the domain1.com vhosts.

Why are they served from that vhost?

Apache searches the enabled vhosts from the top down. Therefore, once it finds a matching vhost for the IP address entered, the contents of that domain are displayed. As we setup domain1.com initially in this example, the contents for this domain will be shown if you enter your slice's IP address in a browser.

This is something to keep in mind when planning your websites. Do you want a particular domain to be the default? Do you want the IP address to have completely different content?

If you want the IP address to have separate content than your domains, you will need to create an additional vhost and use the IP of your slice as the ServerName.

#Default site when browsing with IP address

DocumentRoot /var/www/vhosts/defaultsite
ServerName your server ip

#
#DocumentRoot /var/www/vhosts/aaf.dev/public_html
#ServerName aaf.dev.lin.bd.panth.com
#AddHandler php5-fastcgi .php
#Action php5-fastcgi /cgi-bin/phpfcgid.fcgi
#

Shell script to backup mysql database

2010-01-26T15:57:00.002+06:00

Taking all mysql db backup is very simple if you use this small shell scripts, just create a file named mysqlbackup.sh and paste the all the text below:

#!/bin/bash
#
NOW=$(date +"%m-%d-%Y") # mm-dd-yyyy format
FILE="" # used in a loop

BAK="/home/backups/mysql" # Path to backup dir

### Server Setup ###
#* MySQL login user name *#
MUSER="dbbackup"

#* MySQL login PASSWORD name *#
MPASS="password"

#* MySQL login HOST name *#
MHOST="localhost"

#* MySQL binaries *#
MYSQL="$(which mysql)"
MYSQLDUMP="$(which mysqldump)"
GZIP="$(which gzip)"

# get all database listing
DBS="$($MYSQL -u $MUSER -h $MHOST -p$MPASS -Bse 'show databases')"

# start to dump database one by one
for db in $DBS
do
FILE=$BAK/$db-backkup.$NOW-$(date +"%T").gz
# gzip compression for each backup file
$MYSQLDUMP -u $MUSER -h $MHOST -p$MPASS $db | $GZIP -9 > $FILE
done

The MySQL permissions required for the script above are SHOW DATABASES, SELECT, LOCK TABLES, and RELOAD. Grant them by entering the mysql command line and issuing these commands (choosing a better password than 'readonly' of course)

GRANT SHOW DATABASES, SELECT, LOCK TABLES, RELOAD ON *.* to backup@localhost
IDENTIFIED BY 'readonly';
FLUSH PRIVILEGES;

Create a cron job that will execute this script regularly at a specific time, in my case i set it to 22:30 PM every night and here is my cron job

30 22 * * * sh /path/to/your/mysqlbackup.sh

Create another cron job that will execute at a specific time to clean your backup files older than 5 days

25 22 * * * find /home/backups/mysql/ -name '*.sql' -and -mtime +4 | xargs rm -f

That's it.

Downgrading php 5.3 to php 5.2 using yum on centos 5.4

2010-01-19T17:19:00.000+06:00

First you need to allow downgrade for yum and for that you need to install yum-allowdowngrad utility program, but its very easy to install, Just issue the following command:

#yum install yum-allowdowngrade

Now add a line to your yum.conf file, its located in /etc/yum.conf
#vi /etc/yum.conf
showdupesfromrepos=1

After that list all php packages:

yum list php

If php 5.2.8 is available, remove new one:

yum remove php

and install an old one:

yum --allow-downgrade install php-5.2.8

You are done.

How to install subversion 1.6.6 on CentOS 5.4

2009-12-29T21:52:00.004+07:00

Step-1: Download all the required .rpm file from this location(http://the.earth.li/pub/subversion/summersoft.fay.ar.us/pub/subversion/latest/1.6.6/rhel5/i386/) to your local drive.

step-2: Remove Cadaver: yum remove cadaver

Step-3: Remoe old Neon and Neon Devel: yum remove neon neon-devel

Step-4: Install latest version of neon: rpm-Uvh neon-0.28.4-1.i386.rpm

Step-5: Install latest version of neon devel: rpm -Uvh neon-devel-0.28.4-1.i386.rpm

Step-6: Remove sqlite-devel: yum remove sqlite-devel

Step-7: Install latest sqlite and sqlite-devel: yum install sqlite sqlite-devel

Step-8: Install latest subversion and mod_dav_svn:

to be continued..........

How to install sun java JDK

2009-12-27T17:10:00.001+07:00

alternatives --install /usr/bin/java java /usr/java/jdk1.6.0_17/bin/java 100

alternatives --install /usr/bin/jar jar /usr/java/jdk1.6.0_17/bin/jar 100

alternatives --install /usr/bin/javac javac /usr/java/jdk1.6.0_17/bin/javac 100

Set JAVA_HOME / PATH for all user

You need to setup global config in /etc/profile OR /etc/bash.bashrc file for all users:
# vi /etc/profile
Next setup PATH / JAVA_PATH variables as follows:
export PATH=$PATH:/usr/java/jdk1.5.0_07/bin export PATH=$PATH:/usr/java/jdk1.5.0_07/bin

How to create a self-signed SSL Certificate with OpenSSL

2009-12-27T10:21:00.000+07:00

Overview

The following is an extremely simplified view of how SSL is implemented and what part the certificate plays in the entire process.

Normal web traffic is sent unencrypted over the Internet. That is, anyone with access to the right tools can snoop all of that traffic. Obviously, this can lead to problems, especially where security and privacy is necessary, such as in credit card data and bank transactions. The Secure Socket Layer is used to encrypt the data stream between the web server and the web client (the browser).

SSL makes use of what is known as asymmetric cryptography, commonly referred to as public key cryptography (PKI). With public key cryptography, two keys are created, one public, one private. Anything encrypted with either key can only be decrypted with its corresponding key. Thus if a message or data stream were encrypted with the server's private key, it can be decrypted only using its corresponding public key, ensuring that the data only could have come from the server.

If SSL utilizes public key cryptography to encrypt the data stream traveling over the Internet, why is a certificate necessary? The technical answer to that question is that a certificate is not really necessary - the data is secure and cannot easily be decrypted by a third party. However, certificates do serve a crucial role in the communication process. The certificate, signed by a trusted Certificate Authority (CA), ensures that the certificate holder is really who he claims to be. Without a trusted signed certificate, your data may be encrypted, however, the party you are communicating with may not be whom you think. Without certificates, impersonation attacks would be much more common.

Step 1: Generate a Private Key

The openssl toolkit is used to generate an RSA Private Key and CSR (Certificate Signing Request). It can also be used to generate self-signed certificates which can be used for testing purposes or internal usage.

The first step is to create your RSA Private Key. This key is a 1024 bit RSA key which is encrypted using Triple-DES and stored in a PEM format so that it is readable as ASCII text.

openssl genrsa -des3 -out server.key 1024

Generating RSA private key, 1024 bit long modulus

.........................................................++++++

........++++++

e is 65537 (0x10001)

Enter PEM pass phrase:

Verifying password - Enter PEM pass phrase:

Step 2: Generate a CSR (Certificate Signing Request)

Once the private key is generated a Certificate Signing Request can be generated. The CSR is then used in one of two ways. Ideally, the CSR will be sent to a Certificate Authority, such as Thawte or Verisign who will verify the identity of the requestor and issue a signed certificate. The second option is to self-sign the CSR, which will be demonstrated in the next section.

During the generation of the CSR, you will be prompted for several pieces of information. These are the X.509 attributes of the certificate. One of the prompts will be for "Common Name (e.g., YOUR name)". It is important that this field be filled in with the fully qualified domain name of the server to be protected by SSL. If the website to be protected will be https://public.akadia.com, then enter public.akadia.com at this prompt. The command to generate the CSR is as follows:

openssl req -new -key server.key -out server.csr

Country Name (2 letter code) [GB]:CH

State or Province Name (full name) [Berkshire]:Bern

Locality Name (eg, city) [Newbury]:Oberdiessbach

Organization Name (eg, company) [My Company Ltd]:Akadia AG

Organizational Unit Name (eg, section) []:Information Technology

Common Name (eg, your name or your server's hostname) []:public.akadia.com

Email Address []:martin dot zahn at akadia dot ch

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Step 3: Remove Passphrase from Key

One unfortunate side-effect of the pass-phrased private key is that Apache will ask for the pass-phrase each time the web server is started. Obviously this is not necessarily convenient as someone will not always be around to type in the pass-phrase, such as after a reboot or crash. mod_ssl includes the ability to use an external program in place of the built-in pass-phrase dialog, however, this is not necessarily the most secure option either. It is possible to remove the Triple-DES encryption from the key, thereby no longer needing to type in a pass-phrase. If the private key is no longer encrypted, it is critical that this file only be readable by the root user! If your system is ever compromised and a third party obtains your unencrypted private key, the corresponding certificate will need to be revoked. With that being said, use the following command to remove the pass-phrase from the key:

cp server.key server.key.org

openssl rsa -in server.key.org -out server.key

The newly created server.key file has no more passphrase in it.

-rw-r--r-- 1 root root 745 Jun 29 12:19 server.csr

-rw-r--r-- 1 root root 891 Jun 29 13:22 server.key

-rw-r--r-- 1 root root 963 Jun 29 13:22 server.key.org

Step 4: Generating a Self-Signed Certificate

At this point you will need to generate a self-signed certificate because you either don't plan on having your certificate signed by a CA, or you wish to test your new SSL implementation while the CA is signing your certificate. This temporary certificate will generate an error in the client browser to the effect that the signing certificate authority is unknown and not trusted.

To generate a temporary certificate which is good for 365 days, issue the following command:

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Signature ok

subject=/C=CH/ST=Bern/L=Oberdiessbach/O=Akadia AG/OU=Information

Technology/CN=public.akadia.com/Email=martin dot zahn at akadia dot ch

Getting Private key

Step 5: Installing the Private Key and Certificate

When Apache with mod_ssl is installed, it creates several directories in the Apache config directory. The location of this directory will differ depending on how Apache was compiled.

cp server.crt /usr/local/apache/conf/ssl.crt

cp server.key /usr/local/apache/conf/ssl.key

Step 6: Configuring SSL Enabled Virtual Hosts

SSLEngine on

SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt

SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

CustomLog logs/ssl_request_log \

"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

Step 7: Restart Apache and Test

/etc/init.d/httpd stop

Generating a Certificate Signing Request (CSR)

2009-10-27T16:52:00.003+07:00

This howto describes the instructions to generate a CSR for your Web site. In this guide I use OpenSSL.

Step-1: Create a RSA private key for your Apache server, PEM-formatted:

#openssl genrsa -des3 -out .key 2048

It will ask for a pass phrase, provide a pass phrase of your own here.

Step-2: Create a Certificate Signing Request using the RSA private key created above (output will be PEM format):

#openssl req -new -key .key -out .csr

Note that the Common Name field is the field where the domain name should be stated.

If you want to read your generated .csr file, then issue the following command

#openssl req -text -noout -in .csr

How to remove a Hidded Network Adaptor from windows pc

2009-10-04T16:46:00.002+07:00

Some times we face problem while configuring a NIC, the error message says the address is already assigned to a other NIC but we do not see any NIC from device manager or Network Manage because the other NIC is hidden. To resolve this problem we can troubleshoot in two ways.

Troubleshooting Step-1:

Step-1: Type the following commands at a command prompt

set DEVMGR_SHOW_NONPRESENT_DEVICES=1

Step-2: Open Device Manager enable "Show Hidden Devices" from the View Menu bar

Step-3: Locate the hidden device and uninstall it.

Step-4: Reboot the pc

If you are lucky then this will solve your hidden network card problem, if not then you have to go little more

Troubleshooting Step-2:
Microsoft has Device Configuration Utility called devcon which can be use to enable, disable, restart, update, remove, and query individual devices or groups of devices. To use DevCon, follow these steps:
Step-1: Download the DevCon tool by clicking the following article number to view the article in the Microsoft Knowledge Base:311272 (http://support.microsoft.com/kb/311272/ ) The DevCon command-line utility functions as an alternative to Device Manager
Step-2: Unpack the 32-bit or 64-bit DevCon tool binary to a local folder.
Step-3: Click Start, click Run, then type cmd and press ENTER.
Type CD:\path_to_binaries to navigate to the devcon.exe is located.

Step-4:Use the following syntax to find installed network adapters:
devcon findall =net or
devcon listclass net
Note In the output of the previous commands, there is a line for the ghosted network adapter that is similar to the following:
PCI\VEN_10B7&DEV_9200&SUBSYS_00D81028&REV_78\4&19FD8D60&0&58F0: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
Step-5:Remove the ghosted device by typing the following syntax:
devcon -r remove "@PCI\VEN_10B7&DEV_9200&SUBSYS_00D81028&REV_78\4&19FD8D60&0&58F0"

How to configure sendmail for dns based blacklisting

2009-07-13T13:40:00.000+07:00

Sendmail can be configured to check and block IP addresses of incoming emails that are found to be listed on one or more DNS blacklists.

This can be achieved by configuring sendmail directive dnsbl or DNS blacklists. During the SMTP handshake and conversation of host’s IP address to sendmail SMTP port,

sendmail can check the connecting hosts for possible black listed IP address from DNS blacklists, lowering down the percentage of incoming SPAM emails.

In this tutorial, i am going to show you how to do that in quick simple and easy steps

Steps on how to configure sendmail to check with DNS Blacklists

Step-1:

Choose which DNS blacklists are active with a high history of reliability for blacklisting IP address. As an example here,

we would be using three DNS blacklists servers

zen.spamhaus.org

list.dsbl.org

combined.njabl.org

You can use your choice of DNS blacklists server sources to suit your needs.

Step-2:

Configure sendmail to use dnsbl sendmail directive. Backup and modify /etc/mail/sendmail.mc and insert the below details

FEATURE(`dnsbl', `zen.spamhaus.org', `"550 Refused unsolicited email from " $`'&{client_addr} " - Request access at http://www.spamhaus.org/query/bl?ip=" $`'&{client_addr} ')dnl

FEATURE(`dnsbl', `list.dsbl.org', `"550 Refused unsolicited email from " $`'&{client_addr} " - Request access see http://dsbl.org/listing?"$&{client_addr}')dnl

FEATURE(`dnsbl', `combined.njabl.org', `"550 Refused unsolicited email from " $`'&{client_addr} " - Request access see http://njabl.org/lookup?$&{client_addr}')dnl

The above has been customized to reflect the following useful details

a. IP address of the denied computer hosts

b. DNS blacklist server that has been used for checking the denied host

c. Error message with URL site to be shown to computer host for further course of action and why he has been blocked

The above sendmail details would also be reflected to sendmail’s default log file for further statistics and monitoring details.

By default, dnsbl sendmail directive is not included with default sendmail configuration setup.

Step-3:

Recompile and restart sendmail daemon service

# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf

# service sendmail restart

Monitoring DNS Blacklist Logs with Sendmail

# tailf /var/log/maillog | grep ‘Refused unsolicited’

Counting blocked hosts by Sendmail DNS blacklists

# cat /var/log/maillog | grep ‘Refused unsolicited’ | wc -l

How to configure Sendmail as Smart Host

2009-07-13T11:34:00.001+07:00

We can configure sendmail to send emails directly to destination host or email server. but, network traffic congestion, destination location, and connectivity issue sometimes affect successful mail delivery.

In this tutorial, we are going to configure Sendmail as a smart email host

i am assuming that you have a existing and working Sendmail Setup

Configuration Steps for Sendmail as Smart Host

To create a smart host from your sendmail, backup and edit your sendmail conf file

# vi /etc/mail/sendmail.cdf

Look for sendmail directive line similar below and modify it

dnl define(`SMART_HOST’, `smtp.your.provider’)dnl

Simply replace ’smtp.your.provider’ with your email gateway server and remove the starting and ending ‘dnl’ words from the line . The new sendmail smart host directive will look like

define(`SMART_HOST’, `you-smtp.your.provider’)

Save and exit.

Recompile sendmail configuration file

# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf

Restart sendmail daemon service

# service sendmail restart

When an email failed to be delivered, sendmail smart host will act as a fallback failover mechanism on sending failed emails from local sendmail source to smart host STMP server then going to email destination server.

How to configure SSL VPN on centos 5.3

2009-06-29T14:04:00.005+07:00

SSL VPN is an integrated software solution enabling secure, clientless remote access to internal network resources from any Web browser. Designed for remote employees, SSL VPN provides comprehensive control over file systems and Web-based applications requiring external access.

In this tutorial, i am going to show you how to configure a web based SSL VPN on CentOS 5.3 using Adito, Adito is a web-based SSL VPN server written in Java. It has a browser-based AJAX UI which allows easy access to intranet services. Adito is a fork of SSL-Explorer. For more informaiton, see http://adito.wiki.sourceforge.net

Requirements:

1. JRE

2. Ant

3. Adito Binaries

Step-1: Installing JRE and Configuring JAVA Environment.

You can install JRE in two ways, one using YUM and another is manual way, that means downloading JRE rpm and manual configuration. In this article i am using YUM to install JRE.

#yum install jre

JRE has some dependencies, but don’t worry, yum will handle that automatically for you.

Step-2: Installing ANT

You can also install ANT using YUM utility, Just issue the following command;

#yum install ant

It also has some dependencies, but dont worry YUM will install them for you automatically.

Step-3: Adito configuration

First download the binary release of Adito from sourceforge (http://nchc.dl.sourceforge.net/sourceforge/adito/adito-0.9.1-bin.tar.gz)

#wget http://nchc.dl.sourceforge.net/sourceforge/adito/adito-0.9.1-bin.tar.gz

After downloading, un compress it.

#tar -zxvf adito-0.9.1-bin.tar.gz

#cd adito-0.9.1

Now we need to configure adito, its very simple, just issue the following command:

#ant install

Output will be something like this;

Buildfile: build.xml

set-tools:

check-tools:

check-permissions:

install:

[java] Starting installation wizard.........Point your browser to http://ServerName:28080.

[java] Press CTRL+C or use the 'Shutdown' option from the web interface to leave the installation wizard.

Its asking to point your browser to http://ServerName:28080, open browser and type url with port. you will the Adito Server Configuration Page. Complete the Configuration wizard and click finish.

Then in the terminal, output will be something like this; that means configuration done

[java] .

[java] Jun 29, 2009 8:19:53 PM java.util.prefs.FileSystemPreferences$3 run

[java] INFO: Created system preferences directory in java.home.

BUILD SUCCESSFUL

Total time: 3 minutes 17 seconds

Now Run adito by issuing the following command:

#ant start

terminal output will be something like this;

Buildfile: build.xml

create-wrapper-conf:

[copy] Copying 1 file to /opt/adito-0.9.1/conf

[echo] Creating wrapper configuration dynamically

[echo] Java executable: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/bin/java

[echo] Wrapper directory: install/platforms/linux/x86

set-tools:

check-tools:

check-permissions:

start:

[exec] Starting Adito...

[echo] Adito started

BUILD SUCCESSFUL

Total time: 0 seconds

Now you can browse the Adito simply typing the server name or ip in the browser and play with it.

To install Adito as linux service, issue the following command;

#ant install-service

Thats it. We are done with SSL VPN Configuration.

How to download Youtube video with goog chrome

2009-06-25T11:44:00.002+07:00

You are watching youtube video using google chrome browser, suddenly you thought you need to download this video, but how??

Just follow this steps:

Open your chrome browser if already not open, create a book mark named "Download YouTube" and for the address, paste the following code:

javascript:window.location.href = 'http://youtube.com/get_video?video_id=' + swfArgs['video_id']+ "&l=" + swfArgs['l'] + "&sk=" + swfArgs['sk'] + '&fmt_map' + swfArgs['fmt_map'] + '&t=' + swfArgs['t'];

Then save your bookmark. Next go to the YouTube video you want to download, when it starts playing click your "Download YouTube" bookmark and you will see the .flv start to download in Chrome's download status bar.

Disable the Application Error Reporting tool DW20.exe

2009-06-22T16:16:00.000+07:00

To disable the Application Error Reporting tool, add a DWReportee value of 1 to following registry keys:
HKEY_CURRENT_USER\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW
HKEY_CURRENT_USER\Software\Microsoft\PCHealth\ErrorReporting\DW
HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\DW

How to install PhyMyAdmin on Centos 5.3

2009-06-21T12:06:00.006+07:00

PhpMyAdmin is a very usefull tool to manage and control MySql Server database from browser. Installation is also very easy and straight forward. Just follow the steps below:

Step-1: Download Latest Version of PhpMyAdmin

Latest version of phpmyadmin is 3.2 but it requires to have php 5.3 installed in the web server. Currenlty php 5.3 doesn't support in CentOS 5.3, so better to install the early verstion.

#wget http://nchc.dl.sourceforge.net/sourceforge/phpmyadmin/phpMyAdmin-2.11.9.5-all-languages.tar.gz

Uncompressed the downloaded file and rename it to phpmyadmin. Move the phpmyadmin folder to /usr/share/

#mv phpmyadmin /usr/share

Step-2: Configuration

There are two ways of configuring PhpMyAdmin, you can place the files where they need to be and edit configuration files to suit or there is an setup script for those that are more comfortable doing it that way. I'll go through the manual installation process here.

Go to /usr/share/phpmyadmin and copy the sample config file as config.inc.php

#cd /usr/share/phpmyadmin/

#cp config.sample.inc.php config.inc.php

Now edit the config.inc.php for our own setting.

#vi config.inc.php

Go to authentication section and change the auth_type to http and in the server parameters, change host name if mysql installed in different server.

/* Authentication type */

$cfg['Servers'][$i]['auth_type'] = 'http';

/* Server parameters */

$cfg['Servers'][$i]['host'] = 'localhost';

$cfg['Servers'][$i]['connect_type'] = 'tcp';

Save the file and exit.

Now create one file named phpmyadmin.conf under /etc/httpd/conf.d/ and add the following lines to it

#touch /etc/httpd/conf.d/phpmyadmin.conf

#vi /etc/httpd/conf.d/phpmyadmin.conf

#Application to manage MySQL

Alias /phpMyAdmin /usr/share/phpmyadmin

Save the file and Exit. Now to read the phpmyadmin configuration file, Reload Apache or Restart apache

#Service httpd restart

Now time to test. from a browser, type http://servername/phpmyadmin

It will ask for user name and password, Provide mysql login user name and password, if everything this is ok, then you will be in phpmyadmin control panel, now do what ever you need.

How to switch IIS to 32bit mode in windows 2003 64 bit edition

2009-06-15T14:20:00.003+06:00

On a 64bit windows 2003 server, you can run 32 bit web applications by switching IIS to 32bit mode. To do this you need to execute few command.

First check IIS current mode by executing the following command:

cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs get W3SVC/AppPools/Enable32bitAppOnWin64

Microsoft (R) Windows Script Host Version 5.6

The parameter "Enable32bitAppOnWin64" is not set at this mode

you should see that it returns a value of false as shown below, which shows that IIS is currently running in 64-bit mode.

In order to configure IIS to run in 32-bit mode you need to execute this command :

cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs SET W3SVC/AppPools/Enable32bitAppOnWin64 1

Microsoft (R) Windows Script Host Version 5.6

Enable32bitAppOnWin64 : (BOOLEAN) True

You should now see that it returns a value of True as shown here. This means that IIS is now running in 32-bit mode on your server.

How to Configure VPN (PPTP) Server on CentOS 5.3

2009-06-14T15:09:00.001+06:00

In this document you will find the steps on how to build a Linux Point to Point Tunneling Protocol (PPTP) server using Poptop.

This allows roaming users to connect to their corporate network from anywhere on the Internet securely and inexpensively.

It supports Windows 95/98/Me/NT/2000/XP PPTP clients and Linux PPTP clients.

Requirements: -

Server: CentOS 5.3

kernel-2.6.18-128.el5

ppp-2.4.4-2.el5

pptpd-1.3.4-1.rhel5

Kernel version 2.6.15 or above has MPPE built-in which is required for MSCHAPv2. CentOS 5 kernel version is 2.6.18 that means you do not need to install the MPPE module. CentOS 5comes with ppp-2.4.4-1.el5 and it is MPPE support enabled.

Step-1: Install ppp if already not installed and Check if kernel supports MPPE

#yum install ppp

Run the command below to test if your kernel supports MPPE and you should get a return an “ok”: -

#modprobe ppp-compress-18 && echo ok

Step-2: Install PPTPD

You cannot install the pptpd using yum utility because it’s not in yum repo. Download the RPM file pptpd-1.3.4-1.rhel5.1.i386.rpm from http://poptop.sourceforge.net/yum/stable/packages/

#wget http://poptop.sourceforge.net/yum/stable/packages/pptpd-1.3.4-1.rhel5.1.i386.rpm

Install the RPM by running this command: -

#rpm -ivh pptpd-1.3.4-1.rhel5.1.i386.rpm

Step-3: Configuration

Change the /etc/ppp/options.pptpd as below: -

#vi /etc/ppp/options.pptpd

name pptpd

refuse-pap

refuse-chap

refuse-mschap

require-mschap-v2

require-mppe-128

proxyarp

lock

nobsdcomp

novj

novjccomp

nologfd

Change the following file /etc/pptpd.conf

#vi /etc/pptpd.conf

option /etc/ppp/options.pptpd

logwtmp

localip 192.168.2.1

remoteip 192.168.2.11-15

Add the following username (johndie) and password (passwrd) in /etc/ppp/chap-secrets as below: -

# Secrets for authentication using CHAP

# client server secret IP addresses

vpnuser pptpd passwrd *

Step-4: Run the following command to enable the pptpd to start automatically in runlevel 3 and 5 as below: -

#chkconfig --level 35 pptpd on

Now, you can start the pptpd service as below: -

#service pptpd start

Step-5: For pptpd to work, the packet forwarding must be enabled. Edit /etc/sysctl.conf and change the line to below: -

#vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

To enable it immediately, run following command: -

#sysctl -p

Now test your setup by creating a vpn connection from any windows or linux pc.

How to configure MySQL High Availability with DRBD and Heartbeat on Centos 5.3

2009-05-28T10:49:00.007+06:00

In this tutorial, we're going to go through the entire process of installing, configuring and testing DRBD, Heartbeat and MySQL running in a 2 node cluster environment. This will be a general configuration for learning.

Best practices and security will take a back seat while we learn how all the different pieces work together.

Let’s get started.

Requirements:

In this setup we need two server. To continue farther, you should be very comfortable with installing and configuring MySQL and other software packe before starting this step by step process.

I am using CentOs 5.3 distribution for this tutorial.I am using CentOs 5.3 distribution for this tutorial. you will need two server, i am using vmware server for this tutorial as it is the best for this type setup testing.

Server 1:

Host Name: CentOS5a

IP Address eth0: 192.168.4.220/24

eth1:192.168.1.1/24

Server 2:

Host Name: CentOS5b

IP Address eth0: 192.168.4.222/24

eth1:192.168.1.2/24

Step-1: Installation

[root@node0 ~]# yum install drbd

[root@node0 ~]# rpm install kmod-drbd

[root@node0 ~]# yum install heartbeat

[root@node0 ~]# yum install mysql

[root@node0 ~]# yum install mysql-devel

This will install drbr 8.2, heartbeat 2.1.3, drbd kernel module 8.0.13, mysql 5.0.45, which will work just fine for learning DRBD and Heartbeat. Now that we have all our software installed, Now need to start the configuration.

Step-2: Configuring DRBD

We’re ready to start configuring DRBD on our two node system. Centos5a will become our primary node, making Centos5b our secondary node. These are our steps for configuring DRBD:

1. Create partitions on both nodes.

2. Create drbd.conf

o Configure global drbd options.

3. Configure resource which consists of:

o Disk partitions on node0 and node1.

o Network connection between nodes.

o Error handling

o Synchronization

Step-3: On each node, use fdisk to create a type 83 linux partition:

#fdisk /dev/sda

Step-4: Editing the configuration file.

Now edit the drbd.conf file. Location of this file is /etc/drbd.conf, make sure you backup first.

#vi drbd.conf

#Here is a sample but working configuration file.

global {

minor-count 1;

}

resource mysql {

protocol C; # There are A, B and C protocols. Stick with C.

# incon-degr-cmd "echo 'DRBD Degraded!' | wall; sleep 60 ; halt -f";

# If a cluster starts up in degraded mode, it will echo a message to all

# users. It'll wait 60 seconds then halt the system.

on centos5a {

device /dev/drbd0; # The name of our drbd device.

disk /dev/sdb1; # Partition we wish drbd to use.

address 192.168.4.220:7788; # Centos5a IP address and port number.

meta-disk internal; # Stores meta-data in lower portion of sdb1.

}

on centos5b {

device /dev/drbd0; # Our drbd device, must match node0.

disk /dev/sdb1; # Partition drbd should use.

address 192.168.4.222:7788; # IP address of Centos5b, and port number.

meta-disk internal; #Stores meta-data in lower portion of sdb1.

}

disk {

on-io-error detach; # What to do when the lower level device errors.

}

net {

max-buffers 2048; #datablock buffers used before writing to disk.

ko-count 4; # Peer is dead if this count is exceeded.

#on-disconnect reconnect; # Peer disconnected, try to reconnect.

}

syncer {

rate 10M; # Synchronization rate, in megebytes. Good for 100Mb network.

#group 1; # Used for grouping resources, parallel sync.

al-extents 257; # Must be prime, number of active sets.

}

startup {

wfc-timeout 0; # drbd init script will wait infinitely on resources.

degr-wfc-timeout 120; # 2 minutes.

}

# End of resource mysql

Step-5: Bringing up DRBD

All software, drbd.conf, and devices have been created, make sure only Centos5a is running. Login as root, then issue the following command:

[root@node0 ~]# drbdadm create-md mysql

After that reboot Centos5a server and login to it as root and issue the following command:

#cat /proc/drbd

Output will be something like this.

Note that centos5a is in a secondary state, we will fix this by promoting it to the primary.

Step-6: Now Start up second node that means Centos5b then you'll have to issue the following command:

[root@centos5b ~]# drbdadm create-md mysql

Complete the process and issue another command

#cat /proc/drbd

Output will be something like this:

You can see that both server is in seconday state. now we will promote the centos5a to primary.

Step-7: Promoting first node to Primary

[root@Centos5a ~]# drbdadm -- --overwrite-data-of-peer primary mysql

Now verify that it really promoted the first node to primary by running the following command again

#cat /proc/drbd

Output will be something like this

You've now created a two node cluster. It's very basic, failover is not automatic. We need to take care of that with Heartbeat. First, we need to test DRBD.

Step-8: Testing DRBD

To have a working system, we need to create a filesystem on Centos5a. We do that just like normal, the difference is we use /dev/drbd0 device instead of /dev/sdb1:

[root@Centos5a ~]# mkfs.ext3 -L mysql /dev/drbd0

[root@Centos5b ~]# mkfs.ext3 /dev/drbd0

mke2fs 1.35 (28-Feb-2004)

mkfs.ext3: Wrong medium type while trying to determine filesystem size

You're on Centos5b, which is secondary and /dev/drbd0 is read only! Switch to Centos5a.

Once that's done, we'll do some simple tests. On Centos5a, mount /dev/drbd0 on /mnt/. Change to that directory, then touch a few test files, create a directory. In order to check to see if our files have been replicated, we need to unmount /mnt/mysql, make Centos5a secondary, promote Centos5b to primary, remount /mnt/mysql then check to see if your files are on Centos5b. These steps are:

[root@Centos5a ~]# umount /mnt/mysql

[root@Centos5a ~]# drbdadm secondary mysql

Switch to Centos5b, then:

[root@Centos5b ~]# drbdadm primary mysql

[root@Centos5b ~]# mount /dev/drbd0 /mnt/mysql

Check /mnt/ and see what's in there. You should see your files and directories you created on Centos5a! You'll probably notice we didn't make a filesystem on Centos5b for /dev/drbd0. That's because /dev/drbd0 is replicated, so when we created the filesystem on Centos5a, it was also created on Centos5b. Matter of fact, anything we do in Centos5a:/dev/drbd0 will automatically get replicated to Centos5b:/dev/drdb0.

Next, we'll configure MySQL to use our DRBD device. We'll practice manually failing MySQL over between nodes before automating it with Heartbeat. You want to make sure you understand how the entire system works before automation. That way, if there was a problem with our test files not showing up on Centos5b, then we know there's a problem with DRBD. If we tried to test the entire system as one large piece, it would be much more difficult to figure out which piece of the puzzle was giving us our problem. For practice, return Centos5a to primary node, and double check your files.

How to create SQL Agent Proxy Accounts in SQL 2005/2008 Server

2009-05-27T15:08:00.003+06:00

In SQL Server 2005 and 2008, to allow a non-sysadmin login to execute xp_cmdshell, you will need to create a special system credential "xp_cmdshell_proxy_account" by running the extended stored procedure "sp_xp_cmdshell_proxy_account" and specify a Windows account. This account will be used to run xp_cmdshell by users that are not members of the sysadmin role.

Before moving forward, we first need to enable the xp_cmndshell by using Sql Serface Area Configuration for Features:
Open it and from left pane, select DatabaseServer, expand it and expand Database Engine also, then select xp_cmdshell, now from the right pane, select check box that says Enable xp_cmdshell

Step-1: Execute the following query from sql management Studio login as sa.

USE master

-- Create a user that will be used for running xp_cmdshell called cmdshelluser

CREATE LOGIN cmdshelluser WITH PASSWORD='passcmdshell'

-- Add a Windows domain account Domain\User as the SQL Agent Proxy account

EXEC sp_xp_cmdshell_proxy_account 'domain\sql2005proxy', 'password';

-- Grant database access to the SQL Server login account that you want to provide access.

EXEC sp_grantdbaccess 'cmdshelluser'

-- Grant execute permission on xp_cmdshell to the SQL Server login account.

GRANT exec ON sys.xp_cmdshell TO cmdshelluser

Step-2: Verify that the account is created.

--To confirm that the ##xp_cmdshell_proxy_account## credential has been created.

select * from sys.credentials

Step-3: Test executing the xp_cmdshell sp.

EXECUTE AS login = 'cmdshelluser'

--Execution of xp_cmdshell is allowed.

--And executes successfully!!!

EXEC xp_cmdshell 'DIR C:\*.*'

Now we are going to explore more on xp_cmdshell with bcp utility. We will use xp_cmdshell and bcp utility to export database table data to remote pc as .csv file in a domain environment. Just follow the steps described below:

Step-4: Grand data reader access to cmdshelluser to the database from where you want to export table data.

USE Dbname

EXEC sp_grantdbaccess 'cmdshelluser'

EXEC sp_addrolemember N'db_datareader', N'cmdshelluser'

Step-5: Create one shared folder on remote computer in the same domain.From sharing Tab, allow everyone group change permission and from security tab, grant domainUsers Group modify Permission.

Step-6: Now time to test.

declare @cmd nvarchar(1000)

set @cmd = 'bcp "select * from db_name..table_name" queryout \\remoteserver\CSVReports\test.csv -U cmdshelluser -P passcmdshell -S"dbserver\SQL2005ENT" -w'

EXECUTE AS login = 'cmdshelluser'

exec master..xp_cmdshell @cmd

If everything is ok, it will export table data to remote server.

ISO Image Path Issue with vmware

2009-04-29T15:27:00.001+06:00

If you want to install any virtual server in vmware using .iso file, then definitely you will face one issue, while providing image file path, vmware will say invalid path. You can overcome this isue by following this way,

1. First Install as CD/DVD drive and complete the Create new vitual machine creating wizard.

2. After virtual machine creation, edit the cd/dvd setting and provide the image path as following way

[] d:\path_to_image_dir\imagename.iso

Thats it, when you click ok, it will accept the path. and now you can install the OS using .iso file without any problem.

File Synchronization with Rsync

2009-04-28T16:55:00.000+06:00

Rsync can be used to compare files on the same physical machine, or between two different hosts on your network. If you're planning to sync files between two hosts, you should make sure that rsync is installed on both hosts - simply follow the process above to install the program on each host.

Step-1: Installing rsync

You can check if it is already installed on your system or not by using the following command.

#rpm -q rsync

If it is not installed then install it, the easiest way to do this by using yum, Just issue the command

#yum install rsync

Once you are done with the installation, you can go for a test drive. The first and most basic thing you can do with rsync involves using it as a more intelligent copy command on your local system. So, let's suppose that I have the following directory tree in my home area on my Linux box

Configurating High Availability Linux Apache cluster

2009-04-27T19:06:00.000+06:00

Failover clusters are used to ensure high availability of system services and applications even through crashes, hardware failures, and environmental mishaps. In this article, I'll show you how to implement a rock-solid two-node high availability Apache cluster with the heartbeat application from The High-Availability Linux Project.

In a cluster environment, a high availability (HA) system is responsible for starting and stopping services, mounting and dismounting resources, monitoring the system availability in the cluster environment, and handling the ownership of the virtual IP address that's shared between cluster nodes. The heartbeat service provides the basic functions required for the HA system.

The most common cluster configuration is called standby configuration, as described here. In the standby cluster configuration, one node performs all the work while the other node is idle. Heartbeat monitors health of particular service(s) usually through a separate Ethernet interface used only for HA purposes using special ping. If a node fails for some reason, heartbeat transfers all the HA components to the healthy node. When the node recovers, it can resume its former status.

Installation & Configuration: To setup High Availability Linux, you need a second Ethernet adapter on each node to devote to heartbeat. Install the Apache Web server and the heartbeat program on both nodes.

Step-1: Install the heartbeat programs

#yum install httpd heartbeat

Step-2: Copying the configuration file

The configuration files for heartbeat are not in place when the software is installed. You need to copy them from the documentation folder to the /etc/ha.d/ folder:

cp /usr/share/doc/heartbeat*/ha.cf /etc/ha.d/

cp /usr/share/doc/heartbeat*/haresources /etc/ha.d/

cp /usr/share/doc/heartbeat*/authkeys /etc/ha.d/

Step-3: Configuring the hosts file

In the /etc/hosts file you must add hostnames and IP addresses to let the two nodes see each other. In my case it looks like this:

192.168.1.1 node1.almamunbd.com node1

192.168.1.2 node2.almamunbd.com node2

Make sure you have the exact same /etc/hosts file on both nodes and that you're able to ping both nodes. You can just copy the file from one node to another using secure copy:

scp /etc/hosts root@node2:/etc/

Step-4: Modifying the heartbeat configuration file

Next, modify the configuration file /etc/ha.d/ha.cf.

Edit the following entries in order to get heartbeat to work:

logfile /var/log/ha-log #where to log everything from heartbeat

logfacility local0 #Facility to use for syslog/logger

keepalive 2 # the time between the heartbeats

deadtime 30 #how long until the host is declared dead

warntime 10 #how long before issuing "late heartbeat" warning

initdead 120 # Very first dead time (initdead)

udpport 694 #udp port for the bcast/ucast communication

bcast eth1 #on what interface to broadcast

ucast eth1 10.0.0.1 #this is a 2-node cluster, so no need to use multicast here

auto_failback on #we want the resources to automatically fail back to its primary node

node node1.almamunbd.com #the name of the first node

node node2.almamunbd.com #the name of the second node

This are the basic options necessary for heartbeat to work. The file has to be configured identically on both nodes, except for the "ucast" part where you define the IP address of peer to send packets to.

Step-5: Configuring the /etc/ha.d/haresources file

In this file you need to define the master node name, virtual IP address (cluster IP), and which resources to start. In our case, we're starting the Apache Web server.

We need only one line of data here:

node1.almamunbd.com 192.168.1.5 httpd

Make sure the file is exactly the same on both nodes. Note that the resource name is the name of the init script located in the /etc/init.d folder. If the resource name is not exactly the same as in /etc/init.d/, heartbeat will not be able to find it when it tries to read it and both Apache and heartbeat will fail to start.

Step-6: Configuring the /etc/ha.d/authkeys

The last heartbeat-related file is /etc/ha.d/authkeys. This file must also be the same on both nodes, and it needs to be readable and writable only by the root user. If the permissions are different from what heartbeat expects, heartbeat will refuse to start. Make sure you have the file configured like this:

auth 1

1 crc

And make sure it's readable and writable by root only:

chmod 600 /etc/ha.d/authkeys

Now it's time to configure the Apache service. We want Apache to listen on the virtual IP address 192.168.1.5, and we need to point the Apache document root to the /var/www/vhosts/ mount point where our Web files will be kept.

Listen 192.168.1.5:80

DocumentRoot "/var/www/vhosts"

It's important for the Apache service to not start automatically at boot time, since heartbeat will start and stop the service as needed. Disable the automatic start with the command (on a Red Hat-based system):

chkconfig httpd remove

Make sure you have the same Apache configuration on both nodes.

Step-7: Testing the configuration

Now it's time to start the newly created cluster. Start the heartbeat service on both nodes:

/etc/init.d/heartbeat start

Watch the /var/log/ha-log on both nodes. If everything is configured correctly, you should see something like this in your log files:

Configuration validated. Starting heartbeat 1.2.3.cvs.20050927

heartbeat: version 1.2.3.cvs.20050927

Link node1.almamunbd.com:eth1 up.

Link node2.almamunbd.com:eth1 up.

Status update for node node2.almamunbd.com: status active

Local status now set to: 'active'

remote resource transition completed.

Local Resource acquisition completed. (none)

node2.almamunbd.com wants to go standby [foreign]

acquire local HA resources (standby).

local HA resource acquisition completed (standby).

Standby resource acquisition done [foreign].

Initial resource acquisition complete (auto_failback)

remote resource transition completed.

Now test the failover. Reboot the master server. The slave should take over the Apache service. If everything works well, you should see something like this:

Received shutdown notice from 'node1.example.com'.

Resources being acquired from node1.example.com.

acquire local HA resources (standby).

local HA resource acquisition completed (standby).

Standby resource acquisition done [foreign].

Running /etc/ha.d/rc.d/status status

Taking over resource group 192.168.1.5

Acquiring resource group: node1.example.com 192.168.1.5 httpd

mach_down takeover complete for node node1.example.com.

node node1.example.com: is dead

Dead node node1.example.com gave up resources.

Link node1.example.com:eth1 dead.

And when the master comes back online again, he should take over the Apache service:

Heartbeat restart on node node1.example.comheartbeat

Link node1.example.com:eth1 up.

node2.example.com wants to go standby [foreign]

standby: node1.example.com can take our foreign resources

give up foreign HA resources (standby).

Releasing resource group: node1.example.com 192.168.1.5 httpd

Local standby process completed [foreign].

remote resource transition completed.

Other node completed standby takeover of foreign resources.

Conclusion

That's all it takes to build a low-cost highly available Web server cluster. There are of course many commercial products that accomplish the same goal, but for the production needs for small business or any other institution, High Availability Linux and heartbeat are an excellent alternative.

Blocking AutoRun for all devices

2009-04-26T18:37:00.001+06:00

Step 1. Start Notepad or another text editor.

Step 2. Copy the following text from this page and paste it into your text editor (everything between the square brackets should be all on one line):

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]

@="@SYS:DoesNotExist"

Step 3. Save the file with a name like NoAutoRun.reg, taking care to include the .reg extension.

Step 4. Right-click your .reg file and choose Merge. Confirm any warning prompts to add the information to the Registry.

it's a good idea to reboot your PC after the step 4

How to configure Apache, SuExec, PHP/FastCGI on RedHat Fedora 6

2009-04-04T14:43:00.000+06:00

More or less we suffer one problem while configuring linux based webserver with virtual hosting support. We need to provide client ftp account to upload scripts or files to his webroot directory. this is not a problem until client executes some script that creates a files or directories inside his webroot directories. because while clients uploads file using ftp, fileownership becomes ftpusername. but when file or directory gets created by scripts then the ownership becomes apache that means the user account under which apache is running. To solve this problem, we can use the suexec module with apache. so that when any files or directory gets created through web, it has the ownership the of the user that runs it.

Follow this steps to achieve this:

Step 1: Install the required software and modules

# yum install httpd httpd-devel mod_fcgid php php-cli

Step-2: Add your virtual host

virtualhost 192.168.4.3:80>

ServerName mamun.com

DocumentRoot /var/www/vhosts/mamun.com/public_html

# some settings for fastCGI

PHP_Fix_Pathinfo_Enable 1

MaxRequestsPerProcess 500

SuexecUserGroup mamun.com mamun.com

directory /var/www/vhosts/mamun.com/public_html/>

AddHandler fcgid-script .php

Options +ExecCGI

FCGIWrapper /var/www/vhosts/mamun.com/public_html/cgi-bin/php-cgi .php

/directory>

/virtualhost>

The first two lines are the usual vhost setup. What follows are two options recommended for running PHP in FastCGI mode. The first one makes sure the $_SERVER['PATH_INFO'] environment is setup correctly for your scripts. The second lets each FastCGI process die after having handled 500 requests. This ensures no possible memory leak will tear down your server.

The next line sets up the suexec mechanism and tells it to execute CGIs as user example and group example. This will be the user your PHP processes for this vhost will run under.

The last step is to bind the .php file extension to the FastCGI module and to tell it how to start the FastCGI process. This last line is the special trick. In a normal FastCGI setup (without suexec) you would point it to your PHP binary. In our case this is a small wrapper script.

Why a wrapper script? Because there is a security restriction in suexec: it will only execute scripts below the document root compiled into the Apache binary. In Debian this is /var/www/. So we need to have our PHP binary below /var/www/. SuExec won't accept symlinks.

A hardlink would work, but there is another catch. The executable needs to be owned by the user and group we defined earlier in the SuexecUserGroup line. But we want different users for our different vhosts which wouldn't work with hard links. So we use a wrapper script with the following content:

Step-3: Create on scripts named php-cgi

#!/bin/sh

exec /usr/bin/php-cgi "$@"

See, it simply replaces the running shell process with the correct PHP5 call.

The script needs to be owned by the correct user and group and has to have execution permissions and there is another restriction: it needs to be inside a directory owned by the same user which is not writable by anyone else.

So in our example case we have /var/www/vhosts/mamun.com owned by mamun.com:mamun.com and permissions 755 and /var/www/vhosts/mamun.com/public_html/cgi-bin/php-cgi ownd by mamun.com:mamun.com and permissions 755 as well.

That's it - start up apache and have your vhosts run under different users :-)

How to Configure Exchange 2003 to Receive E-Mail for other Domains

2009-04-02T11:33:00.001+06:00

Start From Here

Using SQL command line utility

2009-03-18T09:56:00.000+06:00

Sometimes it be necessary to insert huge data on a database table, but if you use SQL Management Studio to insert the data into the table, you may face memory related problem. So due to this memory constraints, you should you SQLCMD command line utility to insert huge data to a table. In my case, i used this utility to insert 1000000 row to a sql 2005 database without any problem. Here is the command that i used.

C:\>sqlcmd -S DBServerName -U dbusername -P dbpassword -d dbname -i scriptfile.sql

Here -S means DBServer, -U means dbusername -P dbaccess password -d means dbname -i means input file name that means the sql script file.

Step By Step Vsftpd Server Configuration

2009-03-12T16:39:00.000+06:00

To install and configure Vsftp server on linux box, follow these step by step instructions:

Step-1: Install Vsftpd on your linux box if already not installed.

#rpm -q vsftpd

vsftpd-2.0.5-12.el5

That mens vsftpd is already installed, if not then you can use yum to install it very easy and quickly.

#yum install vsftpd

This is will download and install vsftpd on your linux box.

Step-2: Configuring vsftpd

Now we need to configure vsftpd server to make it ready for use. Its configuration file is located under /etc/vsftpd/ named as vsftpd.conf. First backup the original configuration file and open it with any editor, in my case i use vi editor.

Here is our requirements:

1. Ftp user will not have shell access. Only they will have ftp access.

2. User will ftp their home directory only. They will not be able to come out from home directory.

3. Every user will have their own home directory

4. Anonymous ftp will not be allowed

Now we need to open the configuration file.

#vi /etc/vsftpd/vsftpd.conf

#We do allow anonymous ftp access

anonymous_enable=NO

# Ftp user will jailed to their home directory

chroot_local_user=YES

# In some cases, special users need to go out of their home directory, in this case we need to maintain a file which will list the name of the users that are able to go out site of their home directory. chroot_list file is created by default, we need to create it.

chroot_list_enable=YES

chroot_list_file=/etc/vsftpd/chroot_list

Thats it. save the file.

Step-3: Start vsftpd

From command prompt issue the following command to start vdftpd daemon.

#/sbin/service vsftpd start

Now its time to check the server. create user and test it with an ftp client. if everything is ok, then you will be able to log in...

Step by step vpn setup on Windows 2003

2009-03-04T16:13:00.001+06:00

Here i am describing a simple and easy way to configure vpn server on windows 2003. Just follow the steps carefully.

Step-1: Main Configuraton

1. Open the Routing and Remote Access Service

2. Right click the server name

3. From the context menu, select Configure and Enable Routing and Remote Access. Click Next

4. Select Custom Configuration.(chose this option because we are using a single network card.)

5. From the next screen, select VPN Access then click Next.

6. Click Finish button to finish the wizard.

7. If a dialog box appear asking if you want to start the service. Click Yes.

Next we need to configure the server so that it assigns ip address to its client whenever they connects to it.

Step-2: Configure IP Assignment

1. From the Routing and Remote Access console, right-click the server name

2. From the context menu, select Properties and then select IP tab.

3. Check the radio-button next to Static address pool.

4. Click the Add button and enter start and end ip address.

5. Click Apply and then click OK

Next we need to create users who will connect to vpn server.

Step-3: Create user account for vpn access

1. Open the Active Directory Users And Computers

2. Click the Users folder and right mouse click on the right pane and select New->User Provide all the informaiton and finish the wizard.

3. Right click the user name and select propertise

4. Click the Dial in tab and select Allow Access and click ok to finish.

If the vpn server is behind a firewall, then we need need open some ports for vpn. for pptp, open port 1723 and for IPSec port 50-51 and 500

Server site setup is done, now we need to configure vpn client on client pc.

Step-4: Configuring the vpn client

1. Go to Start -> Settings -> Network Connections

2. Open the New Connection Wizard

3. Select Connect to the network at my workplace then click Next

4. Seelct Virtual Private Network connection then click Next and follow the screen and finish the wizarad.

Now its time to check connection. just double-click on the connection icon just created on the client machine. if everything is ok, then you are connected to your vpn server.

Installing Perl Modules using Yum

2009-02-23T12:15:00.000+06:00

yum -y install mysql mysql-server perl-DBD-MySQL perl-DBI subversion patch db4 db4-devel db4-utils

yum -y install perl-Crypt-Blowfish perl-Crypt-CBC uuid-perl perl-Template-Toolkit perl-libwww-perl perl-Digest-SHA1

yum -y install perl-HTML-Parser perl-Unix-Syslog perl-IO-stringy perl-Net-Server

yum -y install perl-MailTools perl-Convert-UUlib perl-Convert-TNEF perl-Compress-Zlib perl-MIME-tools

yum -y install perl-Archive-Zip perl-Archive-Tar perl-BerkeleyDB perl-Digest-SHA1 perl-Digest-HMAC perl-Net-DNS

yum -y install php php-pear php-mysql php-gd php-Smarty pax cabextract cpio lha lzop freeze tmpwatch bzip2

yum -y install nomarch binutils gzip spamassassin php-bcmath pyzor gcc bison zlib zlib-devel gmp-devel

yum -y install perl-Authen-SASL perl-LDAP perl-URI perl-DBD-SQLite perl-Razor-Agent perl-Mail-SPF-Query

Configuring Spamassassin on Fedora Linux

2009-02-22T16:30:00.000+06:00


Required Perl Modules:Perl 5.6.1 or a later version is required

1.Digest::SHA1

2.HTML::Parser >= 3.43

3.Net::DNS

 Used for all DNS-based tests (SBL, XBL, SpamCop, DSBL, etc.),      perform MX checks, used when manually reporting spam to SpamCop, and used by sa-update to gather version information.

4.LWP

5.HTTP::Date

6.IO::Zlib

7.Archive::Tar

HereI am describing here a quick and step by step procedure for enabling SpamAssassin and having your users  choose what to do with spam messages

that are encountered:

Step-1: Configure your mail transport agent (sendmail or postfix) to use the procmail command as its mailer.For sendmail, it is already configured as the default mailer, based on the following line in the /etc/mail/sendmail.mc file:

 FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl

Step-2:Make sure that the SpamAssassin spamd daemon is running (it should already be on for run levels 2-5), and if it isn't, start it by typing the following (as root user):

# chkconfig --list spamassassin  spamassassin 0:off 1: off 2:on 3:on 4:on 5:on 6:off

# chkconfig spamassassin on

Step-3: Create an /etc/procmailrc file (using any text editor, as root user). This procmailrc file example pipes all mail messages received by procmail through spamc (which is the client side of the spamd daemon turned on in the previous step):

#vi /etc/procmailrc

:0fw

| /usr/bin/spamc

If you like, you can do a lot more in the procmailrc file to deal with spam on a system-wide basis.

You could, for example, create procmail recipes that take reported spam e-mail messages and sorts

them into a  system-wide spam folder or deletes them completely. Likewise, each user can create an individual $HOME/.procmailrc  file to create personal procmail recipes.

Step-4:Check the /etc/mail/spamassassin/local.cf file. This file contains rules that are used system-wide

by SpamAssassin, unless they are overridden by a user's individual $HOME/.spamassassin/user_prefs file. Here are the contents of the local.cf file:

 #vi local.cf

required_hits 5

rewrite_subject 1

 subject_tag [SPAM]

report_safe 0

Install Subversion on Fedora 6, 7& 8 Linux

2009-02-22T11:46:00.003+06:00

I have been working on subversion installations for our development evironments on Fedora servers. While installing subversion on new Fedora server i have been preparing a documents so that i can setup the environment quickly. Below you will have the step by step instruction to setup subversion on a fedora server.

Step-1:Preparing for subversion installation in Fedora:

By default Subversion comes pre-installed on Fedora, if you are using some other Linux flavor and don't know if you have subversion installed already here how you can verify:

#rpm -qa |grep subversion
subversion-1.4.4-7

If you don't have subversion installed, you can install it using yum

#yum install subversion

Step-2:Install mod_dav_svn on Fedora:
If you are planning to access your subversion repositories using web (apache/http) server then you need to install apache configuration directives for subversion.

# yum install mod_dav_svn
Setting up Install Process
Parsing package install arguments
Resolving Dependencies
--> Running transaction check
---> Package mod_dav_svn.i386 0:1.4.4-7 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================
Package Arch Version Repository Size
=============================================================================
Installing:
mod_dav_svn i386 1.4.4-7 fedora 71 k
Transaction Summary
=============================================================================
Install 1 Package(s)
Update 0 Package(s)
Remove 0 Package(s)
Total download size: 71 k
Is this ok [y/N]:y
Installed: mod_dav_svn.i386 0:1.4.4-7
Complete!

Step-3:Setting up subversion repositories:
# mkdir /var/www/svnrepo

Step-4:Create a new subversion repository for fresh install
# svnadmin create svn.reponame

Step-5:Change permissions for subversion directories:
# chown -R apache:apache svn.reponame

Step-6:Configure apache to access subversion directory

# cd /etc/httpd/conf.d

backup the default subversion.conf file before editing

#cp subversion.conf subversion.conf_org

Step-7:Add Location directive for subversion directory location

I have to created apache configuration file for subversion
# cat subversion.conf
Location
DAV svn
SVNParentPath /var/www/svnrepository
AuthType Basic
AuthName "SVN Authorization"
AuthUserFile /etc/svn-auth
AuthzSVNAccessFile /etc/svn-diraccess
Require valid-user
Location

Step-8: Create subversionuser who will access the repository

#httpasswd -cm /etc/svn-auth username

Step-9: Configure the repository access permission

#vi /etc/svn-diracess

[svn.reponame:/]

username = rw

Now everthing is done and ready to use. for a quick test, you can browse the repository by using

the http://servername/svn/svn.repositoryname url. if everything is ok, then you will be asked to provide credentials.

Backup and Restore of Svn Repo:

Now i will discuss about how to backup a subversion repository and also how to restore it.

Step-1: Backup subversion Repository

First login to subversion server using ssh, then go to the subversion repository directory and type the following command.

#svnadmin dump repo_name > repo_name.dump

Here repo_name is the name of the repository that we are going to backup. repo_name.dump is the name of the backup copy.

Step-2: Restoring backup

#svnadmin load new_repo <>

Here new_repo is the name of the fresh created repository where you are going to restore your backup copy.

If you want to have your repository backup daily then you can create one cronjob for it.

#crontab -e

@daily svnadmin dump repo_name > repo_name.dump

Thats it...

Increase IIS/WinXP connection limit (or how to avoid HTTP 403.9 error)

2009-01-28T15:40:00.001+06:00

This can be bumped up to 40 but not higher (40 is the hardcoded limit).

To do this, find the adsutil.vbs script (should be in c:\inetpub\AdminScripts or similar) and run the following command:
adsutil set w3svc/MaxConnections 40
You can also try to prevent individuals from hogging a bunch of connections and thereby blocking out other users. (IE will normally use 2 connections to a web site.) To do this, launch the IIS admin tool (under control panel / administrative tools), right click on your ‘default web site’ (under ‘web sites’ in the outline control), and mess with the settings in the “connections” part of the “web site” tab. Lowering the timeout (default is 5 min) will cause idle connections to get dropped quicker. Disabling keep alives will cause connections to disconnect immediately after the request is handled instead of waiting for new requests on the same connection. This is a little extreme but you probably don’t care that much about responsiveness, so you might want to just try that and see if it solves the problem.

Folder option missing & my regedit is disabled

2009-01-05T18:15:00.001+06:00

Copy the following code,paste in any notepad and save as "EnableRegEdit.inf" . Right-click and install; your regedit will be enabled.(Be careful to copy the code exactly as presented here including everything.

Code is in Italic to avoid any misunderstanding...

___________________________________________________________________________________

[Version]
Signature="$Chicago$"
Provider=Symantec

[DefaultInstall]
AddReg=UnhookRegKey

[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe ""%1"""
HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools,0x00000020,0

_________________________________________________________________________________

To enable Folder Options, copy following code,paste it in any notepad and save as "folderoptions.reg" file. Double click it and your folder options will be restored.

_________________________________________________________________________________

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFolderOptions"=dword:0000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserOptions"=dword:00000000

__________________________________________________________________________________

To enable Task Manager, copy following code,paste it in any notepad and save as "EnableTaskManager.reg" file. Double click it and your folder options will be restored.

_________________________________________________________________________

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:0000000

____________________________________________________________________________

if registry enable not work with above method, then try with this, save it as a .vbs file and run it

'Enable Registry Editing' '© Veegertx - 4/7/2004 'This code may be freely distributed/modified On Error Resume Next 'Prevents errors from values that don't exist Set WshShell = WScript.CreateObject("WScript.Shell") 'Delete DisableRegistryTools registry values WshShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" WshShell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" 'display message Message = "You should have access to Regedit now" X = MsgBox(Message, vbOKOnly, "Done") Set WshShell = Nothing Set fso = Nothing

--------------------------------

 task manager is disabled on their system suddenly.
Problem: It is due to some kind of virus/ trojan activity which normally disables the task manager.Now due to this problem when ever the user press alt+ctrl+del to launch windows task manager it gives an error saying “Task Manager is being disabled by your administrator”.
Solution:
To Enable the Disabled Task Manager on your system
1. Press window key+r to show run prompt
2. Follow the following steps
Enter gpedit.msc in the run prompt and click OK
In the Group Policy settings window
Select User Configuration
Select Administrative Templates
Select System
Select Ctrl+Alt+Delete options
Select Remove Task Manager
Double-click the Remove Task Manager option’.
Set the property of this item as disabled.
Updated on 12th FEB 2008
For Those who use Windows XP Home Edition can use the registry to enable Task Manager
1. open start >> run and type regedit
2. Navigate to the following path:
Hive: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System 
3. You will find a registry key with name DisableTaskMgr of type: REG_DWORD
4. Double click the key with and set the Value to 0
5. Exit the registry and restart to see the effect.

SQL Server 2005: What Service Pack is Installed?

2008-12-15T21:39:00.000+06:00

1. Open SQL Server Management Studio.

2. Click the New Query button.

3. Copy and paste the following into your query window:
SELECT SERVERPROPERTY('productversion'), SERVERPROPERTY ('productlevel'), SERVERPROPERTY ('edition')
4. Click the Execute button.

The results will display the version number, service pack number and the edition of SQL Server 2005 that is installed on the server.

SSL Certificate Export and Import

2008-12-04T09:24:00.001+06:00

Sometimes you want to take an SSL certificate that you already own that is installed on your web server and import it into the ISA firewall’s machine certificate store. This allows for encryption of outbound SSL from the ISA server to the published Web site in an SSL to SSL bridging scenario. One example is publishing your Outlook Web Access (OWA) site through your ISA firewall. This article guides you through the steps required to export your SSL certificate from you Internet Information Server (IIS) 6.0 Web site and import that certificate into the ISA firewall’s machine certificate store.

Note:
Before you begin you should make sure that you have the password for the certificate available. The password that I am referring to is the one you used when you created the certificate. Without this password you can not transfer the certificate

The Export

The first thing to do is export your key from your IIS 6.0 Server, Windows 2003 (the steps are very similar in Windows 2000, IIS 5.0, however the screen shots are from IIS 6.0) as a .pfx file. Here are the steps:

Open the IIS Manager.

Navigate to the web site that has the SSL certificate installed.

Right click and choose Properties

Find the Directory Security Tab and choose it.

Click on the Server Certificate button near the bottom.

A Certification Wizard will appear, Click Next to bypass the "Welcome Screen."

Now you should see a wizard page like this:

If you don't see this exact page, then you do not have your SSL certificate installed. Install your SSL certificate first then re-due these steps. Another reason you might not see this page is that you chose the wrong web site in step #3

Choose "Export the current certificate to a .pfx file" from the radio buttons and press next.

In the next wizard page, choose a file location and save your .pfx file.

The Import

Using SQL 2005 Profiler as non sys user

2008-11-26T20:58:00.000+06:00

To run sql2005 profiler as a non sys user, execute the following query

GRANT ALTER TRACE TO username

SQL 2000 does not have that level, and it is not as simple.

You could add the member to the fixed server role securityadmin. Server roles cannot be redefined, but you can create a new role by combining server role and db roles. For example, add the securityadmin role to a db_accessadmin role.

Defined by
http://www.microsoft.com/technet/prodtechnol/sql/2000/books/c05ppcsq.mspx

Security Administrators (securityadmin) Designed for users who need to manage logins, create database permissions, and read error logs. Members of this role can add members to securityadmin; grant, deny, and revoke CREATE DATABASE; and read the error logs. In addition, they can also perform these tasks: sp_addlinkedsrvlogin, sp_addlogin, sp_defaultdb, sp_defaultlanguage, sp_denylogin, sp_droplinkedsrvlogin, sp_droplogin, sp_grantlogin, sp_helplogins, sp_remoteoption, and sp_revokelogin.

db_accessadmin Designed for users who need to add or remove logins in a database. Members of this role can perform these tasks on the se- lected database: sp_addalias, sp_adduser, sp_dropalias, sp_dropuser, sp_grantdbaccess, and sp_revokedbaccess.

Create the server login, then assign the server role, database access and database roles to the login.

This is not as clean as Grant Alter Any Login, but the user will have that right.

Install FastCGI on Server 2008

2008-11-18T18:43:00.001+06:00

According to IIS.net…

…the FastCGI component enables popular application frameworks like PHP be hosted on the IIS web server in a high-performance and reliable way.

Mike Volodarsky, a program manager on Microsoft’s IIS team, has expressed the following on his blog about why using PHP with FastCGI is the prefered method over ISAPI:

The main reason why ISAPI is not an adequate solution is the lack of thread safety in many popular PHP extensions. The PHP core itself is thread safe, and so are some of the extensions, so its possible that some applications will work correctly in the ISAPI environment. However, many production environments do experience instability with the ISAPI.

So that being said, let’s take a look at how to install configure the FastCGI extension to work with PHP 5.

Installing FastCGI And PHP on Windows Server 2008

As opposed to previous versions of Windows Server, the FastCGi module is already bundled with Windows Server 2008 so you don’t have to install it.

First of all, let’s make sure that the CGI role service is installed. Click on Start => Programs => Administrative Tools => Server Manager. Expand Roles, right-click on Web Server (IIS) and select Add Role Services. Make sure that CGI is checked and if not proceed with its installation.

Next head over to PHP.net’ download page and download the PHP Non-thread-safe Win32 binaries. At the time of this writing, the latest version of PHP is 5.2.5. Extract the content from the PHP archive into c:\php.

Launch the Internet Information Server Manager by clicking on Start => Programs => Administrative Tools => Internet Information Server Manager. Select your server from the left panel and then double-click on the Handler Mappings icon.

Click on Add Module Mapping from the right column:

Fill-in the PHP module mapping information as illustrated below and click on OK when done:

At this point PHP should now be working even though there no php.ini configuration file yet. To find out if PHP files are parsed correctly, create a new file at the root of website’s folder and name it phpinfo.php. Insert the following content into the file and save it:

Now try pointing your web browser to http://yourserver.com/phpinfo.php. If everything works properly you should see this page:

Configuring PHP

By default, IIS will look for PHP’s configuration file (php.ini) in c:\windows. To change this, launch the registry editor (Start => Run => regedit) and add a new key named PHP in HKEY_LOCAL_MACHINE\SOFTWARE\. Under the newly created key, create a new value named IniFilePath and set its value data to c:\php.

Close the registry editor when you’re done. Using the Windows Explorer, rename c:\php\php.ini-recommended to c:\php\php.ini and open it with your favorite text editor (no word processor). Find the extension_dir parameter and set its value to “c:\php\ext”. You might also want to uncomment extension=php_mysqli.dll and / or extension=php_mssql.dll if you plan to use MySQL or MS-SQL.

Once you’re done editing PHP’s configuration file, save it and close your file editor. You will need to restart IIS in order to apply the changes. This can be done through the IIS Manager:

The request filtering module is configured to deny a request that contains a double escape sequence

2008-10-06T17:44:00.001+06:00

By default, IIS 7.0 rejects URLs that contain a double escape sequence.

WorkAround

1. Open web.config and add

system.webServer
security
requestFiltering allowDoubleEscaping="True"/
/security>
/system.webServer>
/configuration>

2. Save

http://support.microsoft.com/kb/942076

how to create a Windows web server running IIS7, MySQL, and PHP

2008-09-17T15:44:00.001+06:00

Install IIS7

First thing first, we need to install a web server.

Open the Control Panel in classic view.
Double-click Programs and Features.
Click Turn Windows features on or off on the left.
Check off Internet Information Services.
Expand Internet Information Services, World Wide Web Services, Application Development Features, and then check off ISAPI Extensions. ISAPI will be needed later when we install PHP.
Click OK to install IIS7.
When the Windows Features box disappears IIS7 is installed and should be running. Test IIS7 by going to http://localhost in your web browser. You should see an IIS7 test page like the screenshot below.

The root of the default web site is located at C:\inetpub\wwwroot. Your web site goes there.

Install PHP

Now that we have a web server we need support for PHP. In this example I’m installing PHP 5.2.4.

Create a folder called php in the root of the C: drive.
Download the Windows Binaries Zip package from http://www.php.net/downloads.php.
Extract the files and save them in the php folder you just created.
Copy C:\php\php.ini-dist and save it on your desktop so we can work with it.
Rename php.ini-dist you just copied on your desktop to php.ini.
Right-click php.ini and select Edit.
Search for extension=php_mysql.dll and uncomment it by deleting the ; in front of it. This allows php to login a MySQL database.
Now move up in the php.ini code and look for extension_dir = “./”. Change “./” to “C:\php\ext”. This shows php where to load the extension=php_mysql.dll extension you just uncommented.
Save php.ini.
Copy php.ini and save it in C:\Windows.
Open the IIS Manager by typing IIS Manager in the Start Menu’s search box and click Internet Information Services (IIS) Manager in the search results.
Double-click Handler Mappings.
Click Add Script Map located on the right.
Fill out the Add Script Map window like the screen shot below.
Click OK to save the changes.
Click Yes in the window that asks you if you want to enable this ISAPI extension.
Click the back button in the IIS Manager and then double-click Default Document.
Type index.php, with a space behind , in the File names list.
Click Apply on the top right of IIS Manager.
Now you need to copy libmysql.dll from C:\php and save it in C:\WINDOWS\System32. Thanks for the fix Oruba.

Lets test to make sure php is installed and running correctly.

Open notepad.
Type < ? phpInfo() ?> in the blank document.
Note: Remove the space between < ? in < ? phoInfo() ?>. I had to add the space so the command doesn’t execute on this page.
Save it as test.php on your desktop and then move it to C:\inetpub\wwwroot.
Note: A common mistake when saving test.php is to save it as test.php.txt. Don’t forget to select All files under Save as type and then name the file test.php in notepad.
Go to http://localhost/test.php. You should get a php information page similar to the screen shot below.

Install MySQL

Before we can install MySQL we need to disable UAC in Windows Vista.

Open the Control Panel in classic view.
Click User Accounts.
Click Turn User Account Control on or off.
Uncheck Use User Account Control and then click OK.
Restart your computer.

Note: You can turn UAC back on after everything has been installed and working.

Now we can install MySQL. In this example I’m going to install MySQL Community Edition 5.0.45.

Download the Windows ZIP/setup.exe version http://dev.mysql.com/downloads/mysql/5.0.html#win32.
Unzip it and save setup.exe on your desktop.
Run Setup.exe.
The welcome window will popup. Click Next.
Since this is a general guide on creating a WIMP server leave Typical selected and click Next.
Let MySQL install in its default directory by simply clicking Install in this window.
Click Next to move through a few advertisements.
Leave Configure the MySQL Server now checked and click Finished.

Note: It seems some versions other than 5.0.45 of MySQL silently errors out during installation. I’m not sure if this is a bug or not but Dustin has provided a great fix in the comments.
Click Next at the welcome window.
I’m assuming that you don’t need to configure any advanced MySQL settings. If you did you probably wouldn’t need this guide or you should leave this job to an expert. Select Standard Configuration and then click Next.
Leave Install As Windows Service, the service name MySQL, and Launch MySQL Automatically checked and click Next.
Type the MySQL administrator (root) password twice and then click Next.
This part is VERY important. Hold your mouth just right, cross your fingers and click Execute to configure MySQL. If you did it just right you should get 4 check marks when it’s done.

Note: If you get a Connection Error, click Retry and it should work. This is caused by a slower computer not starting the MySQL service fast enough.
Click Finished.

Now that you have MySQL installed and running lets install the GUI Tools to make managing databases easy.

Download the GUI Tools (Windows x86) at http://dev.mysql.com/downloads/gui-tools/5.0.html.
Install it just like any other software.
Click Start, All Programs, MySQL, MySQL Administrator.
Fill in the fields just like the screen shot below.

Remember: Root’s password is the one you set when you installed MySQL.
Once MySQL Administrator is open, you can create a new database by clicking Catalogs and then right-clicking under test and select Create Schema.
Give it a name and there you go!

Open Port 80

Now that you have a working WIMP lets open it up to the world. All internet (HTTP) traffic passes through port 80. Let’s open port 80 to the world.

Search for firewall in the search box in the Start Menu and click Windows Firewall in the search results.
Click the Exceptions tab in the Windows Firewall Settings window.
Click the Add port button.
Type HTTP as the name and 80 as the port number.

Adjust Vista for Web Server Performance

Because Windows Vista is not meant to be a server out of the box its priorities are backwards when it’s being used as a web server. Windows Vista prioritizes programs like Word before background services like IIS7 to give the end user the best experience possible. Since we’re configuring Windows Vista as a web server background services need to be Vistas priority instead of programs.

Let’s set Windows Vista’s services as a higher priority than programs to squeeze the most speed out of it as we can.

Right-click Computer in the Start Menu and then select Properties.
Click Advanced system settings.
Click Settings under Performance in the Advanced tab of the System Properties window.
Click the Advanced tab in the Performance Options window.
Select Background services.
Click OK and then restart your computer.

Hardware

A web server with low to modest traffic doesn’t have to be a powerful machine to get the job done. Any modern PC with at least 1GBs of RAM (2GBs recommended for MySQL) will do fine. If you become one of the fortunate ones who receives enough traffic to need a high performance web server here are a few hardware tips.

Memory: If you’re expecting any kind of modest traffic (many thousands of hits per day) memory is very important. 2GBs is a good start but 3 or 4 are better.
IIS7: A powerful processor(s) and a good amount of memory are important.
MySQL: A fast hard drive and lots of memory are important for a MySQL database.

How to Remote Root Access to MySql Server

2008-09-09T17:22:00.000+06:00

First we need to set root password, to do that follow the example.

mysql -u root mysql> SET PASSWORD FOR 'ROOT'@'LOCALHOST" > = PASSWORD('new_password');

Now while we’re still here, we’ll create a new HOST for root and allow root to login from anywhere.

mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' > IDENTIFIED BY 'password' WITH GRANT OPTION; mysql> exit

We’re almost done now. We just have to tell Mysql to allow remote logins.

edit the my.cnf file located in mysql installation directory

Now find the line that says

bind-address = 127.0.0.1

and comment it out. That’s all there is to it! Now get your favorite MySql client and start developing.

Configuring SSL on Ektron Sites

2008-09-09T10:20:00.000+06:00

In Ektron CMS400.NET, you can use SSL when users log in to your
Web site. SSL encrypts the username and password during
transmissions to the server.
When you set up the SSL certificate, and configure Ektron
CMS400.NET to use it, the login page is launched in a Secure
Socket Layer. This section explains how to set up SSL for Ektron
CMS400.NET.

First enable SSL certificate on the ektron site

Next, configure Ektron CMS400.NET to use the SSL certificate.
1. Open the web.config file.
2. Move to the section of the file that has these settings.

add key="ek_UseSSL" value="false"
add key="ek_SSL_Port" value="443"

3. Set the ek_UseSSL value to true.

WARNING! If the ek_UseSSL value is true, but you did not install the certificate to the Web
Server, you cannot log into Ektron CMS400.NET.

4. Set the ek_SSL_Port value to 443 (unless you specified another
SSL port).
5. Save and close the file.
You are ready to use the SSL support for Ektron CMS400.NET.

SQL2000 Server based Session management configuration

2008-09-01T15:17:00.000+06:00

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>aspnet_regsql.exe -S localhost -U

sa -P dhaka1214 -ssadd

How to view Outlook2007 email header?

2008-08-30T10:24:00.002+06:00

You can easily view outlook 2007 email header, just open the email by double clicking on it. Just look at the image and click the red marks area.

Where all my linux disk space gone?

2008-08-11T18:22:00.001+06:00

Here’s a quick run through using nothing more than the command prompt -

To show all of your filesystems with the -m showing used/free space in megabytes

$ df -m
Filesystem   1M-blocks      Used     Available   Use%    Mounted on
simfs        10000          718      9283        8%      /

So I’m using 718 MB of my disk space but where?

For the next bit we’re going to need to be root (or root equivalent)

$ sudo -s
# cd /
# du -ahm --max-depth 1 --exclude /proc | sort -n

That will list the size in MB of all of the folders in root (/) with the largest last.

  ./bin
  ./etc
  ./root
  ./sbin
  ./lib
  ./home
  ./var
  ./usr

So my /usr folder is using 513MB. Now I can drill down into the folders running the same command again.

# cd /usr
# du -ahm --max-depth 1 --exclude /proc | sort -n

and so on.

Obviously you only want to be deleting files when you’re absolutely positive what they are used for and what impact deleting them will have on your system!

There are a whole bunch of utilities for both Windows and linux to make this process easier and prettier! Here’s a couple -

Linux - http://treesize.sourceforge.net/
Windows - http://sourceforge.net/projects/windirstat/

Which w3wp.exe process belongs to which App Pool in IIS6

2008-08-05T17:43:00.001+06:00

Along with Windows Server 2003 and Internet Information Services 6.0 came a large number of benefits. For us IIS admins, it was a great welcome set of changes. But, one apparent difficultly is matching up the w3wp.exe processes displayed in Task Manager to the Application Pools in IIS.

What about IIS6?

But, that doesn't work anymore with IIS6.0. Now each site in IIS6 is placed in an Application Pool. Each Application Pool is completely separated from other App Pools by running in its own process called w3wp.exe. This make life SO much easier. Now, the trick is to match up the process shown in Task Manager with the Application Pool set up in IIS.

If there is a different user for each application pool, Windows Task Manager is the easiest way to find out which application pool belongs to which site since Task Manager will display the user the process runs as.

But, what happens if you have multiple application pools running as the same user? For example, if you keep to the default NETWORK SERVICE user but create multiple Application Pools, you may want to know which process belongs to which App Pool. Component Services doesn't work for this anymore.

Enough already, tell me how to do it!

Have no worries, Microsoft has given us the exact tool for the situation. IISApp.vbs lists all the applications, their PID and their App Pool name.

The script is already placed in systemroot\system32 on Windows Server 2003 so simply go to your Command Prompt and type in iisapp.vbs (the .vbs is optional) and you'll have an instant list of all the App Pool information you've always wanted to know. You may need to type cscript iisapp.vbs instead if CScript isn't your default WSH script host.

Let's see an example of the output:

Here is an example of the output.

W3WP.exe PID: 1468 AppPoolId: AppPoolForSite1.com
W3WP.exe PID: 3056 AppPoolId: AppPooForSite2.com
W3WP.exe PID: 1316 AppPoolId: AppPooForSite3.com

Direct from the horse's mouth, Microsoft documents this:

http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/cl_as_viewapps.asp

Summary

We've seen here that using iisapp.vbs, you can painlessly match up the PID to the friendly name of the Application Pool.

CONFIGURING FTP IN ISOLATION MODE (IIS6 windows2003)

2008-07-23T10:12:00.001+06:00

1. Installing IIS6 FTP on Windows Server 2003:

In the “Windows Components Wizard”, highlight the “Application Server” and press the “Details” button. The screen below will be displayed (Fig 1).

Figure 1 - The Application Server Screen

Highlight the “Internet Information Services (IIS)” option and press “Details” (as shown in Fig 1 above).

Figure 2 - The Internet Information Services (IIS) Screen

On the next screen (Fig 2 above) we highlight “File Transfer Protocol (FTP) Service”.

Click “OK” to close each window and “Next” to install the newly-selected components. You will be asked to insert your Windows Server 2003 disk. Click “Finish” once the installation is complete.

You have now installed the FTP service.

Figure 3 - Setting up your FTP Root Directory

2. The FTP Root Directory

In order to use FTP in "Isolation" mode, we need to construct the FTP Root so that users are "Dropped" into their correct home directory.

The structure illustrated above contains two subdirectories, "localuser" and my domain "simongibson" which contain home directories for each user. These user sub-directories must match their respective username exactly. If not, the user will not be able to log onto your FTP server.

Create the directory structure above to match your configuration. The "FTPRoot" directory can be placed anywhere on your system.

Figure 5 - Removing the Default FTP Site in IIS 6

4. Removing the Default FTP Site in IIS 6:

The first task is to remove (delete) the Default FTP Site. This site does not use Isolation and matches IIS5 FTP sites in terms of functionality and security. As we are going to use Isolation, we will need to create a fresh FTP site.

Simply right-click on the Default FTP Site and press "Delete" in the menu that appears.

Figure 6 - Creating a fresh FTP Site in IIS.

5. Creating a fresh FTP site:

To create a new FTP site, simply right-click on "FTP Sites" and select "New" and "FTP Site...". Then, press "Next" to begin the FTP Site Creation Wizard.

Figure 7 - FTP Site Creation Wizard: FTP Site Description

6. FTP Site Creation Wizard: FTP Site Description

This is the name that will appear in the "FTP Sites" list in IIS. I'm going to use my imagination and call this site "FTP".

Click Next.

Figure 8 - FTP Site Creation Wizard: IP Address and Port Settings

7. FTP Site Creation Wizard: IP Address and Port Settings

Simply select your server's IP address from the list (this is usually the only one listed).

You can also change the TCP Port if required but this is not recommended.

Click Next.

Figure 9 - FTP Site Creation Wizard: FTP User Isolation

8. FTP Site Creation Wizard: FTP User Isolation

This screen allows you to choose the type of Isolation you want to use:-

"Do not isolate users"
Although this option allows users to be "dropped" into their own home directory (if one exists under the FTP root that exactly matches their username), it's NOT able to stop them moving up out of their directory and into those belonging to other users.

"Isolate users"
This option Isolates users based on the directory structure under the FTP root directory (see Step 2). This is the easiest of the two Isolation methods and the method we will use in this tutorial.

"Isolate users using Active Directory"
This option Isolates users by getting their "FTP Home Directory" from the Active Directory. The advantage of this is that new users can be added without the need to modify your FTP site. However, the "FTP Home Directory" can not be entered using the Active Directory snap in and must be configured from the command line by using a VBScript utility.

As shown in Figure 9 above, select "Isolate Users" and press "Next".

Figure 10 - FTP Site Creation Wizard: FTP Site Content Directory

9. FTP Site Creation Wizard: FTP Site Content Directory

This step defines the FTP Root directory. Select the FTP Root directory you created in Step 2 (Figure 3).

Figure 11 - FTP Site Creation Wizard: FTP Site Access Permissions

10. FTP Site Creation Wizard: FTP Site Access Permissions

This step allows you to define read or write access for your FTP site. In this case, I intend to allow files to be uploaded so I've ticked the "Write" box.

Click Next then click Finish to complete the Wizard.

Your FTP Site is now ready for use. To test it, simply open Internet Explorer and enter the URL ftp://192.168.0.1 (or your Server's IP address if different). You should then log in and be automatically "Dropped" into your home directory.

How to reinstall or repair Internet Explorer in Windows XP

2008-07-23T10:01:00.001+06:00

Introduction

You may have to reinstall or to repair Internet Explorer in Windows XP if you have problems with Internet Explorer because of damaged files or missing registration information. You may also decide to reinstall or to repair Internet Explorer 6 to resolve problems with Outlook Express in Windows XP.

Methods to follow if you have Internet Explorer 6

Any of the methods in this article may resolve your problem. Feel free to select the one that you are most comfortable with.

Method 1: Install Internet Explorer 7

You may be able to resolve problems with Internet Explorer 6 if you install Internet Explorer 7. Installing Internet Explorer 7 probably will not resolve problems with Outlook Express.

For information about how to install Internet Explorer 7, visit the following Microsoft Web site:

http://www.microsoft.com/windows/products/winfamily/ie/default.mspx (http://www.microsoft.com/windows/products/winfamily/ie/default.mspx)

Note After you install Internet Explorer 7, you can repair damaged files or missing registration information in Internet Explorer 7. To do this, follow these steps:

1.	Start Internet Explorer 7.
2.	On the Tools menu, click Internet Options.
3.	On the Advanced tab, click Reset.
4.	In the Reset Internet Explorer Settings dialog box, click Reset to confirm.

Method 2: Install Windows XP Service Pack 2

If you do not want to install Internet Explorer 7, or for some reason cannot do so, you may be able to resolve problems with Internet Explorer 6 by installing Windows XP Service Pack 2. Additionally, installing Windows XP Service Pack 2 may help resolve issues with Outlook Express because Windows XP Service Pack 2 includes both Internet Explorer 6 Service Pack 2 and Outlook Express Service Pack 2.
To install Windows XP Service Pack 2, follow these steps:

1.	Visit the following Microsoft Web site: http://www.update.microsoft.com (http://www.update.microsoft.com)
2.	Click Express Install (Recommended).
3.	If your computer qualifies, Windows XP Service Pack 2 will be one of the updates that is automatically selected. Click Install.
4.	Review the Microsoft Software License Terms. Then, if you agree with it, accept it.

For more information how to obtain the latest Windows XP service pack, click the following article number to view the article in the Microsoft Knowledge Base:

322389 (http://support.microsoft.com/kb/322389/) How to obtain the latest Windows XP service pack

Method 3: Repair Internet Explorer 6 and Outlook Express 6 by using the System File Checker in Windows XP

If you already have Windows XP Service Pack 2 installed, and you do not want to install Internet Explorer 7, you may be able to resolve problems with Internet Explorer 6 by running the System File Checker. Additionally, running the System File Checker may help resolve issues with Outlook Express 6.

To run the System File Checker, follow these steps:

1.	Click Start, click Run type sfc /scannow, and then press ENTER.
2.	Follow the prompts throughout the System File Checker process.
3.	Restart the computer when System File Checker process is complete.

Method 4: Reinstall Internet Explorer 6 by using the Ie.inf file

If you already have Windows XP Service Pack 2 installed, and you do not want to install Internet Explorer 7, you may be able to resolve problems with Internet Explorer 6 by using the Ie.inf file to reinstall Internet Explorer 6. To do this, follow these steps:

1.	Click Start, click Run, type %systemroot%\inf, and then press Enter.
2.	Find the Ie.inf file that is located in Windows\Inf folder.
3.	Right-click the Ie.inf file, and then click Install.
4.	Restart the computer when the file copy process is complete.

Method to follow if you have Internet Explorer 7

If you have Internet Explorer 7, you can repair damaged files or missing registration information in Internet Explorer 7. To do this, follow these steps:

1.	Start Internet Explorer 7.
2.	On the Tools menu, click Internet Options.
3.	On the Advanced tab, click Reset.
4.	In the Reset Internet Explorer Settings dialog box, click Reset to confirm.

Performance Tuning Microsoft Indexing Services (win2003/2000)

2008-07-23T09:59:00.001+06:00

Why Tune Performance?
A common question for many Indexing Service users is how often the Indexing Service is updated. Is it automatic, manual, done every hour, minute, second, do they have to restart the service?

For all intents and purposes, changes to an indexed document are instant and automatic. However, how instant is determined by the size of the index and server resources.

So, Microsoft have provided a simple tool to allow the administrator to set the relative importance of these updates. How important it should be for the Index to be current at any point in time and how many queries should the server typically expect to answer. Of course, you can set both of these to their maximum, but this will be at the expense of other services running on the server.

1. Where to find the Indexing Service Console:
Click on 'Start', 'Programs', 'Administrative Tools' and then 'Computer Management' (shown above in Fig.1)

2. Where to find the "Tune Performance" settings:
Right-click on 'Indexing Service' and select 'All Tasks' and 'Tune Performance' from the menus that appear (as shown in Fig.2 above).

Windows 2000 Server users will notice that this option is "grayed out" when the service is running. To access the "Tune Performance" dialogue, they should first stop the Indexing Service by selecting "Stop" from the menu.

3. The "Indexing Service Usage" dialog box:
The "Indexing Service Usage" dialog box shown in Fig.3 above contains a list of presets that determine how quickly the catalog is updated when a document is added or modified. In most cases, the "Used often, but not dedicated to this service" or "Used occasionally" options will suffice.

5. Customizing Indexing Service usage:
If you'd prefer to have more control, you can select "Customize" from the option list shown in Fig.3.

The "Indexing" slider determines how quickly the Indexing Service reacts to document changes or additions.
The "Querying" slider determines how quickly Indexing Service processes queries.

For example: If your index must be absolutely current at all times but not many search queries are typically submitted - an "Instant" setting for "Indexing" and a "Low load" setting for "Querying" will be required.

Finally, to ensure that your changes take effect, you should restart the Indexing Service.

SQL Server 2000 installation fails "previous program installation"

2008-07-15T11:04:00.000+06:00

SYMPTOMS

When you install SQL Server 2000, this error message may occur:

A previous program installation created pending file operations on the installation machine. You must restart the computer before running setup.

To work around this problem, depending on the source of the error, you can use any one of the following methods:

Restart the computer and see if you are able to run the setup. If the restart does not help, use the steps that follow.

Perform these steps and then run the SQL Server 2000 setup again:

a.	Click Start, and then click Run.
b.	In the Open dialog box, type: "Regedit" (without the quotation marks) or "Regedt32" (without the quotation marks)
c.	Click OK. NOTE: Please make sure that you only delete the value mentioned, not the whole session manager key.
d.	In Registry Editor, expand the following registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
e.	On the File menu, click Export. NOTE: In Microsoft Windows 2000, click Export Registry File from the Registry menu.
f.	In the File name text box, type: "Session Manager Key" (without the quotation marks)
g.	Click Save.
h.	In the right-pane of the Registry Editor window, right-click PendingFileRenameOperations. On the shortcut menu that appears, click Delete.
i.	In the Confirm Value Delete message dialog box that appears, click Yes.
j.	On the File menu, click Exit. NOTE: In Windows 2000, click Exit on the Registry menu.
k.	Restart the computer.
l.	Using the Registry Editor, verify that the PendingFileRenameOperations registry value is not available. Note The PendingFileRenameOperations registry value may be re-created when you restart the computer. If the registry values are re-created, delete the PendingFileRenameOperations registry value again by completing steps a through j, and then run SQL Server 2000 Setup. Do not restart the computer before you run SQL Server 2000 Setup.

Check other control set keys (for example, ControlSet001, ControlSet002, and so forth) for the same values and also delete them.

Identify the virtual memory settings on the computer. If the paging file is too small or if there is no paging file, this error message may occur at startup:

Limited Virtual Memory Your system has no paging file or the paging file is too small.

If the error message occurs, determine the placement of the paging file from the virtual memory settings and give that drive full permissions for the system account.

Block usage of USB Removable Disks

2008-07-07T11:14:00.000+06:00

To block your computer's ability to use USB Removable Disks follow these steps:

Open Registry Editor.
In Registry Editor, navigate to the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR
Locate the following value (DWORD):

Start

and give it a value of 4.

Close Registry Editor. You do not need to reboot the computer for changes to apply.

Enable usage of USB Removable Disks

To return to the default configuration and enable your computer's ability to use USB Removable Disks follow these steps:

Go to the registry path found above.

Locate the following value:

Start

and give it a value of 3.