Comparing two MS Office Word 2007 documents

Today I discovered the most useful feature of Microsoft Office Word 2007: Compare!

When tasked with the challenge of comparing two versions of a lengthy legal document, to determine what changed, I thought for sure I was doomed to read side by side print outs (or on screen displays), or install some tool that would require converting to ascii (and then I could use 'diff', for Unix's sake!).

But Microsoft bless, I found one reason to really like Microsoft today, and that feature is called Compare.

Enough blithering, here's how it works:
Open MS Word
Choose Review > Compare
compare two versions of a single document (legal blackline)
Select the original and revised documents.

And, as if by Microsoft Magic, you'll have a list of changes between the documents.



Open MS Word 2007,

Protocol & network speed

Greetings, Internet audience.

Out of idle curiosity, and a plaguing question from a client about why he wasn't getting as much throughput as he expected on super-sweet gigabit Catalyst 4948 switches as he expected, meaning he expected ~600Mbps throughput, and got about 130Mpbs.

I suspected two things:

1) bandwidth limitations on the servers, meaning that a 1Gbps NIC doesn't get 1Gbps speeds on the internal BUS, and thus, won't get near 1Gbps wire speed.
2) protocol. We were testing speed using scp, and I suspected encryption was reducing the speed.

Since #2 is a bit easier for me to prove, I staged a test on my home office network, at a time I was the only one on the network.

My plan:
copy a 706330624 byte file locally, using three protocols:
scp (tcp/22), tftp (udp/69), and ftp (tcp/21)
my home network is comprised of inexpensive 10/100Mbps Netgear switches, the kind you can buy at Fry's for $30, or could a few years back, you get the point.

Note the results are in Mega "bits" per second, not Mega "bytes" per second. For MBPS, divide by 1024, or check out this handy calculator-page:
http://www.matisse.net/bitcalc/

Results:
Protocol Mbps
scp ~20Mbps
tftp ~6Mbps
ftp ~89Mbps

As you may have already figured out, the cost of encryption on network speed, is pretty high, and if you are hearing complaints about your network speed, make sure and test with FTP for the lower-protocol-overhead results. My swag as to why tftp is so slow is udp retries, but this is slower than I expected. If anyone has an opinion to add, comment away.

DSAdd, my new best friend

When faced with the need to create 50 new users in a brand, spanking new Windows 2008 R2 Active Directory Domain, our heroine did what most hero(ines) would do ... search for a command line tool to help her out.

So I searched, and first found "ldifde" which was, essentially a giant pain in the petunia, to quote a Disney fairy.

Then I found DSADD! Oh how I love you DSADD! For those script minded folks, you can do cool things with VB scripts and excel imports using dsadd, but I was happy to copy and paste.

Here's a string that worked, btw, with identifying names and domains changed to protect the innocent and private.

dsadd user "cn=Julie Smith,ou=ABUsers,dc=mydomain,dc=local" -fn Julie -ln Smith -display "Julie Smith" -disabled no -pwd Something123 -mustchpwd yes -tel 212.555.1111 -samid ud -email julie@mydomain.com -upn julie@mydomain.local

One gotcha, that got me good. I had users in an Excel table, that I added columns and text around to create the format above, then copy/paste into Word to search out extra tabs, spaces and the like. Word got all smarty-pants on me and switched out the plain-text double quote (") with Smartie-pants quotes that wrapped around. DSAdd complained and whined about these and refused to play nice.

dsadd failed: ... :A referral was returned from the server.
This also happens if you're trying to add a user to a OU or DC that doesn't exist, btw.

p.s. with love from Microsoft

Cisco ASA IOS 8.4 and the art of a native Windows 7 L2TP/IPSec VPN

It was a day full of IP wrangling, the day I got this to work. A sine curve kind of day full of frustrations and eventually joy. Perhaps this will save someone else a bit of agony ...

Here's a config that works on ASA software version 8.4(1) with the mind twisting new NAT syntax. The config is for IPSec clients which are Linux (using vpnc - tip of the keyboard to AI for that info), Mac OSX, and Cisco VPN Client, and also for L2TP/IPSec. Confirmed working on Windows 7, Vista, and XP Pro.

Identifying info like IP addresses, valid domain names, and the like have been scrubbed to create anonymity.

Caveat emptor, when using ADSM rather than the command line, it has a way of mucking with VPN tunnel configurations. Consider yourself warned!

Configuration required for IPSec VPN, used by Cisco VPN Client and Mac OSX, iPad, and iPhone colored orange.
Configuration required for L2TP/IPSec VPN, used by Windows XP, Vista, and 7 native clients, colored aqua.
Configuration required by both IPSec and L2TP/IPSec is in white.
…
interface Ethernet0/2
nameif Outside-ISP1
security-level 0
ip address X.X.15.2 255.255.255.248
!
interface Ethernet0/3
nameif Outside-ISP2
security-level 0
ip address Y.Y.18.86 255.255.255.248
…
object network NAT_VPN
subnet 10.1.1.0 255.255.255.0
…
access-list VPN_ROUTES standard permit 10.1.0.0 255.255.0.0
access-list VPN_ROUTES standard permit 10.2.0.0 255.255.0.0
access-list VPN_ROUTES standard permit 10.4.0.0 255.255.0.0
…

! separate pools are not needed, but it's easier to identify, you can definitely create only one
ip local pool VPN_POOL 10.1.1.11-10.1.1.40 mask 255.255.255.0
ip local pool L2TP_POOL 10.1.1.41-10.1.1.150 mask 255.255.255.0
…
! this next line is needed because the Windows client doesn't obey the split tunneling nicely, if you have multiple inside subnets, but this does mean if the VPN is connected, all traffic will go through the ASA and back out.

nat (Outside-ISP1,Outside-ISP1) source dynamic NAT_VPN interface
nat (Inside,Outside-ISP1) source static CORP_SUBNETS CORP_SUBNETS destination static NAT_VPN NAT_VPN
nat (Inside-Eng,Outside-ISP1) source static ENG_SUBNETS ENG_SUBNETS destination static NAT_VPN NAT_VPN
…
nat (Inside,Outside-ISP2) source static CORP_SUBNETS CORP_SUBNETS destination static NAT_VPN NAT_VPN
nat (Inside-Eng,Outside-ISP2) source static ENG_SUBNETS ENG_SUBNETS destination static NAT_VPN NAT_VPN
…
crypto ipsec ikev1 transform-set ESP-3DES-SHA_trans esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA_trans mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
! For IPsec only, do NOT specify “mode transport”
crypto dynamic-map DynMap 1 set ikev1 transform-set ESP-3DES-SHA_trans ESP-3DES-SHA
crypto map MapVPN 100 ipsec-isakmp dynamic DynMap
crypto map MapVPN interface Outside-ISP1
crypto map MapVPN interface Outside-ISP2
crypto isakmp nat-traversal 60
crypto ikev1 enable Outside-ISP1
crypto ikev1 enable Outside-ISP2

! can probably delete policy 10 or 65535, test and report back

crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 43200
crypto ikev1 policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
…
group-policy DfltGrpPolicy attributes
vpn-simultaneous-logins 1
vpn-tunnel-protocol ikev1 l2tp-ipsec
group-policy VPNPolicy internal
group-policy VPNPolicy attributes
dns-server value 10.2.1.32
vpn-tunnel-protocol ikev1 l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_ROUTES
default-domain value nonamedomain.com
group-policy VPNPolicyIpsec internal
group-policy VPNPolicyIpsec attributes
dns-server value 10.2.1.32 Public_DNS_Server_IP
vpn-idle-timeout 120
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_ROUTES
default-domain value nonamedomain.com
…
! when creating new users, specify the encryption type as mschap, not as nt-encrypted so that when the account is created, the password will be converted to unicode and hashed in MD4.

username user1 password **** nt-encrypted
username user2 password **** nt-encrypted

…
! L2TP for Windows uses the DefaultRAGroup, it won't use a specific tunnel group

tunnel-group DefaultRAGroup general-attributes
address-pool L2TP_POOL
authorization-server-group LOCAL
default-group-policy VPNPolicy
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key ****
isakmp keepalive threshold 40 retry 5
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
no authentication ms-chap-v1
authentication ms-chap-v2
tunnel-group VPNGroupIpsec type remote-access
tunnel-group VPNGroupIpsec general-attributes
address-pool VPN_POOL
default-group-policy VPNPolicyIpsec
tunnel-group VPNGroupIpsec ipsec-attributes
ikev1 pre-shared-key ****
isakmp keepalive threshold 40 retry 5

If you want specifics on the client side setup, let me know.

Fun at home with VMWare ESXi, CentOS netinstall, and Windows Server 2008 R2

At long last, I am building that home VMWare ESXi host, to be the home for a few OS'es, including CentOS 5, and Windows Server 2008 R2, as my personal server playgrounds.

Here are a few tips and tricks I learned along the way, that you may find useful, if you ever do this at home (try it at home, kids, it's fun and safe!).

So. The environment:

Dell PowerEdge 830 tower server which has:
4GB memory (would love to upgrade, but not willing to pay the $$)
CERC SATA RAID controller
3 x 250GB disks, RAID5 configuration

First, VMWare ESXi. I wasn't willing to install Windows OS first, and then VMWare server, so I was on a mission to figure out which ESXi version (as ESX is nowhere to be found anymore), would work on my four year old server. It wasn't 4.1, and the free version is now called VMWare VSphere Hypervisor 4.1. But the HCLs say no way Jose to my 4 year old box, so I need version 3.5, open source.

So I searched, and searched, and found a link at long last to ...
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vsphere_hypervisor_esxi/3_5

File: VMware-VMvisor-InstallerCD-3.5.0_Update_5-207095.i386.iso

Register, by the way, and you get a free license. Don't register, and VMWare will commit suicide in 60 days.

Burn that puppy to a CD, and boot from it. Installed like a charm, like a champ, configure your datastore as you will, I made all available space the datastore.

Once you get that license, add it ...
In the Virtual Infrastructure Client, select the server, click on the Configuration Tab, select "Licensed Features" and add the serial number.

I downloaded CentOS-5.5-i386-netinstall.iso so I would not have to download 5 ginormous CentOS install ISOs. LOVE netinstall!

Then I created a folder under the main datastore on the ESX host, ahem, ESXi host, so I could mount the ISO like a CD for the new VM.

On the ESX host, Configuration tab > Storage option > right click on the Datastore > Browse datastore.

Create a new folder, I called mine Distros. Open folder, click the Upload icon, and you can upload the CentOS ISO to that directory.

Then ... the fun part!

Create a new VM for CentOS, name it as you will.
In the Settings, for the CD/DVD drive, select Datastore ISO file, and browse to the ISO.

Here's the one tricky part, figuring out the server and path to the rest of the images needed by the CentOS netinstall. After browsing the many CentOS mirrors, this is what worked, which was not the path where I downloaded the netinstall ISO. Go figure.

At the root URL for the mirror, browse to some path that could look like this:

http://hostname/5.5/os/i386/

make sure that the path you specify has an /images subdirectory. That's the ticket!

Good luck here. Erroneous errors including CentOS returning extra //'s in the path that could just drive you crazy. Just look for the /images subdir, and specify the parent path.

Then ... onto Windows Server 2008 R2 install, which is, of course, 64-bit. First attempt at install gave me this lovely error ...


For search purposes, here is the main clue:
Attempting to load a 64-bit application, however this CPU is not compatible with 64-bit mode.

Say what?!

As I soon figured out, with a tip of the hat to google, there is a BIOS setting, disabled by default, that resolves this error in a jiffy.

Here's how I did it on my server:

F2 at boot, get into bios settings
CPU info
Virtualization technology > disabled by Default, change to Enabled

Reboot, and guess what? Problem solved! Windows Server 2008 R2 installed happily and easily, once I copied the ISO to the datastore as I did for CentOS. No small lovely netinstall though, MS you might want to get with the program.

Windows XP computer thinks it's the domain master browser

One of my many Windows XP computers believes it's the Domain Master Browser, as shown in the logs on one of my Windows 2003 ADCs, as such:

System Log

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 11/29/2010
Time: 3:56:13 PM
User: N/A
Computer: XXXXX02
Description:
The master browser has received a server announcement from the computer XXXXXX069 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D051FAC0-5D67-4. The master browser is stopping or an election is being forced.

I checked the Computer Browser service, and it shows startup type as Automatic (as my laptop does as well), but status is Started, where mine is not.

Stopped the service, and set to Manual.

When faced with a couple tgzaa / tgzab files ...

Yesterday I was faced with the task of how to uncompress and un-tar two files that represented the backup of a whole server that was decommissioned a few months back, the files were named as so:

vancouver.2008-09-05.2156.tgzaa
vancouver.2008-09-05.2156.tgzab

I tried:
tar xvfz vancouver.2008-09-05.2156.tgzaa vancouver.2008-09-05.2156.tgzab
but got un-friendly error messages to the effect that it wasn't going to happen. Ever.
Then I tried this, on just the first file:
tar xvfz vancouver.2008-09-05.2156.tgzaa

which uncompressed that archive, and ended with an EOF error

after pulling a dozen weeds out of my garden in frustration, a coworker found the answer:
nice -n19 cat redmond.2008-09-05.2156.tgza* gzip -dc - tar xvf -

with this explanation:
nice - to no havily load the server
cat - to join the volumes
gzip -dc - to extract
tar - to unfold the directory structure

It was the joining of the volumes I didn't know had to be done first ... tip of the pen to NF.

Into the world of cisco - pinging between firewalls in a vpn

Cisco VPNs ... I've set up more than my share, but they always challenge me anyway. I've had a point to point vpn set up between two offices for a few months, but what got me, bugged the heck out of me was that I couldn't ping from the pix on one side to the inside interface on the asa on the other side (and vice versa). Moreover, I couldn't ping from hosts on one side to the inside intf on the firewall on the other side.

And my cisco contract expired before I thought to call them.

So at long last, I renewed the contract, sent in the email with all the configs, and alas, as I suspected the answer was illusive, but simple nonetheless.

management-access inside

command entered on both firewalls, and voila, as if by magic, the pings had response times instead of timeouts, and now my syslog server can reach the remote pix, and I get to check one little big thing off my list.

Apple connecting to Windows Share

At long last, a problem I've ignored for many, many months is revealed and resolved. Apple gives this simplistic view of a Mac connecting to an SMB share on a windows file server (Win 2003):

http://support.apple.com/kb/HT1568

Which says, select Go > Connect to Server
type in
smb://servername/sharename
enter your domain/username/password
and voila! You are in the land of the MS clients now.
But alas, this failed, and Apple contractors on the net couldn't connect.

So I tried to connect to a member server using this method, with a local account instead of a domain account, and that DID work.

So I thought, Domain Policies, perhaps, and a quick Google turned up this completely useful link:

http://allinthehead.com/retro/218/accessing-a-windows-2003-share-from-os-x

Which says, basically, that by default a Windows domain policy will require all connecting clients to digitally sign communications, which Macs don't do, and thus, lost in translation.

Disable this policy (see link above), run gpupdate to refresh the domain policy, and away we go.

Monitoring homework made easy

I was just about to press the mouse button to purchase a 5 server version of ActiveXperts monitoring application, but had an itch to do a quick google search on 'ActiveXperts Nagios' - one of my favorite ways to find out competitive reviews.

And I found a list of products "suitable for large-scale IT installations and compatible with" a couple products I'd never heard of.
http://www.hw-group.com/software/pd_it_big_en.html

Quick summary of 10 products with their capabilities. Enjoy, someone saved us the time of researching!

PIX firewall - getting ssh to work

I always remember there is something I have to do for ssh to a pix or asa firewall to work, so here it is, the commands I remember I forgot:

hostname myfirewall
domain-name mydomain.mytld
ca gen rsa key 1024
ssh 0.0.0.0 0.0.0.0 outside #if you want to permit ssh from the Internet to your firewall
ssh timeout 20 #this is in minutes, I find the default of 5 to be irritating
passwd YourPasswordGoesHere
ca save all

then ssh using this from a *nix machine:
ssh -1 pix@publicIP
the ssh password is the "YourPasswordGoesHere" above NOT the enable password

Microsoft SQL Server 2005 - suspect status and restoring from backup

A couple days ago one of our production databases suddenly imploded, and the only warning it gave us wasthe status of the database in Management Studio Express said "Suspect" after the database name.

We couldn't write more data, update data, but my team found a couple articles that came in handy:

Code Project: How to restore a suspect database
and
SQL-Articles

The first was most useful. But because altering the state of the database and repairing it causes just a bit of ice water to run through my veins, first we did a test restore of the previous night's backup to SQL Express running on my laptop.

Now, if you have a full backup, a differential backup, and a few transaction logs to apply, here's what you'll want to do in the GUI. There are others who swear by TSQL but I'm not fluent in that language so here's my way.

In SQL Management Studio, right click on Databases, select New Database
Create a new database with the identical name to the one you're restoring
I left all options at defaults

Then, with your .bak file handy, restore over the empty database you just created.
Right click on the empty database just created, select Tasks > Restore > Database
In the dialog box, select "source for restore" *from device, and locate the full backup file to restore first. Then select Options in the top left.
Change the path for "Restore As" to a valid path. For the full backup, you'll need to check "Overwrite the existing database"
If, IF you have a differential backup and/or transaction logs to apply after the full backup, then you'll need to select:
Leave the database non-operational and do not roll back uncommitted transactions ... (RESTORE WITH NORECOVERY)
if you don't choose this, you won't be able to restore the differential or txn logs.
If you're only restoring the full backup and nothing else, keep the default first option "Leave the database ready to use by rolling back uncommitted transactions ... (RESTORE WITH RECOVERY)

Got that?

Click OK when ready and wait patiently for the first increment of 10% to be passed. Progress is measured in 10% increments for reasons known only to the MS SQL team.

After this one is up, if you chose the RESTORE WITH NORECOVERY option, the database will say "Restoring"
Now do about the same thing as above to restore a differential if you have one. If you have transaction logs, choose the NORECOVERY option, if this is it, chose the RECOVERY option and you'll have a functioning database when you're done.

If you need to restore a transaction log,
Right click on the database name > Tasks > Restore > Transaction log
choose the file, and select the RESTORE WITH RECOVERY option if you want the DB to be functional after this txn log is applied.

Possible errors you may see:
System.Data.SqlClient.SqlError: The log or differential backup cannot be restored because no files are ready to rollforward. (Microsoft.SqlServer.Express.Smo)

For me this meant I chose RESTORE WITH RECOVERY when I still had differential or transaction logs to apply.

System.Data.SqlClient.SqlError: This differential backup cannot be restored because the database has not been restored to the correct earlier state.

For me, this meant I had restored a full backup but didn't have the next in line differential to apply. I found a newer full backup and then was able to restore the diff. Don't ask, I had two different apps making full backups of the database.

HTHSomeone ...

Cannot see wireless network woes ... resolved

I've had a pesky sort of problem for a couple months now that my CEO's computer can only see our wireless network but not our neighbors and couldn't see any in the city of Manhattan from his tower-high hotel room. Another contractor could see every other wireless network except ours; ditto for three new contractors that started this week.

But all the Dell Latitude D630s with (Dell Wireless 1490 Dual Band WLAN Mini-Cards) in the office could see all wireless access points including ours and the upstairs neighbors.

After many fruitless google searches, I finally extracted a clue.

The Cisco Aironet 1131AG in my office was only broadcasting over 802.11A, whereas the wireless network adapters of various makes and models including an Intel Wireless Wifi 4965AGN in a Sony Vaio and an undocumented card in an Acer were only listening on networks other than 802.11A.

So did two things:
I enabled 802.11G on the Cisco Aironet.

Then on the CEO's Vaio, I went into the properties of the wireless adapter
On Vista - Network and Sharing Center > Manage network connections > right click on the wireless adapter, select properties > select Configure > Advanced
in the list, look for something that goes by various names like Wireless Mode, Band Preference, or just search through the list until you see something that makes you choose whether you want 802.11 a/b/g or some combination.

On the Vaio, I could choose 802.11a/b/g and voila! CEO's vaio could suddenly see everyone's WAPs. I haven't tested on the other machines, but I'll repost if it doesn't solve the issue.

Issue deleting MS SQL Server Maintenance Plans and Jobs

I was contemplating running around in circles, as that's what my brain was doing trying to figure out this inane error with Microsoft SQL Server 2005 Maintenance Plans and associated jobs (subtasks).

I had a brand new install of SQL server and used the Maintenance Plan wizard to create a series of jobs for full backup, differential backup, and transaction log backup.

Seemed to be working just fine, until someone else changed the 'sa' password and all the jobs failed left right and center.

It took me a while to figure out that was the cause, and the last day to figure out how to delete a maintenance plan and associated jobs once the sa password was changed. Couldn't delete them manually, I got an error saying the login failed for user 'sa'.

I could delete all but one of the subplans by listing them first under maintenance plans, but one could never be deleted.

This turned out to be the major error:

An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo)
------------------------------
The DELETE statement conflicted with the REFERENCE constraint "FK_subplan_job_id". The conflict occurred in database "msdb", table "dbo.sysmaintplan_subplans", column 'job_id'.
The statement has been terminated. (Microsoft SQL Server, Error: 547)

And at long last, after many, many searches, I found this marvelous post on how to manually delete the jobs and maintenance plans with TSQL code:
MS Forums
and this one, which was inordinately useful:
sql-server-2005-delete-maintenance-plan-error

And here's pretty much what I did in TSQL to delete the subplan and the maintenance plan 'SystemDB-MaintenancePlan':

USE [msdb]
declare @job_name varchar(100)
set @job_name = N'SystemDB-MaintenancePlan.Subplan_1'

delete sysmaintplan_log
FROM sysmaintplan_subplans AS subplans INNER JOIN
sysjobs_view AS syjobs ON subplans.job_id = syjobs.job_id INNER JOIN
sysmaintplan_log ON subplans.subplan_id = sysmaintplan_log.subplan_id
WHERE (syjobs.name = @job_name)

USE [msdb]
declare @job_name varchar(100)
set @job_name = N'SystemDB-MaintenancePlan.Subplan_1'
delete sysmaintplan_subplans
FROM sysmaintplan_subplans AS subplans INNER JOIN
sysjobs_view AS syjobs ON subplans.job_id = syjobs.job_id
WHERE (syjobs.name = @job_name)

declare @job_name varchar(100)
set @job_name = N'SystemDB-MaintenancePlan.Subplan_1'
delete
from msdb.dbo.sysjobs_view where name = @job_name

delete
FROM msdb.dbo.sysmaintplan_plans
where name = 'SystemDB-MaintenancePlan'

other commands I find useful:
select * FROM sysmaintplan_subplans
select * FROM sysmaintplan_plans

Happy deleting! Thanks so much Gedzuks!

Installing Java / JDK and Tomcat with jpackage

Periodically, when amnesia strikes and I can't recall how I made this work the last 20 or so times I did it before, I get baffled, and start all over from the beginning.

I could be talking about anything, I suppose, but in this case I'm installing Java or the JDK as it's fondly called, and Tomcat and twelve billion dependencies it has on a server, in this case Linux.

Do yourself a favor here that I forgot when I was writing this blog ... see if java is already installed. If it's some antiquated version before 1.5, remove it, unless you know you need it. rpm -qa | grep on java and on jdk to make sure you're not missing anything.

In the past I've used the works and packages of the fine jpackage.org folks. This time is no exception.

First, dig deep in Sun's website until I find a 1.5.0 binary for Linux. I downloaded the Linux RPM in self-extracting file: jdk-1_5_0_14-linux-i586-rpm.bin.

For the uninitiated, it's easiest to use wget to get the binary right onto the server without any intermediate file saving, scp-ing, and the like, but since Sun's URLs are about 5 miles long, they fail wonderfully with the error: blahblahblah "File name too long."

So to make this work, use:
wget -O jdk-1_5_0_14-linux-i586-rpm.bin http://reallylongurlfromsuncopiedandpastedfromtheRPMinselfextractingfilelinkthatendsin/jdk-1_5_0_14-linux-i586-rpm.bin

and then, to our wonder and amazement, it will work. I also often forget this and the reminder is really for me, but if it helps you, all the better.

then, extract the .bin file:
./jdk-1_5_0_14-linux-i586-rpm.bin
which dumps a rpm in your pwd.

then install the RPM, do I need to say how to do this, well okay then:
rpm -i jdk-1_5_0_14-linux-i586.rpm

but then the fun begins, like finding out an older 1.4.2 version was installed already and I didn't delete it before I began this process so installing the rpm gave the message:
[root@server jdk]# rpm -i jdk-1_5_0_14-linux-i586.rpm
package jdk-1.5.0_14-fcs is already installed

and look, rpm -qa | grep jpp gives a whole big list of pkgs, do I need to remove them all? (yes, is the answer you'll see later)

[root@server yum.repos.d]# rpm -qa | grep jpp
bsh-manual-1.3.0-9jpp.1
bsh-javadoc-1.3.0-9jpp.1
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.2.el5
xalan-j2-2.7.0-6jpp.1
jakarta-commons-logging-1.0.4-6jpp.1
java-1.4.2-gcj-compat-javadoc-1.4.2.0-40jpp.112
jpackage-utils-1.7.3-1jpp.2.el5
xmlrpc-javadoc-2.0.1-3jpp.1
java-1.4.2-gcj-compat-1.4.2.0-40jpp.112
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.2.el5
bsf-2.3.0-11jpp.1
bsh-1.3.0-9jpp.1
jakarta-commons-codec-1.3-7jpp.2
jakarta-commons-httpclient-3.0-7jpp.1
java-1.4.2-gcj-compat-devel-1.4.2.0-40jpp.112
ldapjdk-4.18-2jpp.3.el5
antlr-2.7.6-4jpp.2
junit-3.8.2-3jpp.1
xmlrpc-2.0.1-3jpp.1
java-1.4.2-gcj-compat-src-1.4.2.0-40jpp.112


Okay, so to begin, let's update /etc/yum.repos.d to include the jpackage repository:
in the /etc/yum.repos.d do:
wget http://www.jpackage.org/jpackage17.repo

but do you see the problem ... I don't want 1.7, I want 1.5, so how do I get that?
What I did was create my own jpackage50.repo file containing this:
[jpackage50-generic]
name=JPackage 5.0, generic
baseurl=http://mirrors.dotsrc.org/jpackage/5.0/generic/free/
gpgkey=http://www.jpackage.org/jpackage.asc
gpgcheck=1
enabled=1

[jpackage50-generic-nonfree]
name=JPackage (non-free), generic
baseurl=http://mirrors.dotsrc.org/jpackage/5.0/generic/non-free/
gpgcheck=1
gpgkey=http://www.jpackage.org/jpackage.asc
enabled=1

and now I'll go hunting to remove the jpps:
deleted all the jpp rpms except these:
bsh-manual-1.3.0-9jpp.1
bsh-javadoc-1.3.0-9jpp.1
jpackage-utils-1.7.3-1jpp.2.el5
xmlrpc-javadoc-2.0.1-3jpp.1

now reinstall jdk:
rpm -ev jdk-1.5.0_14-fcs
rpm -iv jdk-1.5.0_14-fcs
install java-compat from jpp:
rpm -iv java-1.5.0-sun-compat-1.5.0.14-1jpp.src.rpm
which seemed to work, but rpm isn't listed with rpm -qa | grep java

but what did work:
yum install java-1.5.0-sun-compat-1.5.0.14-1jpp
and now it's in the rpm list. yay!
and java -version shows the new version - yay yay!
[root@quinoa jdk]# java -version
java version "1.5.0_14"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_14-b03)
Java HotSpot(TM) Client VM (build 1.5.0_14-b03, mixed mode, sharing)

figured out I need tomcat 5.5, not 6.0, and a handy
yum list *tomcat*
gave me a list of all tomcat options, giving me a choice between tomcat5 (which was really 5.5.23) and tomcat6.
ran
yum install tomcat5
and away it went, installing the 37 dependencies and tomcat5 from jpackage.
it ended with this error:
/usr/bin/build-jar-repository: error: Could not find xml-commons-apis Java extension for this JVM
/usr/bin/build-jar-repository: error: Some specified jars were not found for this jvm

and when I started tomcat I got the same error. So I installed xml-commons-apis
yum install xml-commons-apis
which inconveniently uninstalled the jdk, why, I'm not sure, so I installed it back again from the rpm I got from sun.
restarting tomcat didn't get that error this time.

Credits to:
Sun
jpackage.org
Bart Busschotts

Postfix useful queue commands

Two Postfix commands I discovered by accident while trying to figure out how to delete mail out of the queue:

postqueue -d
list all mail in the queue currently
postqueue -f
flush mail from the queue; will attempt to deliver all mail

postsuper
superuser postfix command

and the command:
postsuper -d ALL
will delete all messages from the queue

Credit:
Seaglass Postfix FAQ
man postsuper
man postqueue

Setting up a new server - ntp

Super brief notes on configuring NTP

Make sure ntp is installed
rpm -qa | grep ntp
yum install ntp

Edit /etc/ntp.conf
Add stratum servers from www.ntp.org - check the server pool for your locale.

I added these:
server 0.north-america.pool.ntp.org
server 1.north-america.pool.ntp.org
server 2.north-america.pool.ntp.org
server 3.north-america.pool.ntp.org

And this to restrict access from those servers:
restrict 0.north-america.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 1.north-america.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 2.north-america.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 3.north-america.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery

And permit any host in my private network to get time from my server:
restrict 10.1.1.0 mask 255.255.255.0 nomodify notrap

check if ntpd is currently running:
ps -ef | grep ntp
no dice, so configure it to start at boot

chkconfig --list ntpd
ntpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off

Check to see if the server time is reasonably close to ntp time (within 2 minutes), if not run:
ntpdate pool.ntp.org
to synchronize.

Run:
chkconfig ntpd on
service start ntpd

Check for log messages in /var/log/messages and check the time on the server to see if it's accurate. Also check status with:
[root@server etc]# ntpq -pn
remote refid st t when poll reach delay offset jitter
==============================================================================
64.73.32.134 64.73.0.9 2 u 30 64 1 72.596 4.418 0.001
66.250.45.2 209.51.161.238 2 u 29 64 1 92.327 -8.728 0.001
66.36.239.127 129.6.15.29 2 u 28 64 1 86.409 1.150 0.001
82.165.184.7 74.208.4.166 3 u 27 64 1 88.581 -7.514 0.001
127.127.1.0 .LOCL. 10 l 26 64 1 0.000 0.000 0.001

Tip of the keyboard to:
ntp.org
linuxhomenetworking.com

Setting up a new server - logwatch & logrotate

A couple hints so that you get logwatch emails and include other log files you want to monitor.

Logwatch depends on having the email address set for root to forward somewhere, otherwise the emails will sit in the local mailbox for root.

Change this line in /etc/aliases - works for either sendmail or postfix:
# Person who should get root's mail
root: validuser@yourdomain.com

Then run 'newaliases' (for sendmail) so this will be in use.
You may run into issues if the hostname for your box isn't in public DNS because of actions to cut down spam, so set it to masquerade if needed (see last post).

Then to have logwatch check other logfiles besides the defaults, which on my CentOS box are listed in /usr/share/logwatch/default.conf/logfiles
in my case, I'm going to add monitors for the syslog alerts for my network equipment that I have set to go to /var/log/network and also for a newly created mysql backup log file /var/log/mysqlbackup

Defaults are fine, so I created the file /etc/logwatch/conf/logfiles/network.conf
#######################################################
# Defile log file group for /var/log/network
# syslog output for network equipment
# created by JAR 1/16/08
#######################################################

# Actual file
LogFile = network

#EOF

We'll see if this works.

Also a quick note about logrotate - when I configured syslog to accept messages from my network gear, I configured the new log file "network" in logrotate so that it would follow the normal rotation.

I added to the /etc/logrotate.d/syslog file:
/var/log/network

Setting up a new server - sendmail/postfix

Someday I will create a checklist of things to do to a new unix server to make it behave as I'd like. Until that someday comes, I'll write bits and pieces of things to do to remind myself.

Here's one.
When setting up a new system that has Logwatch enabled, remember by default it's going to email "root@localhost" all the logs. This is fine, except that if you're like me, you seldom check email for root and would prefer that the logfiles get sent to an email address, probably Internet routable, that you check more frequently.

This is how to make that happen, or perhaps what to do first:
Edit the /etc/aliases file
notice that everything is going to root, either directly or indirectly.
At the very bottom of the file, see the line that is commented out:

# Person who should get root's mail
#root: marc

make it a real email address that goes to a real human somewhere.
then run command 'newaliases' so the change you made goes into a file that's read.

Or, if you are, in fact, not a fan of sendmail, you can quickly switch to postfix (or qmail for the diehards) which has the reputation of being more secure and easier to work with.

In fact, I recommend this:
yum install postfix
service sendmail stop
yum erase sendmail

and then, if you want your host to pretend to be a different name (masquerade), edit this line:

myhostname = hostname.outsidedomain.com
and uncomment this line:
myorigin = $mydomain

so that email sent from this box will appear as username@outsidedomain.com.
a quick
service postfix restart

and you're good to go.

CVS Setup on Linux

I know, in this fast paced modern world that SVN is thought to be superior to CVS, but for some of my studio audience, and myself, here are my notes from configuring CVS.

I'm using CentOS rel 5, but should be similar on RH or Fedora (now please tell me you're not surprised about that).

check if you have cvs already:
rpm -qa | grep cvs

if not ...
yum install cvs

then add CVSROOT as a variable for everyone using bash ... if they're not using bash, they're on their own ...
add to /etc/bashrc:
CVSROOT=/home/cvsrep
export CVSROOT

create initial repository:
cvs -d /home/cvsrep init

Edit the file /etc/xinetd.d/cvs which starts the service in the xinetd server - this was created by "yum install cvs"

# default: off
# description: The CVS service can record the history of your source \
# files. CVS stores all the versions of a file in a single \
# file in a clever way that only stores the differences \
# between versions.
service cvspserver
{
disable = yes
port = 2401
socket_type = stream
protocol = tcp
wait = no
user = root
passenv = PATH
server = /usr/bin/cvs
env = HOME=/var/cvs
server_args = -f --allow-root=/var/cvs pserver
# bind = 127.0.0.1
}

but note the "disable=yes" line
if you want cvs to work ... change to:
disable=no

and restart xinetd after you make all configuration changes necessary

tip of the keyboard to:
http://personal.vsnl.com/sureshms/linuxindex.html