Problemi e Soluzioni di un sistemista informatico

./cfgmaker –global ‘WorkDir: /var/www/htdocs/mrtg’ –global ‘Options[_]: bits,growright’ –output/etc/mrtg/lanservice.mrtg.cfg -ifref=ip proietti@172.21.1.61

Comunity proietti

Nessun Commento

RunAs – HowTo Run OpenVPN as a non-admin user in Windows

Microsoft, openvpn, vpn admin 5 September 2008

THANK YOU!!!

http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin.html

Mathias Sundman (mathias@openvpn.se)
2005-02-17
Rev 1.1

Introduction

With the current implementation of the TAP-Win32 driver included with OpenVPN, administrator privileges is required to open the TAP device. This means that openvpn.exe must be executed with administrator privileges. In many situations it’s un recommended to do your day-to-day work logged on with an administrator account. Especially corporate environments often have a policy that users should never have administrator rights even on their local machine. Fortunately there are a few ways to work around this so OpenVPN can be used even in these environments.

Here I present you with two ways to run OpenVPN / OpenVPN GUI as a non-admin user:

1) Use the OpenVPN Service

Included in the OpenVPN / OpenVPN GUI installation package there is a small service wrapper for OpenVPN. This service simply starts all configuration files it finds in the OpenVPN\config folder. If you want your OpenVPN tunnel to always be up, regardless of whether you are logged on or not, you can simply configure the OpenVPN Service to start automatically at boot-time. However it might be more convenient to be able to start and stop the tunnel when you want, which you can do by starting and stopping the service. For more information about the OpenVPN Service see the “Running OpenVPN as a Windows Service” section in INSTALL-win32.

The major disadvantage with this method is that there is no way to supply the OpenVPN Service with the password used to encrypt your private key. This means that you must use an un-encrypted private key when using this method. A way to get around the problem with having your private key lying unprotected on your hard drive is to import it to the MS Certificate Store and use the –cryptoapicert option to load it. Remember that the service is running as “Local System” (by default) so you must import the key/cert into the System account, not your user account. (There is work in progress to allow OpenVPN to access also user account key/cert’s). To load a key/cert into the System accounts CertStore you must use the Certificates MMC Snap-In, not Internet Explorer.

Give a normal user right to control the OpenVPN Service

Normally starting and stopping a service requires administrator privileges, but you can assign a normal user the right to control an individual service. You do this with the subinacl.exe utility included in the Windows Resource Kit. You can also download it here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en

To give the user “John” the right to start and stop the OpenVPN service, log on as administrator and run the following command:

subinacl /SERVICE “OpenVPNService” /GRANT=john=TO

You can also give a user right to control a service through the use of Group Policies. See this support article for more info.

Control the OpenVPN service from OpenVPN GUI

A default installation of OpenVPN GUI does not give you any way to control the OpenVPN service. There is however two ways to do this. If you are running as administrator, and just want a convenient way to control the OpenVPN Service, you can enable a hidden menu for this. You enable this by setting the following registry value to “1″:

HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\allow_service

Since OpenVPN GUI 1.0-rc2 there is a special mode called “Service Only” that is suitable for users running without admin privileges. This mode changes the behavior of the “Connect” and “Disconnect” actions to start and stop the OpenVPN service instead of launching openvpn.exe directly, like it usually does. It also hides the “Proxy Settings” menu as it has no effect on the service. To enable this mode set the following registry value to “1″:

HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\service_only

Also remember that a normal user don’t have write access to the OpenVPN\config folder, so he won’t be able to edit the OpenVPN config file or change his password, unless you give him write access to these files. To hide these menu items set the following registry values to “0″:

HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\allow_edit

HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\allow_password

2) Windows “RunAs” feature

Since Windows 2000, there is a feature that allows you to start an application as another user than the currently logged on account. The best way to use this feature is by starting OpenVPN GUI as administrator this way. Since OpenVPN GUI is then running as administrator any number of OpenVPN tunnels can started and stopped as long as OpenVPN GUI is running.

* Keep in mind that by using this feature you are potentially giving your users a way to escalate their privileges to administrator rights. If your main reason for not running as administrator is to protect against malicious code on the web from executing with administrator rights in your computer, then this could be a good way to run OpenVPN GUI, but if your users under no circumstances should be able to run other applications as administrator, you should NOT use this way to run OpenVPN GUI either!

While installing OpenVPN / OpenVPN GUI, make sure to un-check “AutoStart OpenVPN GUI”, as you will need to create your start-up shortcut manually.

Create a “RunAs” short-cut in Windows 2000

Create a normal Short-Cut to openvpn-gui.exe (c:\program files\openvpn\bin\openvpn-gui.exe) on the desktop.
Right-click the short-cut and select Properties.
Check “Run as a different user”.

When you double-click this short-cut, you will now be prompted for the username and password of the user you want to run as. If you want OpenVPN-GUI to auto-start when you logon, move this short-cut to your “Startup” folder on the Start->Programs menu. You will then be prompted for username and password directly every time you log on.

I’m not aware of any way to save the credentials so you don’t have to type them every time in Windows 2000.

Create a “RunAs” short-cut in Windows XP

Create a normal Short-Cut to openvpn-gui.exe (c:\program files\openvpn\bin\openvpn-gui.exe) on the desktop.
Right-click the short-cut and select Properties.
Click “Advanced…”
Check “Run with different credentials”.

Create a “RunAs” short-cut in Windows XP that saves the administrator password

WARNING: When using this method the user will be able to start ANY application as administrator with the right knowledge.

Create a normal Short-Cut to openvpn-gui.exe (c:\program files\openvpn\bin\openvpn-gui.exe) on the desktop.
Right-click the short-cut and select Properties.
In the Target box, insert the following before the path to openvpn-gui.exe: “runas /savecred /user:administrator “.
Double-click the new short-cut, and enter the administrator password.

Next time you run this short-cut, it will start OpenVPN GUI as administrator automatically without prompting you for any credentials. If you want OpenVPN-GUI to auto-start when you logon, move this short-cut to your “Startup” folder on the Start->Programs menu.

Future

There is work in progress to enhance the OpenVPN Service so it can be controlled via a TCP socket. This will allow individual tunnels to started and stopped at will, as well as supplying OpenVPN with the password used to encrypt the private key. OpenVPN GUI 2.0 will be rewritten to make use of this service.

Nessun Commento

Linux: Slow SSH Login – Login Lento con SSH

Linux admin 29 August 2008

Thanks to http://www.hackosis.com/2007/12/15/linux-fix-slow-ssh-login/

The Problem:

By default, most SSH installations are set to do a reverse DNS lookup on any incoming connections. If the DNS server times out, or there is no record for your IP address, it can result in a very lengthy delay when logging into your Linux server via SSH.

The Solution:

There are about 3 different solutions to this problem.

Disable reverse lookup on the SSH server you are connecting to.Append
UseDNS no UsePAM no

to the /etc/ssh/sshd_config file on the server you are connecting to and restart the SSH daemon —

/etc/init.d/sshd restart or /etc/init.d/ssh restart.
If you are connecting from a static IP, you may enter your host name in the /etc/hosts file.
Call your ISP and ask them to setup reverse hostnames for customer’s IP addresses.

And enjoy your non-delay SSH login for more info check out the sshd_config man page.

Nessun Commento

Replicazione Database MySQL – Mysql replication

database, Linux, mysql admin 11 August 2008

Sul MASTER:

ipotizzo che il master sia il 192.168.0.20

——————— /etc/my.cnf del Master 192.168.0.20 ————————————–

[client]
port = 3306
socket = /tmp/mysql.sock

[mysqld]
port = 3306
socket = /tmp/mysql.sock
skip-locking
key_buffer = 256M
max_allowed_packet = 1M
table_cache = 256
sort_buffer_size = 1M
read_buffer_size = 1M
read_rnd_buffer_size = 4M
myisam_sort_buffer_size = 64M
thread_cache = 8
query_cache_size= 16M
log-slow-queries=/var/log/mysql-slow-queries.log
thread_concurrency = 8
log-warnings

server-id = 1
relay-log = /usr/local/mysql/data/mysql-relay-bin
relay-log-index = /usr/local/mysql/data/mysql-relay-bin.index
master-info-file = /usr/local/mysql/data/mysql-master.info
relay-log-info-file = /usr/local/mysql/data/mysql-relay-log.info
log-bin = /usr/local/mysql/data/mysql-bin

[mysqldump]
quick
max_allowed_packet = 16M

[mysql]
no-auto-rehash

[isamchk]
key_buffer = 128M
sort_buffer_size = 128M
read_buffer = 2M
write_buffer = 2M

[myisamchk]
key_buffer = 128M
sort_buffer_size = 128M
read_buffer = 2M
write_buffer = 2M

[mysqlhotcopy]
interactive-timeout

——————————————————————————————————————-

operazioni sul master:

mysql

GRANT SUPER,REPLICATION CLIENT,REPLICATION SLAVE,RELOAD ON *.* to slaveuser@’192.168.0.25′ identified by ‘slavepw’;
FLUSH PRIVILEGES;

——————— /etc/my.cnf dello Slave 192.168.0.25 ————————————–

[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
# Default to using old password format for compatibility with mysql 3.x
# clients (those using the mysqlclient10 compatibility package).
old_passwords=1

# changes made to do slave
server-id = 2
relay-log = /var/lib/mysql/mysql-relay-bin
relay-log-index = /var/lib/mysql/mysql-relay-bin.index
#log-error = /var/lib/mysql/mysql.err
master-info-file = /var/lib/mysql/mysql-master.info
relay-log-info-file = /var/lib/mysql/mysql-relay-log.info
##datadir = /var/lib/mysql
master-host=192.168.0.20
# Nome con cui lo slave si presenta al master
report-host = 192.168.0.25
master-user=slaveuser
master-password=slavepw
#master-port=3300
master-connect-retry=30
# end slave setup

log-warnings

## Risolve un bug
skip-bdb

[mysql.server]
user=mysql
basedir=/var/lib

[mysqld_safe]
err-log=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

——————————————————————————————————————-

operazioni sullo Slave:

mysql -u root -p
> load data from master;

Problemi e soluzioni

Appena configurato il master-slave ho avuto i seguenti errori nei log e conseguenti problemi di replica master-slave

Error reading slave log configuration
080811 15:01:08 [ERROR] Error reading slave log configuration
080811 15:01:08 [ERROR] Failed to initialize the master info structure

Ho risolto stoppando lo slave, stoppando il master e cancellando dal master i file:
/usr/local/mysql/data/mysql-relay-bin
/usr/local/mysql/data/mysql-relay-bin.index
/usr/local/mysql/data/mysql-master.info
/usr/local/mysql/data/mysql-relay-log.info
/usr/local/mysql/data/mysql-bin

Saluti a tutti

Maurizio

Nessun Commento

Gestione degli utenti inattivi su Windows 2003 Server

windows, windows 2003 server admin 7 August 2008

Oggi ho deciso di ripulire un po’ il dominio.
Ho scritto uno script che permette di
creare un report e/o di spostare gli account e/o di disattivare gli account
che non eseguono l’accesso al dominio (owa compresa) da un tempo
superiore a un numero di giorni
settabili a piacere.
Se può esservi utile, lo allego di seguito.
E’ uno script VBS
Saluti a tutti
Maurizio Proietti

'Option Explicit 'On Error Resume Next


'—— SCRIPT CONFIGURATION ——

'Creo un report? (si/no)

CreaReport = "si"

'Dove creo il report?

ReportFolder = "\\fs3\SW_PKG\ScriptGestione\Report\"

'ReportFileName = year(now())&"_"&month(now())&"_"&day(now())&".txt"

ReportFileName = year(now())&"_"&month(now())&"_"&day(now())&".csv"
'Sposto gli account UTENTE nella OU definita + sotto? (si/no)

MoveUsersAccount = "si"

'Sposto gli account COMPUTER nella OU definita + sotto? (si/no)

MoveComputersAccount = "no"
'Dove sposto gli account utente inattivi

MoveUsersToOU = "OU=Users,OU=z_InactiveAccount,DC=prvprato1,DC=local"

'Dove sposto gli account macchina inattivi

MoveComputersToOU = "OU=Computers,OU=z_InactiveAccount,DC=prvprato1,DC=local"
'Disabilito gli account? (si/no)

DisableUsersAccount = "si"

DisableComputersAccount = "no"
'Quanti giorni di inattività occorrono per spostare gli account e di conseguenza cancellargli la posta? (deve essere >= 15)

InactiveDaysToMoveAccounts = 90
'Quanti giorni di inattività occorrono per disabilitare gli account? (deve essere >= 15)

InactiveDaysToDisableAccounts = 45
'Dove ricerco

strDomainDN = "CN=Users,DC=prvprato1,DC=local"
'strDomainDN = "DC=prvprato1,DC=local

'strDomainDN = "CN=test3,CN=Users,DC=prvprato1,DC=local"

'strDomainDN = "OU=Users,OU=z_InactiveAccount,DC=prvprato1,DC=local"

'strDomainDN = "DC=prvprato1, DC=local"
' —— END CONFIGURATION ———
'Option Explicit
'——–   Cerco e scrivo il lastLogonTimeStamp x utenti ———————
Const OPEN_FILE_FOR_APPENDING = 8
Dim objRootDSE, adoConnection, adoCommand, strQuery

Dim adoRecordset, strDNSDomain, objShell, lngBiasKey

Dim lngBias, k, strDN, dtmDate, objDate

Dim strBase, strFilter, strAttributes, lngHigh, lngLow
' Obtain local Time Zone bias from machine registry.

Set objShell = CreateObject("Wscript.Shell")

lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" _

& "TimeZoneInformation\ActiveTimeBias")

If (UCase(TypeName(lngBiasKey)) = "LONG") Then

lngBias = lngBiasKey

ElseIf (UCase(TypeName(lngBiasKey)) = "VARIANT()") Then

lngBias = 0

For k = 0 To UBound(lngBiasKey)

lngBias = lngBias + (lngBiasKey(k) * 256^k)

Next

End If

Set objShell = Nothing
' Determine DNS domain from RootDSE object.

Set objRootDSE = GetObject("LDAP://RootDSE")

strDNSDomain = objRootDSE.Get("defaultNamingContext")

Set objRootDSE = Nothing
' Use ADO to search Active Directory.

Set adoCommand = CreateObject("ADODB.Command")

Set adoConnection = CreateObject("ADODB.Connection")

adoConnection.Provider = "ADsDSOObject"

adoConnection.Open "Active Directory Provider"

adoCommand.ActiveConnection = adoConnection
' Search entire domain.

'Nella ver originale c’era questo, ma a me interessa solo la CN=USERS

'strBase = ""

strBase = ""
' Filter on all user objects.

'strFilter = "(&(objectCategory=person)(objectClass=user))"

strFilter = "(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"
' Comma delimited list of attribute values to retrieve.

strAttributes = "cn,distinguishedName,lastLogonTimeStamp"
' Construct the LDAP syntax query.

strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
' Run the query.

adoCommand.CommandText = strQuery

adoCommand.Properties("Page Size") = 100

adoCommand.Properties("Timeout") = 60

adoCommand.Properties("Cache Results") = False

Set adoRecordset = adoCommand.Execute
'Creo il report VUOTO

If (CreaReport = "si") Then

Dim objFileSystem, objOutputFile

Dim strOutputFile

strOutputFile = ReportFolder & ReportFileName

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objOutputFile = objFileSystem.CreateTextFile(strOutputFile, TRUE)

objOutputFile.WriteLine("distinguishedName;" & "CN;" & "lastLogonTimeStamp;" & "InactiveDays;" & "Action;" & "operazioni eseguite")

objOutputFile.Close

Set objFileSystem = Nothing

End If
' Enumerate resulting recordset.

Do Until adoRecordset.EOF

LogAction = "0?

Action = "0?

' Retrieve attribute values for the user.

strDN = adoRecordset.Fields("distinguishedName").Value

strCN = adoRecordset.Fields("cn").Value

' Convert Integer8 value to date/time in current time zone.

On Error Resume Next

Set objDate = adoRecordset.Fields("lastLogonTimeStamp").Value

If (Err.Number <> 0) Then

On Error GoTo 0

dtmDate = #1/1/1601#

Else

On Error GoTo 0

lngHigh = objDate.HighPart

lngLow = objDate.LowPart

If (lngLow < 0) Then

lngHigh = lngHigh + 1

End If

If (lngHigh = 0) And (lngLow = 0 ) Then

dtmDate = #1/1/1601#

Else

dtmDate = #1/1/1601# + (((lngHigh * (2 ^ 32)) _

+ lngLow)/600000000 – lngBias)/1440

End If

End If

' Display values for the user.

InactiveDays = DateDiff("d", dtmDate, now)

'———————– Sez disabilita utente ————————————————

If (DisableUsersAccount = "si") Then

If (InactiveDays >= InactiveDaysToDisableAccounts) Then

'DISABILITO UTENTE

set objUser = GetObject("LDAP://" & strDN)

if (objUser.AccountDisabled = FALSE) then

LogAction = "Account disabled by script"

objUser.AccountDisabled = TRUE

objUser.SetInfo

else

LogAction = "Account già disabilitato"

end if

End If

set objUser = Nothing

End If

'—————— FINE DISABILITA UTENTE ———————–
'———————– Sez sposta utente ————————————————

If (MoveUsersAccount = "si") Then

If (InactiveDays >= InactiveDaysToMoveAccounts) Then

strObjectDN    = "LDAP://" & strDN

strObjectRDN   = "cn=" & strCN

'SPOSTO UTENTE

set objMoveUsersToOU = GetObject("LDAP://" & MoveUsersToOU)

objMoveUsersToOU.MoveHere strObjectDN, strObjectRDN

LogAction = LogAction & " – Account spostato dallo script"

End If

set objMoveUsersToOU = Nothing

End If

'—————— FINE SPOSTA UTENTE ———————–
'———————– Sez REPORT ————————————————

If (CreaReport = "si") Then

If (dtmDate = #1/1/1601#) Then

dtLastLogon= "Never"

Else

dtLastLogon = dtmDate

End If

If (InactiveDays >= InactiveDaysToDisableAccounts) Then

Action = "To Disable"

End If

If (InactiveDays >= InactiveDaysToMoveAccounts) Then

Action = "To Move and Delete emails"

End If

'Dim objFileSystem, objOutputFile

'Dim strOutputFile
' generate a filename base on the script name

strOutputFile = ReportFolder & ReportFileName
Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objOutputFile = objFileSystem.OpenTextFile(strOutputFile, OPEN_FILE_FOR_APPENDING)

objOutputFile.WriteLine(strDN & ";" & strCN & ";" & dtmDate & ";" & InactiveDays & ";" & Action & ";" & LogAction)

objOutputFile.Close
Set objFileSystem = Nothing

End if

' ————————– FINE REPORT ———————————

adoRecordset.MoveNext
Loop

' Clean up. adoRecordset.Close adoConnection.Close Set adoConnection = Nothing Set adoCommand = Nothing Set adoRecordset = Nothing Set objDate = Nothing

2 Commenti