Saturday, 4 October 2014

Ah, SSH from Mac OS X to OpenSuSE - The firewall, (s)he say "No"

So I was trying to work out why I wasn't able to SSH from my Mac to my new server running OpenSuSE 13.1.

This is what I was doing: -


but that was simply timing out.

I then tried telnet e.g.

telnet 192.168.1.84 22

but to no avail: -

Trying 192.168.1.84...
...

On the SuSE box, I confirmed that sshd was running: -

netstat -anp | grep 'LISTEN' | grep 22

which returned: -

...
tcp 0 0.0.0.0:22 0.0.0.0:* LISTEN 17611/sshd
tcp 0 0 ::22 :::* LISTEN 17611/sshd
...

and: -

pgrep sshd

which returned: -

17611

As ever, a quick Google search for openlinux firewall which brought me here: -

I was wondering… why I can't connect through ssh. sshd daemon is running fine, so I found out that OpenSuSE installs its stikin' firewall by default and blocks everything. I'm pretty well protected behind enough high end security devices, and don't need to micro-manage my connection. Here is how I disabled the firewall altogether:

/sbin/SuSEfirewall2 off

To start the firewall:

/sbin/SuSEfirewall2 on

If you want to temporarily disable your firewall:

/etc/init.d/SuSEfirewall2_setup stop

Enter the above line without "stop" and you will see all available switches.
...

Lo and behold, once I did the same on the OpenSuSE box: -

/sbin/SuSEfirewall2 off

telnet worked: -

Trying 192.168.1.84...
Connected to 192.168.1.84.
Escape character is '^]'.
SSH-2.0-OpenSSH_6.2

as did ssh: -


Password: 
Last login: Sat Oct  4 19:42:44 2014 from 192.168.1.70
Have a lot of fun...

I did, of course, bring the firewall back up again when I'd finished ......

at No comments:

Synology NAS - Ever wonder why you cannot write to a USB external drive ?

So I was seeing this: -

cd /volumeUSB1/usbshare
touch foo

touch: foo: Permission denied

when I tried to write a file to an EXT2-formatted USB drive on my Synology DS414 NAS as a non-root user.

However, I was able to write a file as the root user.

Well, it's quite simple actually: -


Yes, the USB drive appears as this: -

/dev/sdr1 on /volumeUSB1/usbshare type ext3 (0)

and my admin user did NOT have Read/Write access to that drive.

It was actually this article that led me to the solution: -


so I will explore the SSH keys option :-)

at No comments:

Friday, 3 October 2014

 OS X and NFS

So I was seeing: -

Operation not permitted

whilst trying to mount a NFS export from my Mac: -

sudo mount -t nfs 192.168.3.5:/macbak /tmp/foobar

Simple solution, thanks to Google: -


...
simply adding -o resvport to the mount_nfs command resolves the above error and successfully mounts the NFS share.
...

which leads me to this: -

sudo mount -t nfs -o resvport 192.168.3.5:/macbak /tmp/foobar

The original article also refers to this: -


PS For the record, I'm using OS X 10.9.5 Mavericks, but the solution remains the same, which is nice :-)
at No comments:

WebSphere MQ Queue Manager Clustering


WebSphere MQ Queue Manager Clustering [PDF]



Plus this, which is relatively old but still useful: -

at No comments:

Adding Active Directory LDAP into a WebSphere Application Server 8.5 environment

This follows on from some earlier posts: -




and focuses on the use of Microsoft Active Directory 2008, whereas most of my prior experience ( recently, at least ) has been with IBM Tivoli Directory Server and CA Directory.

So here's the process I followed: -

Start WSAdmin Client

Note - in this scenario, we only have the Deployment Manager and Node Agent running

/opt/ibm/WebSphereProfiles/Dmgr01/bin/wsadmin.sh -lang jython -host `hostname`.uk.ibm.com -port 8879 -user wasadmin -password p455w0rd

Add SSL Signer Certificate for AD to Cell Default Trust Store

cellID=AdminControl.getCell()
AdminTask.retrieveSignerFromPort('[-keyStoreName CellDefaultTrustStore -keyStoreScope (cell):'+cellID+' -host ad_ldap.uk.ibm.com -port 636 -certificateAlias ad_ldap.uk.ibm.com -sslConfigName CellDefaultSSLSettings -sslConfigScopeName (cell):'+cellID+' ]')

Save and Synchronise

AdminConfig.save()
AdminNodeManagement.syncActiveNodes()

Create LDAP Repository

AdminTask.createIdMgrLDAPRepository('[-default true -id ad_ldap.uk.ibm.com -adapterClassName com.ibm.ws.wim.adapter.ldap.LdapAdapter -ldapServerType AD -sslConfiguration -certificateMapMode exactdn -supportChangeLog none -certificateFilter -loginProperties uid]')

Add LDAP Server

AdminTask.addIdMgrLDAPServer('[-id ad_ldap.uk.ibm.com -host ad_ldap.uk.ibm.com -bindDN ad_ldap_bin -bindPassword p455w0rd -referal ignore -sslEnabled true -ldapServerType AD -sslConfiguration -certificateMapMode exactdn -certificateFilter -authentication simple -port 636]')

Add Base Entry

AdminTask.addIdMgrRepositoryBaseEntry('[-id ad_ldap.uk.ibm.com -name dc=uk,dc=ibm,dc=com -nameInRepository dc=uk,dc=ibm,dc=com]')
AdminTask.addIdMgrRealmBaseEntry('[-name defaultWIMFileBasedRealm -baseEntry dc=uk,dc=ibm,dc=com]')

Enable/validate Global Security

AdminTask.setAdminActiveSecuritySettings('[-activeUserRegistry WIMUserRegistry -enableGlobalSecurity true]')

Set User Search Base and Search Filter

Note - your environment WILL almost certainly be different, in terms of object classes, filters etc.

AdminTask.updateIdMgrLDAPEntityType('[-id ad_ldap.uk.ibm.com -name PersonAccount -objectClasses organizationalPerson -searchBases "ou=users,dc=uk,dc=ibm,dc=com" -searchFilter (objectclass=person)]')

Set Group Search Base and Search Filter

Note - your environment WILL almost certainly be different, in terms of object classes, filters etc.

AdminTask.updateIdMgrLDAPEntityType('[-id ad_ldap.uk.ibm.com -name Group -objectClasses group -searchBases "ou=groups,dc=uk,dc=ibm,dc=com" -searchFilter (ObjectCategory=Group)]')

Enable Login if AD is down

AdminTask.updateIdMgrRealm('[-name defaultWIMFileBasedRealm -allowOperationIfReposDown true]')

Save and Synchronise

AdminConfig.save()
AdminNodeManagement.syncActiveNodes()

Restart Deployment Manager and Node Agent

/home/wasadmin/stopManager_PC.sh
/home/wasadmin/stopNode_PC.sh
/home/wasadmin/startManager_PC.sh
/home/wasadmin/startNode_PC.sh

Validate Users/Groups

/opt/ibm/WebSphereProfiles/Dmgr01/bin/wsadmin.sh -lang jython -host `hostname`.uk.ibm.com -port 8879 -user wasadmin -password p455w0rd

print AdminTask.searchGroups(["-cn *"])

cn=developers,o=defaultWIMFileBasedRealm
cn=administrators,o=defaultWIMFileBasedRealm
cn=wasadministrators,ou=groups,dc=uk,dc=ibm,dc=com

print AdminTask.searchUsers(["-cn *"])

cn=ad_ldap_bin,ou=users,dc=uk,dc=ibm,dc=com
cn=wasuser1,ou=users,dc=uk,dc=ibm,dc=com
cn=wasuser2,ou=users,dc=uk,dc=ibm,dc=com
uid=deAdmin,o=defaultWIMFileBasedRealm
uid=wasadmin,o=defaultWIMFileBasedRealm

Note - entries highlighted in bold are from AD, rest are from WAS File-Based Registry 

The job, as Andy Garratt would say, is a good 'un.

at 1 comment:

Solved - iTunes Library cannot be saved (Error -54)

I saw this exception: -

iTunes Library cannot be saved (Error -54)

whilst attempting to backup my iPhone 5S using iTunes 11.4 on the Mac ( OS X Mavericks 10.9.5 ).

Google, as almost always, led me to the answer: -

...
I've already solved the issue, through repairing disk permissions.  (Applications>Disk Utility>Repair Permissions)
...


In order to achieve this, I rebooted the Mac into, effectively, single-user mode ( known as Recovery Mode ).

Source: OS X Recovery
Source: OS X: About OS X Recovery

This is achieved by rebooting and, as soon as one hears the bong of life, holding down [cmd] and [r].

Once rebooted, one can access a limited subset of tools, including Terminal, Restore from Time Machine and, most importantly, Disk Utility.

DU allowed me to mount my disk ( note that this requires one to enter the OS X log in password to unlock/decrypt the disk, assuming that one is using FileVault2 for full-disk encryption ).

Once done, I was able to: -
  • Verify and Repair Disk
  • Verify and Repair Permissions
To be safe, I did BOTH, several times.

Once I rebooted into normal multi-user mode, I re-opened iTunes ( the 5S was still connected ) and was able to do a full backup without exception.

For the record, I do backup the 5S locally rather than to the cloud .....

I then further backup ITunes to various external USB drives, with/out Time Machine.

Which is nice .....
at No comments:

Thursday, 2 October 2014

No longer ShellShocked - Bash updated on Mac OS X

Well, I'm pleased to say that my Mac is no longer vulnerable to the so-called #ShellShock issue.

I downloaded this: -



This is before: -

echo $SHELL

/bin/bash

/bin/bash -version

GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.

and this is after: -

/bin/bash -version

GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.

which is nice :-)
at No comments:
Subscribe to: Posts (Atom)

Note to self - Firefox and local connections

 Whilst trying to hit my NAS from Firefox on my Mac, I kept seeing errors such as:- Unable to connect Firefox can’t establish a connection t...