How to connect to Vcenter/ESXi Server

First you have to connect to the vmware server. It can be a ESXi server or a Vcenter

PowerCLI C:\> Connect-VIServer

It will prompt the server address.

cmdlet Connect-VIServer at command pipeline position 1
Supply values for the following parameters:
Server[0]:

Enter the IP address and hit ENTER

Then a new window will prompt from authentication credentials of the VMware server

Export VM list

Once you connected to the server, you can run VM commands to get the output, Following script will give you a list of guest servers with Name of the virtual machine, Number of CPU, Memory, Disk Space

Get-VM | Select-Object Name, NumCPU, MemoryMB, ProvisionedSpaceGB | Export-Csv "Report.csv"

Find the list of List of VM Property Names here.  you can use this names after “select-object” . separated by comma

Use “out-gridview” instead of “Export-Csv“ to get a sample output. See the figure

PowerState              : Power State
 Version                 : v7
 Description             :
 Notes                   :
 Guest                   : WEB-Server-01:CentOS 4/5 (64-bit)
 NumCpu                  : 1
 MemoryMB                : 4096
 HardDisks               : {Hard disk 1}
 NetworkAdapters         : {Network adapter 1}
 UsbDevices              : {}
 CDDrives                : {CD/DVD Drive 1}
 FloppyDrives            : {Floppy drive 1}
 Host                    : vm01
 HostId                  : HostSystem-host-248
 VMHostId                : HostSystem-host-248
 VMHost                  : vm01
 VApp                    :
 FolderId                : Folder-group-v264
 Folder                  : Production
 ResourcePoolId          : ResourcePool-resgroup-247
 ResourcePool            : Resources
 PersistentId            : 502b8ac0-d052-d637-980d-1e52c6f54340
 UsedSpaceGB             : 40
 ProvisionedSpaceGB      : 40
 DatastoreIdList         : {Datastore-datastore-395}
 HARestartPriority       : ClusterRestartPriority
 HAIsolationResponse     : AsSpecifiedByCluster
 DrsAutomationLevel      : AsSpecifiedByCluster
 VMSwapfilePolicy        : Inherit
 VMResourceConfiguration : CpuShares:Normal/1000 MemShares:Normal/20480
 Name                    : WEB-Server-01
 CustomFields            : {}
 ExtensionData           : VMware.Vim.VirtualMachine
 Id                      : VirtualMachine-vm-407
 Uid                     : /VIServer=root@192.168.1.1:443/VirtualMachine=Virt
 ualMachine-vm-407/

Configuring Foundry Switch for LACP

in example we are using ports 1/1 to 1/4 and Vlan 100. Configure your device according to  your port configurations and Vlan names.

lag <lag name> static
port e 1/1 to 1/4
primary-port e 1/1

To assign a Vlan to the teamed Ethernet ports go to the VLAN interface, and tag the ports which you want to add the vlan

Vlan 100
tagged e 1/1

Configuring Virtual Switch on ESXi Server

Do following steps to configure vSwitch properties for load balancing:
Open your vSphere and connect to ESXi or VCenter.
1.    Click the ESX host.
2.    Click the Configuration tab.
3.    Click the Networking link.
4.    Click Properties.
5.    Click the virtual switch in the Ports tab and click Edit.
6.    Click the NIC Teaming tab.
7.    From the Load Balancing dropdown, choose Route based on ip hash.
8.    From the Network Failover Detection  dropdown, choose Link Status Only

Here is the command to Backup ESXi server configuration to your local computer. You should have access to the ESXi server using  vSphere CLI tool. This will help administrator to schedule ESXi backup using Scripts. Download vSphere CLI tool from here. Open the CLI console and run following command.

Tool located at C:\Program Files (x86)\VMware\VMware vSphere CLI>

vicfg-cfgbackup.pl  --server 192.168.0.1  --username root
--password your_password --save backup.cfg

Possible Errors:

CLI Error :  Saving firmware configuration to backup.cfg …
GET https://192.168.0.1/downloads/configBundle-servername..tgz unsuccessful : 404 Not
Found

Event log : Boot partition : /usr/lib/vmware/hostd/docroot/downloads//files cannot be found

Solution :

/usr/lib/vmware/hostd/docroot/downloads is only a link to /scratch/downloads/

and /scratch is link to /tmp/scratch

Problem will be solved after create a folders under /tmp

SSH to ESXi Server

cd /tmp
mkdir scratch
cd scratch
mkdir downloads
cd downloads

How to restore

We are using same command to restore also, Use –load (-l) syntax instead of –save
While restore all the guest machines should in off state. Command will give a message to shutdown all the gust VMs. ESXi will go to maintenance mode and restore the configuration and reboot the server.

vicfg-cfgbackup.pl  --server 192.168.0.1  --username root
--password your_password --load backup.cfg

1. Open your Xen – Center
2. Go to the server which you want to start automatically
3. Take the properties
4. Go to Start-up Options
5. Put the tick mark on “Auto-start on Server boot”

By default HFS application is listening TCP port 80. You can change if you are already using this port for some other application. Read this  article if you have port conflicts. HFS is supported by Wine, so linux users can use the advantage of HFS. Inbuilt DNS updater is one of the interesting features of HFS. So that you can configure your DynDNS account with HFS and assign public domain name for your file server. It is helpful for internet connections with dynamic IP address.

You can see connected users in  the application bottom panel. Full control over connected users in terms of bandwidth and access list. It will also log the IP address of connected users.

Download :  HFS

We have explained the command to reset the remote desktop connections from a windows 7 PC,  As you know windows RDP client will give an error if multiple users are connected through terminal service. Its including console access. In critical situations we have to accrue the session. There are two ways to reset the remote desktop connection. The first method is using an GUI application called Terminal service manager ( Run tsadmin) Here we explained the usage of tsadmin.

How to disconnect remotely logged users of remote desktop

First you have to get access to the target server, If you are in same domain you have access to the server. Or you can gain access by mapping a drive to local computer.

Eg : net use x: \\192.168.0.1\c$

Here i am using 192.168.0.1 as example IP, replace it with your IP

Open command prompt, and run

qwinsta /server:192.168.0.1

you can see the session IDs in the list, find the ID number which you want to reset

then run command

rwinsta /server:192.168.0.1 4

Here 4 is the session ID

Now the session will be cleared and you can access the server

Microsoft has released the first service pack (Final release) for Windows 7. It is a collection of all previous updates. It is also includes client side support for RemoteFX and Dynamic Memory for Windows 7 VMs. Windows 7 and Windows Server 2008 R2 SP1 helps keep your PCs and servers on the latest support level. Both 64 bit and 32 bit service pack size is about 1GB. If you are facing any problem after installing service pack, you can uninstall it completely. Find this article about How to Uninstall Windows 7 Service Pack 1

Microsoft download page  : Link

Direct download links :

windows6.1-KB976932-X64.exe

windows6.1-KB976932-X86.exe

Reason

The reason of Java not working in IE9 is because the Java applets has been blocked by ActiveX Filtering, it is a new feature in IE9.the solution is to temporarily turn off ActiveX Filtering.

1) How to Enable Activex filtering -> Go to Tools option in IE9 Click on Activex Filtering, the tick in front of the option will disappear. It means the option is disabled. If it is not there the option is already disabled.

If you enabled the java loading in IE9, you may encounter a problem that the java causes the web page to crash. We can stop this problem also, to enable the compatibility view option in IE9. If you enabled Compatibility option then add which address you need to option that contained java applet.

2) How to Enable Compatibility view in IE9 -> Go to Tools  and click on Compatibility view settings option, click add button and add the web site.
To remove a website from Compatibility view, just go back to Compatibility View Settings, and remove the site from the Compatibility View list.

We already covered some topics in earlier articles some of them are linked here.

Here are some tips for servers hardening ( Some already mentioned in my previous posts)

1) Removing Unnecessary Software Packages (RPMs)

An administrator should be crystal clear about the primary function or role of the Linux server also should know what is on the server.Therefore, it is very critical to look at the default list of software packages and remove unneeded packages.

To get a list of all installed RPMs you can use the following command:

rpm -qa

Remove the unneeded packages from the list.

2) Disabling Run level System Services

In  Linux servers, some services are enabled to start at boot up by default.
it is safe to disable all services that are not needed as they are risks security and waste of hardware resources. Read more.

3) Reviewing Inittab and Boot Scripts

The inittab file /etc/inittab also describes which processes are started at bootup and during normal operation. For example, Oracle uses it to start cluster services at bootup. Therefore, it is recommended to ensure that all entries in /etc/inittab are legitimate in your environment.

I would at least remove the CTRL-ALT-DELETE trap entry to prevent accidental reboots:

The default runlevel should be set to 3 since in my opinion X11 (X Windows System) should not be running on a production server. In fact, it shouldn’t even be installed.

# grep ':initdefault' /etc/inittab
id:3:initdefault:

To have changes in /etc/inittab become effective immediately, you can run:

# init q

4) Securing SSH

Ssh is a great protocol and as it name stands for Secure SHell its secure but its prone to attacks with basic configuration. There are ways to make ssh even more secure than it is now.Read more

5) SSH login without passwords

Automated authentication onto server using RAS key authenticating mechanism . Read more

6) Kernel Tuning

Following are some tunable kernel parameters you can use to secure your Linux server against attacks .We need to add these entries inside /etc/sysctl.conf configuration file to make the change permanent after reboots.To activate the configured kernel parameters immediately at runtime, use:

#sysctl -p

Disable IP Source Routing

net.ipv4.conf.all.accept_source_route = 0

Disable ICMP Redirect Acceptance

net.ipv4.conf.all.accept_redirects = 0

Enable Ignoring Broadcasts Request

net.ipv4.icmp_echo_ignore_broadcasts = 1

Enable Bad Error Message Protection

net.ipv4.icmp_ignore_bogus_error_responses = 1

Enable Logging of Spoofed Packets, Source Routed Packets, Redirect Packets

net.ipv4.conf.all.log_martians = 1

The above mentioned are only few steps for harding . There are many more steps like providing strong password , locking user accounts after too many login failures , restricting use of previous used passwords , setting banners etc.

Hardening five or six servers can be done quite easily at a stretch but when the number of servers increases it just becomes tiresome and time consuming . So why don’t we think about a running a script that does all the hardening jobs and there wont be any waste of time. The script presented can be customized according to the requirement.

#!/bin/bash
chkconfig autofs off
chkconfig avahi-daemon off
chkconfig avahi-dnsconfd off
chkconfig bluetooth off
chkconfig conman off
chkconfig cups off
chkconfig dhcdbd off
chkconfig firstboot off
chkconfig gpm off
chkconfig haldaemon off
chkconfig isdn off
chkconfig iptables off
chkconfig ip6tables off
chkconfig irda off
chkconfig irqbalance off
chkconfig kdump off
chkconfig kudzu off
chkconfig mcstrans off
chkconfig microcode_ctl off
chkconfig multipathd off
chkconfig netconsole off
chkconfig netfs off
chkconfig netplugd off
chkconfig nfs off
chkconfig nfslock off
chkconfig nscd off
chkconfig pcscd off
chkconfig portmap off
chkconfig rdisc off
chkconfig rhnsd off
chkconfig restorecond off
chkconfig rpcgssd off
chkconfig rpcidmapd off
chkconfig rpcsvcgssd off
chkconfig sendmail off
chkconfig smartd off
chkconfig winbind off
chkconfig wpa_supplicant off
chkconfig xfs off
chkconfig ypbind off
chkconfig yum-updatesd off
chkconfig acpid on
chkconfig anacron on
chkconfig atd on
chkconfig cpuspeed on
chkconfig lvm2-monitor on
chkconfig messagebus on
chkconfig ntpd on
chkconfig network on
chkconfig oracle on
chkconfig oracleasm on
chkconfig readahead_early on
chkconfig readahead_later on
chkconfig syslog on
chkconfig sshd on
cat > /root/banner << EOF
|-----------------------------------------------------------------|
| This system is for the use of authorized users only. |
| Individuals using this computer system without authority, or in |
| excess of their authority, are subject to having all of their |
| activities on this system monitored and recorded by system |
| personnel. |
| |
| In the course of monitoring individuals improperly using this |
| system, or in the course of system maintenance, the activities |
| of authorized users may also be monitored. |
| |
| Anyone using this system expressly consents to such monitoring |
| and is advised that if such monitoring reveals possible |
| evidence of criminal activity, system personnel may provide the |
| evidence of such monitoring to law enforcement officials. |
|-----------------------------------------------------------------|
EOF
cat /root/banner
sed -i 's/id:5:initdefault:/id:3:initdefault:/g' /etc/inittab
sed -i 's/ca::ctrlaltdel:/#ca::ctrlaltdel:/g' /etc/inittab
echo PermitRootLogin no >> /etc/ssh/sshd_config
echo Banner /root/banner >> /etc/ssh/sshd_config
sed -i 's/#AllowTcpForwarding yes/AllowTcpForwarding no/g' /etc/ssh/sshd_config
sed -i 's/#X11Forwarding no/X11Forwarding no/g' /etc/ssh/sshd_config
sed -i 's/X11Forwarding yes/#X11Forwarding yes/g' /etc/ssh/sshd_config
sed -i 's/#StrictModes yes/StrictModes yes/g' /etc/ssh/sshd_config
sed -i 's/#IgnoreRhosts yes/IgnoreRhosts yes/g' /etc/ssh/sshd_config
sed -i 's/#HostbasedAuthentication no/HostbasedAuthentication no/g' /etc/ssh/sshd_config
sed -i 's/#RhostsRSAAuthentication no/RhostsRSAAuthentication no/g' /etc/ssh/sshd_config
service sshd restart
echo net.ipv4.conf.all.accept_source_route = 0 >> /etc/sysctl.conf
echo net.ipv4.conf.all.accept_redirects = 0 >> /etc/sysctl.conf
echo net.ipv4.icmp_echo_ignore_broadcasts = 1 >> /etc/sysctl.conf
echo net.ipv4.icmp_ignore_bogus_error_responses = 1 >> /etc/sysctl.conf
echo net.ipv4.conf.all.log_martians = 1 >> /etc/sysctl.conf
sysctl -p
if [ $(id -u) -eq 0 ]; then
read -p "Enter username : " username
read -s -p "Enter password : " password
egrep "^$username" /etc/passwd >/dev/null
if [ $? -eq 0 ]; then
echo "$username exists!"
exit 1
else
pass=$(perl -e 'print crypt($ARGV[0], "password")' $password)
useradd -m -p $pass $username
[ $? -eq 0 ] && echo "User has been added to system!" || echo "Failed to add a user!"
fi
else
echo "Only root may add a user to the system"
exit 2
fi