How to Kill a Terminal Services Session from the Command Line
- Open a CMD prompt
- To query for current sessions, type:
- qwinsta.exe /server:<servername>
- To kill a session, type:
- rwinsta.exe /server:<servername> <session id>
|
||||||||||||||||||||||||||||
|
How to Disable CRL Checking in IIS 6.x:
To query to see if the CertCheckMode is already set or not, you can run one of the following commands:
IIS 7.5 – uploadReadAheadSizeA developer recently reported a problem that when a customer attempted to upload an attachment, they would sometime receive the error:The page was not displayed because the request entity is too large.In our case it did not include an error number, but it will sometimes include the error number:
HTTPS 413 The fix for us is listed below: How to set the uploadReadAheadSize in IIS 7.5
1. uploadReadAheadSizeIn the second scenario, the error occurred because of the size of the page, it is very large and it caused to request entry body become larger when you submitting the page.http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/7e0d74d3-ca01-4d36-8ac7-6b2ca03fd383.mspx?mfr=true Basically, what happens is if you have a website with SSL and “Accept Client Certificates” enabled HTTP requests are limited to the UploadReadAheadSize of the site. To resolve this, you have to increase the  Collapse | Copy Codeappcmd.exe set config -section:system.webserver/serverruntime /uploadreadaheadsize: 1048576 /commit:apphost
2. maxReceivedMessageSizeWCF by default limits messages to 64KB to avoid DOS attack with large message. By default, it sends byte[] as base64 encoded string and it increases the size of the message (33% increase in size). There for if the uploaded file size is ~larger than 48KB then it raises the above error. (48KB * 1.33 = ~64KB) (NB. you can use MTOM – Message Transmission Optimization Mechanize to optimize the message) By modifying the “ Collapse | Copy Code<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding maxReceivedMessageSize="10485760">
<readerQuotas ... />
</binding>
</basicHttpBinding>
</bindings>
</system.serviceModel>
#!/bin/ksh
#
# Set you environment here [ACC,FOP,PRD]
ENV=FOP
# Set your company name here
COMP=WARMETAL
#
# APP_HOME setting
APP_HOME=/opt/sft/${COMP}-${ENV}
# Change here the WAS userid, WAS group and sid if necessary
WAS_USER=wasuser
WAS_GROUP=wasgroup
WAS_PROCESSES="dmgr nodeagent Front_Server Security_Server APP_Server JMS_Server"
WAS_CELL="${COMP}-${ENV}.cell"
WAS_NODE_EB="${COMP}-${ENV}.AppSrv.node"
WAS_NODE_FE="${COMP}-${ENV}.AppSrv.node"
# Change the location of the directory in this variable of the WAS :
WAS_HOME=/opt/IBM/WebSphere/AppServer
WAS_BASE_HOME=/opt/sft/${COMP}-${ENV}/WAS_Profiles/${COMP}-${ENV}.AppSrv
WAS_BASE_DATA=/var/data/${COMP}-${ENV}/WAS
WAS_BASE_LOG=/var/log/${COMP}-${ENV}/WAS
WAS_BASE_DUMP=/var/dump/ibm/websphere/6.1/BASE
# Change the location of the directory in this variable of the WAS_ND :
WAS_ND_HOME=/opt/sft/${COMP}-${ENV}/WAS_Profiles/${COMP}-${ENV}.dmgr
WAS_ND_DATA=/var/data/${COMP}-${ENV}/WAS_ND
WAS_ND_LOG=/var/log/${COMP}-${ENV}/WAS_ND
WAS_ND_DUMP=/var/dump/${COMP}-${ENV}/WAS_ND
# Essential Homes
WAS_UPDATE_INSTALLER_HOME=/opt/IBM/UpdateInstaller
WAS_IHS_HOME=/opt/IBM/HTTPServer
BACKUPFILEND=${WAS_ND_DUMP}/wasbck_`date +%Y%m%d%H%M`.zip
BACKUPFILEBASE=${WAS_BASE_DUMP}/wasbck_`date +%Y%m%d%H%M`.zip
case "$1" in
start )
echo "Starting the Network Deployment Manager"
su - $WAS_USER $WAS_ND_HOME/bin/startManager.sh
echo "Starting the Node"
su - $WAS_USER $WAS_BASE_HOME/bin/startNode.sh
for server in Front Security APP JMS; do
echo "Starting server $server"
su - $WAS_USER ${ALLSHARE_HOME}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin/startServer.sh ${server}_Server
done
su - $WAS_USER ${ALLSHARE_HOME}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin/startServer.sh Monitoring_server
;;
stop )
echo "Stopping the Network Deployment Manager"
su - $WAS_USER $WAS_ND_HOME/bin/stopManager.sh
echo "Stopping the Node"
su - $WAS_USER $WAS_BASE_HOME/bin/stopNode.sh -stopservers
su - $WAS_USER ${ALLSHARE_HOME}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin/stopServer.sh Monitoring_server
;;
start-node )
echo "Starting the Node"
su - $WAS_USER $WAS_BASE_HOME/bin/startNode.sh
;;
stop-node )
echo "Stopping the Node"
su - $WAS_USER $WAS_BASE_HOME/bin/stopNode.sh -stopservers
su - $WAS_USER ${APP_HOME}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin/stopServer.sh Monitoring_server
;;
start-dmgr )
echo "Starting the Network Deployment Manager"
su - $WAS_USER $WAS_ND_HOME/bin/startManager.sh
;;
stop-dmgr )
echo "Stopping the Network Deployment Manager"
su - $WAS_USER $WAS_ND_HOME/bin/stopManager.sh
;;
start-all )
for server in JMS APP Security Front; do
echo "Starting server $server"
su - $WAS_USER ${APP_HOME}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin/startServer.sh ${server}_Server
done
su - $WAS_USER ${APP_HOME}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin/startServer.sh Monitoring_server
;;
stop-all )
for server in Front Security APP JMS; do
echo "Stopping server $server"
su - $WAS_USER ${APP_HOME}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin/stopServer.sh ${server}_Server
done
;;
backup )
for profile in dmgr AppSrv; do
su - $WAS_USER ${APP_HOME}/WAS_Profiles/${COMP}-${ENV}.${profile}/bin/backupConfig.sh \
/var/backup/${COMP}-${ENV}/was/was-config-${profile}-`date +%Y%m%d`.zip \
-nostop \
-logfile /var/backup/${COMP}-${ENV}/was/was-config-${profile}-`date +%Y%m%d`.log \
-profileName ${COMP}-${ENV}.${profile}
done
;;
restore )
if [ -f /var/backup/${COMP}-${ENV}/was/was-config-dmgr-${2}.zip -a -f /var/backup/${COMP}-${ENV}/was/was-config-AppSrv-${2}.zip ]; then
for profile in dmgr AppSrv; do
su - $WAS_USER /opt/sft/${COMP}-${ENV}/WAS_Profiles/${COMP}-${ENV}.${profile}/bin/restoreConfig.sh \
/var/backup/${COMP}-${ENV}/was/was-config-${profile}-`date +%Y%m%d`.zip \
-logfile /var/backup/${COMP}-${ENV}/was/was-config-${profile}-`date +%Y%m%d`.log \
-profileName ${COMP}-${ENV}.${profile}
done
else
if [ ! "$2" = "" ]; then
echo "Cannot find or read (all) backup files, searching for:"
echo /var/backup/${COMP}-${ENV}/was/was-config-dmgr-${2}.zip
echo /var/backup/${COMP}-${ENV}/was/was-config-AppSrv-${2}.zip
echo
else
echo "Please specify the date (YYYYMMDD) to restore as argument"
echo "Available dates currently under backup:"
ls -1 /var/backup/${COMP}-${ENV}/was/was-config-*.zip | awk -F - '{ print $5 }' | \
sed 's/.zip//g' | sort | uniq
echo
fi
exit 1
fi
;;
status )
for i in $WAS_PROCESSES; do
unset pid
pid=`ps -ef|grep $i| grep $i|grep -v grep|awk '{ print $2 }'`
if [[ "$pid" = "" ]] then
echo "WAS subprocess $i is stopped..."
echo
exit 0
else
echo "WAS subprocess $i is running using processed $pid"
fi
done
echo
exit 1
;;
info )
# WAS instance information, version, etc...
echo "Information of the Deployment Manager"
su - $WAS_USER ${WAS_ND_HOME}/bin/versionInfo.sh
echo
echo "Information of AppSrv Node"
su - $WAS_USER ${WAS_BASE_HOME}/bin/versionInfo.sh
echo
echo "Information of Dmgr Node"
su - $WAS_USER ${WAS_ND_HOME}/bin/versionInfo.sh
echo
echo "Information of Update Installer"
su - $WAS_USER ${WAS_UPDATE_INSTALLER_HOME}/bin/versionInfo.sh
;;
plugin )
echo "Regenerating the plugin for the HTTP Server"
su - $WAS_USER ${WAS_HOME}/bin/GenPluginCfg.sh -cell.name $WAS_CELL -node.name $WAS_NODE_FE
;;
env )
$0 status
if [[ "$?" = "1" ]] then
for i in $WAS_PROCESSES; do
echo "********* $i *********"
pid=`ps -ef|grep $i|grep -v grep | awk '{ print $2 }'`
ps ewww $pid | tr ' ' '\012' | grep = | sort
echo
echo
done
else
echo "WAS not available, exiting.."
exit 1
fi
;;
* )
echo
echo "Usage: $0 COMMAND"
echo "---------------------------"
echo "start - Start dmgr, node-agent and the application servers"
echo "stop - Stops dmgr, node-agent and the application servers"
echo
echo "start-dmgr - Starts the Deployment Manager"
echo "stop-dmgr - Stops the Deployment Manager"
echo
echo "start-node - Starts the local node-agent"
echo "stop-node - Stops the local node-agent and all appservers"
echo
echo "start-all - starts all application servers"
echo "stop-all - stops all application servers"
echo
echo "backup - Creates online backup of complete cell"
echo "restore - Restores offline backup of complete cell using date YYYYMMDD"
echo
echo "status - Server stopped/started state"
echo "plugin - regenerate webserver plugin"
echo "info - Show server configuration"
echo "env - Shows environment variables set for WebSphere configuration"
echo
exit 1
esac
WebSphere Console LDAP AuthenticationThis is an howto on how to get the WebSphere Integrated Solutions Console to authenticate administrators through LDAP, in our case Microsoft’s Active Directory 2008. This is installed with Windows Server 2008 and Active Directory. OverviewBy default, when WebSphere gets installed everybody can access the WebSphere portal because there is no security. This is how the portal looks like:
As you can see, the console can be reached with this url: http://fqdn-of-server:9060/ibm/console And as you can see as well, there’s no password field. Now we want secured access to the console, and we want to centrally administrate the users who will access the console. To do so, we have to follow these steps:
After securing the console will be reachable on this url: https://fqdn-of-server:9043/ibm/console PrerequisitesBefore the above setup can be configured we first have to create the groups on which WebSphere Roles can be associated:
For more information about the WebSphere Roles see the resources below. BackupCreate a backup of the existing configuration. See the WebSphere Management Script for more information on how to do that. Enable Administrative SecurityFollow these steps to enable administrative security:
Configure Federated RepositoriesIn the same page as for the previous section, follow these steps to configure Federated Repositories:
Now configure the repositories, starting with the InternalFileRepository and than AD-LDAP. Configure the InternalFileRepository
Configure a LDAP RepositoryIn the same page as before click “Manage repositories” to start configuring the LDAP repository:
The configuration now looks like this:
Configure Federated Repositories IINow go back to the “Federated repositories” page to add the LDAP repository to the realm:
Now the federated repositories look like this:
Set up Administrative Group RolesBefore we can setup Administrative Group Roles we first have to enable WebSphere to access the just created LDAP repository. To do so, we have to restart the WebSphere console. Since the console is part of the deployment manager you can restart the deployment manager. See the WebSphere Management Script for more information on how to do that. After restart, you can login, but you’ll need to login with the configured local account:
After logging in expand the “Users and Groups” section and click “Administrative Group Roles” to start granting roles:
Now the “Administrative Group Roles” look like this:
root@aix:/opt/sft/${COMP}-${ENV}/WAS_Profiles/${COMP}-${ENV}.AppSrv/bin>syncNode.sh localhost
[11/5/10 11:44:58:890 GMT+01:00] 00000034 MBeanHelper ...<cut>... ADMN0022E: Access is denied for the stop operation on Server MBean because of insufficient or empty credentials. TestI added myself to the WebSphereReadOnly group and when I logged in to the WebSphere Console the control buttons for stopping and starting the application server were gone. Then I added myself to the WebSphereAdministrators group and it worked: ADMN1020I: An attempt is made to stop the Monitoring_server server. (User ID = defaultWIMFileBasedRealm/ldapsjoerd) Then I tried to stop the application servers from the commandline, and also here was authentication required. I gave incorrect credentials when stopping the last application server. As you can see, the stopping of all application servers was successful, except for the last one: Stopping server Front
ADMU0116I: Tool information is being logged in file
../logs/Front_Server/stopServer.log
ADMU0128I: Starting tool with the AppSrv profile
ADMU3100I: Reading configuration for server: Front_Server
Realm/Cell Name: <default>
Username: ldapsjoerd
Password:
ADMU3201I: Server stop request issued. Waiting for stop status.
ADMU4000I: Server Front_Server stop completed.
Stopping server JMS
ADMU0116I: Tool information is being logged in file
../logs/JMS_Server/stopServer.log
ADMU0128I: Starting tool with the AppSrv profile
ADMU3100I: Reading configuration for server: JMS_Server
Realm/Cell Name: <default>
Username: test
Password:
ADMU0111E: Program exiting with error: javax.management.JMRuntimeException:
ADMN0022E: Access is denied for the stop operation on Server MBean
because of insufficient or empty credentials.
ADMU4113E: Verify that username and password information is correct. If
running tool from the command line, pass in the correct -username
and -password. Alternatively, update the <conntype>.client.props
file.
ADMU1211I: To obtain a full trace of the failure, use the -trace option.
ADMU0211I: Error details may be seen in the file:
../logs/JMS_Server/stopServer.log
MonitoringAfter setting up security, and when running monitoring add authentication information to the monitor. See below for required information (which can all be found inside the node and application server configuration):
You can check the service by going to this url: http://ndhost.company.local:9030/wasPerfTool/servlet/perfservlet?connector=SOAP&port=8879&host=ndhost.company.local&username=test&password=xxxxxxxx TroubleshootingLogging as defined user works, but not through group membershipIf you can login using a user defined in the user roles, but not as a user who is defined a member of a group defined in group roles, select the “ignore case for authorization” in the federated repositories configuration. This is why:
Define configuration parameters for Microsoft Active Directory to provide extra security options for your environment. Before you beginBefore setting configuration parameters, perform authentication tests to confirm that user, group, and membership search filters work properly. For more information, see the Related tasks section. You must be assigned the Security administration role with permission to Manage security (Full permission) to perform these steps. About this taskYou might need to modify the example search parameters in the following steps to match your LDAP server schema. You can use the system console, the command line interface, or the REST API to complete this task. For the command line and REST API information, see the Related information section. Procedure
Problem(Abstract)In a WebSphere Application Server cell where Global Security is enabled, you may want to disable security for individual application servers, for example, when you run some applications that can be accessed anonymously, while others require authentication. This can be done either from the Application Server Administrative Console or using wsadmin. Resolving the problemSolution using Administrative Console:
Solution using wsadmin:
The result of both solutions described above (Administrative Console and wsadmin), is a separate security.xml file for server1 containing security enabled=’false’. Remark: WebSphere Global Security OFFThis is a massive pain, WAS 6.1 is failing with my new SSL certs with larger (2048) size keys. No matter how perfectly configured my Node Default Trust Store looks with it’s happy Signer Certificate, the SSL connection still fails.
I changed a setting to do with SSL – I knew that was a bad idea! Server won’t let me back in the console, time to turn off security. To disable global security either edit the security.xml file or use the wsadmin tool. $WAS_HOME\config\cells\cellname\security.xml Using WAS command-line client wsadmin (run with was user or root privileges): 2. Turn off global security 3. Save
Using wsadmin to enable an LDAP Federated Repository in WebSphere Application Server 8.5This article is somewhat of an aide memoire for me, allow me to remember how to enable WebSphere Application Server to talk to an LDAP server, without needing to use a GUI 🙂 I pulled this together using my own WAS 8.5 VM running on RHEL 6.3, as ever, and a remote LDAP ( albeit IBM Tivoli Directory Server rather than Microsoft Active Directory ).
Start wsadmin client
$ cd /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin
$ ./wsadmin.sh -lang jython
List existing repositories
wsadmin> AdminTask.listIdMgrRepositories()
should return: –
‘{InternalFileRepository={repositoryType=File, host=LocalHost}}’
Configure the Administrative User Registry ( assume that we’re keeping the WAS admin in file-based registry )
wsadmin> AdminTask.configureAdminWIMUserRegistry(‘[-realmName defaultWIMFileBasedRealm -verifyRegistry false ]’)
Add the LDAP server
wsadmin> AdminTask.createIdMgrLDAPRepository(‘[-default true -id LDAP1 -adapterClassName com.ibm.ws.wim.adapter.ldap.LdapAdapter -ldapServerType IDS -sslConfiguration -certificateMapMode exactdn -supportChangeLog none -certificateFilter -loginProperties uid]’)
wsadmin> AdminTask.addIdMgrLDAPServer(‘[-id LDAP1 -host bluepages.ibm.com -port 389 -bindDN uid=8817222GB,c=gb,ou=bluepages,o=ibm.com -bindPassword passw0rd! -referal ignore -sslEnabled false -ldapServerType IDS -sslConfiguration -certificateMapMode exactdn -certificateFilter]’)
wsadmin> AdminTask.updateIdMgrLDAPRepository(‘[-id LDAP1 -loginProperties [“”]]’)
wsadmin> AdminTask.updateIdMgrLDAPRepository(‘[-id LDAP1 -adapterClassName com.ibm.ws.wim.adapter.ldap.LdapAdapter -ldapServerType IDS -sslConfiguration -certificateMapMode exactdn -certificateFilter -supportChangeLog none -loginProperties uid]’)
Add the Base Entries
wsadmin> AdminTask.addIdMgrRepositoryBaseEntry(‘[-id LDAP1 -name o=ibm.com -nameInRepository o=ibm.com]’)
wsadmin> AdminTask.addIdMgrRealmBaseEntry(‘[-name defaultWIMFileBasedRealm -baseEntry o=ibm.com]’)
Validate the Admin Name ( wasadmin in file-based registry )
wsadmin> AdminTask.validateAdminName(‘[-registryType WIMUserRegistry -adminUser wasadmin ]’)
Enable Global Security and set Federated Repositories to be default
wsadmin> AdminTask.setAdminActiveSecuritySettings(‘[-activeUserRegistry WIMUserRegistry -enableGlobalSecurity true]’)
Set the LDAP search filters
wsadmin> AdminTask.updateIdMgrLDAPEntityType(‘[-id LDAP1 -name PersonAccount -objectClasses inetOrgPerson -searchBases ou=bluepages,o=ibm.com -searchFilter ]’)
Save changes
wsadmin> AdminConfig.save()
Validate changes
wsadmin> AdminTask.listIdMgrRepositories()
should return: –
‘{InternalFileRepository={repositoryType=File, host=LocalHost}, LDAP1={repositoryType=LDAP, specificRepositoryType=IDS, host=bluepages.ibm.com}}’
wsadmin> AdminTask.listIdMgrRepositoryBaseEntries(‘[-id LDAP1]’)
should return: –
‘{o=ibm.com=o=ibm.com}’
    Cause The cause of this problem is that the plug-in keystore does not have the correct SSL signer certificate to match with the SSL personal certificate from the WebSphere Application Server node. Resolving the problem Environment Often the Plug-in keystore (plugin-key.kdb) on the WebSphere Application Server side does NOT contain the necessary SSL signer certificates yet, so you need to find the correct signer certificate from the WebSphere Node and add it as a Signer certificate to the Plug-in CMS keystore, then copy the plugin-key.kdb file to the web server system. NOTE: The plug-in keystore must contain the Signer Certificates for every WebSphere Node in the cell. So, if your cell has multiple WebSphere Nodes, you will need to repeat steps 1-19 for each one. Here are the exact steps to use in the WebSphere Application Server administrative console: Click on the WebSphere Application Server node (NodeDefaultSSLSettings). Click on Key stores and certificates on the right side. Click on NodeDefaultKeyStore. Click on Personal certificates on the right side. You will see a chained certificate. The personal certificate is the first one in the chain. The signer certificate is the second one in the chain. Look at the CN in the signer certificate. Also look at the serial number of the signer certificate.
Note: That is the exact signer certificate that you need to use. Go back to the Key stores and certificates page. Click on NodeDefaultTrustStore. Click on Signer certificates on the right side. Find the signer certificate with the match CN and serial number from above, and check the box next to it. Click Extract. Note: That is the exact signer certificate that you need to use. Go back to the Key stores and certificates page. Click on NodeDefaultTrustStore. Click on Signer certificates on the right side. Find the signer certificate with the match CN and serial number from above, and check the box next to it. Click Extract. Enter a temporary path and filename (for example: /tmp/nodeRootSigner.arm). Click OK. Go back to the Manage endpoint security configurations page. Find the node which contains the web server definition. You will need to look inside the node and look inside the servers folder to find the web server (for example: webserver1). Click on the web server name. Click on Key stores and certificates on the right side. Click on CMSKeyStore (this is a link to the plugin-key.kdb file). Click on Signer certificates. Click Add. Enter an Alias like “NodeRootSigner”, and enter the path and filename from step 7 (for example: /tmp/nodeRootSigner.arm). Click OK. Enter a temporary path and filename (for example: /tmp/nodeRootSigner.arm). Click OK. Go back to the Manage endpoint security configurations page. Find the node which contains the web server definition. You will need to look inside the node and look inside the servers folder to find the web server (for example: webserver1). Click on the web server name. Click on Key stores and certificates on the right side. Click on CMSKeyStore (this is a link to the plugin-key.kdb file). Click on Signer certificates.
Click the Save link to save the changes. Now go to Servers > Server Types > Web servers. Click on the web server name in the list (for example: webserver1). Click on Plug-in properties. Click Copy to Web server key store directory. If the button is disabled, you will need to locate the plugin-key.kdb file on the deployment manager system, and copy it to the web server system into the Plugins/config/web_server directory. Where “webserver” is the name of the web server (for example: webserver1). Click Add. Enter an Alias like “NodeRootSigner”, and enter the path and filename from step 7 (for example: /tmp/nodeRootSigner.arm). Click OK
Determining if ip address is already in use for device eth0. how to fix the issue RHEL FEDORA CENTOS [ OK ] lo Link encap:Local Loopback ADD ARPCHECK=no [root@cluster3 ~]# vi /etc/sysconfig/network-scripts/ifcfg-eth0 |
||||||||||||||||||||||||||||
|
Copyright © 2025 - All Rights Reserved Powered by WordPress & Atahualpa |
||||||||||||||||||||||||||||
Recent Comments