Convert Full to Core

Log onto the server with an account that has administrative permissions.

If it isn’t already open, launch the Server Manager console.

From the Server Manager console, click the Manage menu.

Click Remove Roles and Features.

On the Before You Begin screen, click Next.

On the Select Destination Server screen, ensure the server is selected in the server pool, and then click Next.

On the Remove Server Roles screen, click Next

On the Remove Features screen, scroll down the list until you see User Interfaces and Infrastructure and expand it.

Uncheck Graphical Management Tools and Infrastructure and Server Graphical Shell, and then click Next.

On the Confirmation screen, review the changes and then click Remove.

When the removal process completes, click Close. The server will now need to be rebooted. During the reboot phase, the remaining components will be removed. Do not power off the server.

After the server reboots, log back in.

Once you’re logged in, you’ll notice that only a command-prompt window is open. You have successfully removed the graphical interface from Windows Server 2012 R2

Convert Core to Full

Log onto the server with an account that has administrative privileges.
Check to see if any graphical user interface components are installed.
```
Get-WindowsFeature -Name "Server-Gui-Mgmt-Infra","Server-Gui-Shell"
```
The output should look like the following, unless you are running in a minimal install, where only Graphical Management Tools and Infrastructure is installed, giving the admin access to Server Manager in server core.

We can that no components are installed, in the figure above. Now we need to install both of the features listed above.

Install-WindowsFeature -Name "Server-Gui-Mgmt-Infra","Server-Gui-Shell"

When the features are installed, a warning will be displayed telling you that the server must be restarted. Go ahead and restart the server now.

When the server completes the reboot process, log in. You should now have a fully functional graphical user interface presented to you.

dir:/var/audit flags:lo,ad,pc,fc,fd,fm naflags:lo,ad # # lo - login/logout events # ad - administrative actions: mount, exportfs, etc. # pc - process operations: fork, exec, exit, etc. # fc - file creation # fd - file deletion # fm - change of object attributes: chown, flock, etc. #

#!/sbin/sh # # newauditlog.sh - Start a new audit file and expire the old logs # AUDIT_EXPIRE=30 AUDIT_DIR="/var/audit" /usr/sbin/audit -n cd $AUDIT_DIR # in case it is a link /usr/bin/find . $AUDIT_DIR -type f -mtime +$AUDIT_EXPIRE \ -exec rm {} > /dev/null 2>&1 \;

S01MOUNTFSYS S69inet S72inetsvc S74xntpd S80PRESERVE S05RMTMPFILES S71rpc S74autofs S75cron S88utmpd S20sysetup S71sysid.sys S74syslog S75savecore S99audit S30sysid.net

#!/bin/sh # # /etc/init.d/nddconfig # # Fix for broadcast ping bug /usr/sbin/ndd -set /dev/ip ip_respond_to_echo_broadcast 0 # Block directed broadcast packets /usr/sbin/ndd -set /dev/ip ip_forward_directed_broadcasts 0 # Prevent spoofing /usr/sbin/ndd -set /dev/ip ip_strict_dst_multihoming 1 /usr/sbin/ndd -set /dev/ip ip_ignore_redirect 1 # No IP forwarding /usr/sbin/ndd -set /dev/ip ip_forwarding 0 # Drop source routed packets /usr/sbin/ndd -set /dev/ip ip_forward_src_routed 0 # Shorten ARP expiration to one minute to minimize ARP spoofing/hijacking # [Source: Titan adjust-arp-timers module] /usr/sbin/ndd -set /dev/ip ip_ire_flush_interval 60000 /usr/sbin/ndd -set /dev/arp arp_cleanup_interval 60

WARNING: To protect the system from unauthorized use and to ensure that the system is functioning properly, activities on this system are monitored and recorded and subject to audit. Use of this system is expressed consent to such monitoring and recording. Any unauthorized access or use of this Automated Information System is prohibited and could be subject to criminal and civil penalties.

# @(#)ntp.client 1.2 96/11/06 SMI # # /etc/inet/ntp.client # # An example file that could be copied over to /etc/inet/ntp.conf; it # provides a configuration for a host that passively waits for a server # to provide NTP packets on the ntp multicast net. # # Public NTP Server list: http://www.eecis.udel.edu/~mills/ntp/clock1.htm # server clock.llnl.gov

Script to get free/unused memory on Solaris can be found with command vmstat. Without options, vmstat displays a one-line summary of the virtual memory activity since the system was booted. Tested on Solaris 5.8, 5.9, 5.10. Can be wrong on Zones.

Script ./mem_usage.sh

#!/bin/sh
mem_free=`vmstat 1 2 | tail -1 | awk '{print $5}' | tail -1`;
mem_free_in_mb=`echo $mem_free/1024 | bc`;
mem_total_in_mb=`/usr/sbin/prtconf 2>/dev/null | grep Memory | awk '{ print $3 }'`;
mem_usage_in_mb=`echo "$mem_total_in_mb-$mem_free_in_mb" | bc`;
mem_usage_in_per=`echo "$mem_usage_in_mb/($mem_total_in_mb/100)" | bc`;
echo "\tPhysical memory size:\t\t $mem_total_in_mb";
echo "\tMemory usage in MB:\t\t $mem_usage_in_mb";
echo "\tMemory usage in %:\t\t $mem_usage_in_per%";

Output:

# ./mem_usage.sh
        Physical memory size:            768
        Memory usage in MB:              633
        Memory usage in %:               90%

2. Solaris swap usage

Script ./swap_usage.sh

#!/bin/sh
swap_total=`/usr/sbin/swap -l | grep "/" | awk '{ sum+=$4} END {print sum}'`;
swap_free=`/usr/sbin/swap -l | grep "/" | awk '{ sum+=$5} END {print sum}'`;
swap_in_use_per=`echo "($swap_total-$swap_free) / ($swap_total/100)" | bc`;
echo "\tSwap in use:\t\t $swap_in_use_per%";

Output:

# ./swap_usage.sh
        Swap in use:             27%

3. Determine If system is Solaris Zone

#!/bin/sh
if [ -f "/usr/sbin/zoneadm" ]; then
  /usr/sbin/zoneadm list | grep global 1>/dev/null;
  if [ "$?" -ne "0" ]; then
    zone_num=`/usr/sbin/zoneadm list | wc -l | sed 's/ //g'`;
    if [ "$zone_num" = "1" ]; then
      zone_status="Zone";
    fi;
  fi;
fi;
echo "\tSystem is:\t\t $zone_status";

4. Check RAID status metastatus and ZFS

#!/bin/sh
if [ -f "/usr/sbin/metastat" ]; then
  metastatus_ok=`/usr/sbin/metastat 2>/dev/null | grep "State:" | wc -l|sed 's/ //g'`;
  metastatus_err=`/usr/sbin/metastat 2>/dev/null | grep "State:" | grep -v "State: Okay" | wc -l|sed 's/ //g'`;
  if [ "$metastatus_ok" = "0" ] && [ "$metastatus_err" = "0" ]; then
    raid_status="no_meta_raids";
  fi
  if [ "$metastatus_ok" != "0" ] && [ "$metastatus_err" = "0" ]; then
    raid_status="OK";
  fi;
  if [ "$metastatus_err" != "0" ]; then
    raid_status="metastat_Failed";
  fi;
  raid_controller="Software RAID (metastatus)";
else
  raid_status="no_metastatus";
fi;
if [ -f "/usr/sbin/zpool" ]; then
  zfs_exists="ZFS"
  zfs_pools=`/usr/sbin/zpool status -v`;
  zfs_failed=`/usr/sbin/zpool status -v | grep "state:" | grep -v "ONLINE" | wc -l |sed 's/ //g'`;
  if [ "$zfs_pools" = "no pools available" ]; then
    zfs_status="no_zfs_pools";
  else
    if [ "$zfs_failed" != "0" ]; then
      zfs_status="ZFS_Failed";
    else
      zfs_status="OK";
    fi;
  fi;
else
  zfs_status="no_zfs";
fi;
echo "\tRAID Controller:\t $raid_controller, $zfs_exists";
echo "\tRAID Status:\t\t $raid_status, $zfs_status";

5. Get serial number on Solaris

#!/bin/sh
if [ -f "/usr/sbin/sneep" ]; then
  serial=`/usr/sbin/sneep`;
else
  serial=`/usr/sbin/eeprom | grep serial | awk -F= '{ print $2}'`;
fi;
echo "\tSerial:\t\t\t $serial";

6. Get Solaris OS name, version, update level

#!/bin/sh
os_name="`uname -s`";
os_ver="`uname -r`";
if head -1 /etc/release | grep u1 1>/dev/null ; then update_ver="U1"; fi;
if head -1 /etc/release | grep u2 1>/dev/null ; then update_ver="U2"; fi;
if head -1 /etc/release | grep u3 1>/dev/null ; then update_ver="U3"; fi;
if head -1 /etc/release | grep u4 1>/dev/null ; then update_ver="U4"; fi;
if head -1 /etc/release | grep u5 1>/dev/null ; then update_ver="U5"; fi;
if head -1 /etc/release | grep u6 1>/dev/null ; then update_ver="U6"; fi;
if head -1 /etc/release | grep u7 1>/dev/null ; then update_ver="U7"; fi;
if head -1 /etc/release | grep u8 1>/dev/null ; then update_ver="U8"; fi;
if head -1 /etc/release | grep u9 1>/dev/null ; then update_ver="U9"; fi;
if head -1 /etc/release | grep u10 1>/dev/null ; then update_ver="U10"; fi;
if head -1 /etc/release | grep s9_58shwpl3 1>/dev/null ; then update_ver="FCS"; fi;
echo "5CtOS version:\t\t $os_name $os_ver $update_ver";

7. Other

Vendor

#!/bin/sh
vendor=`/usr/sbin/prtconf 2>/dev/null | head -1 | awk '{print $3 " " $4}'`;
echo "\tVendor:\t\t\t $vendor";

Hardware

#!/bin/sh
hw="`uname -i`";
echo "\tHardware:\t\t\t $hw";

Platform 32/64bit

#!/bin/sh
os_bit="`isainfo -kv | awk '{print $1}'`";
echo "\tPlatform:\t\t $os_bit";

NTP stratums

#!/bin/sh
ntp_stratum=`/usr/sbin/ntpq -p 2>/dev/null | awk '{ print $3 }'| tail +3`
ntp_status=`echo $ntp_stratum`;
echo "\tNTP:\t\t\t $ntp_status";

All IP addresses

#!/bin/sh
ip_all="`/sbin/ifconfig -a | grep inet | grep -v 127.0.0.1 | awk '{print $2}'`";
ip_all_one_string="`echo $ip_all`";
echo "\tIP all:\t\t\t $ip_all_one_string";

Root files system usage

#!/bin/sh
fs_root="`df -k | grep "/$" | awk '{print $5}'`";
echo "\tFS ROOT:\t\t $fs_root";

All files systems usage

#!/bin/sh
fs_all=`df -k | grep "/" | grep -v "/$" | grep -v "/proc" | grep -v "/etc/mnttab" | grep -v "/etc/dfs/sharetab" | grep -v "/lib/libc.so.1" | awk '{print $6 " " $5 ","}'`
fs_all_one_string="`echo $fs_all`";
echo "\tFS ALL:\t\t\t $fs_all_one_string";

I’m going to explain how to install an SSL certificate on IHS (IBM HTTP Server).

I have received this request yesterday and today I have struggled with this configuration. So, now if you are in a hurry, I think you can configure an SSL in 5 minutes. So let’s go through the steps:

* TIPS
TIP 1 – Create a .sh script for creating the db, for importing certificates and for receiving the signed key.
TIP 2 – gsk7cmd command supports -Xms1024m -Xmx2048m options for adding extra heap memory to java. This is very usefull because some times you end up with OutOfMemory errors.
TIP3 – After creating the request you can see the request by list request certificates in the keystore, after receiving the signed certificate the certificate request is removed. Don’t worry, this is normal.
TIP4 – SL0208E: SSL Handshake Failed, Certificate validation error. This error is related to the Root Class3 certificate. Don’t forget to import it to the keystore.

Step 1 – Configure your environment variables

Using command line (as almost on every server)

Step 1 – Configure your environment

export JAVA_HOME=/java/jre
export PATH=/java/jre/bin:$PATH

Step 2 – Create a new key store database:

IHS_ROOT_DIR/gsk7/bin/gsk7cmd -keydb -create -db keystore -pw 1234 -type cms -stash

Step3 – Create a new Key Request:

IHS_ROOT_DIR/gsk7/bin/gsk7cmd -certreq -create -db keystore.kdb -pw 1234 –

label keystorelabel -dn “CN=subdomain.yourcompany.com,O=Company Name,OU=OrganizationUnit,L=Sao Paulo,ST=Sao Paulo,C=BR” -size 2048 -file keyrequest.csr

Step3 – Import primary and secondary intermediate certsign public keys

access this link and copy the primary and secondary intermediate keys

http://www.verisign.com/support/verisign-intermediate-ca/secure-site-intermediate/index.html

copy the Primary Intermediate CA Certificate and save in a file called
primary.crt

copy the Secondary Intermediate CA Certificate and save in a file called
secondary.crt

access Verisign link and choose your product. The most common is “Standard SSL”

https://knowledge.verisign.com/support/mpki-for-ssl-support/index?page=content&actp=CROSSLINK&id=SO4785

Access your product. After accessing your product link, it will be displayed the Class 3 Public Primary Certification Authority. Copy the certificate and store it in a file called

rootclasscert.crt

so now you have the 3 certificates:

primary.crt
secondary.crt
rootclasscert.crt

Step 4 – Import primary, secondary and rootclasscert into your keystore.kdb database

IHS_ROOT_DIR/gsk7/bin/gsk7cmd -Xms1024m -Xmx2048m -cert -add -db keystore.
kdb -pw 1234 -label primary -format ascii -trust enable -file primary.crt

IHS_ROOT_DIR/gsk7/bin/gsk7cmd -Xms1024m -Xmx2048m -cert -add -db keystore.

kdb -pw 1234 -label secondary -format ascii -trust enable -file secondary.crt

IHS_ROOT_DIR/gsk7/bin/gsk7cmd -Xms1024m -Xmx2048m -cert -add -db keystore.

kdb -pw 1234 -label rootclasscert -format ascii -trust enable -file rootclasscert.crt

Step 5 – Send your request file keyrequest.csr to Verisign so to receive a signed certificate.

This step is atomic. You access your Verisign account and copy and paste the request key and Verisign will send the signed certificate by email at the same time.

Step 6 – Receive the file and store it in your database

Copy the content of the cert.cer or copy the attached file to your server and issue the following command:

IHS_ROOT_DIR/gsk7/bin/gsk7cmd -Xms1024m -Xmx2048m -cert -receive -file cert.cer -db keystore.kdb -pw 1234 -format ascii -default_cert yes

Step 7 – Configure your IHS to point to the new keystore

Example:

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so

Listen 443

< virtualhost your.ip.address.number:443 >
ServerName your.ip.address.number
SSLEnable
SSLProtocolDisable SSLv2
KeyFile YOUR_PATH/SSL/keystore.kdb
< /virtualhost>
SSLDisable

Step 8 – Stop and Start IHS.

IHS_ROOT_DIR/bin/adminctl stop
IHS_ROOT_DIR/bin/apachectl stop

IHS_ROOT_DIR/bin/adminctl start
IHS_ROOT_DIR/bin/apachectl start

check your server now using https://yourserver/

Recent Posts

Pages

Categories

Archives

Recent Comments

Categories

Mysql gallera

Windows Server 2012 R2 between Core and Full Installations

Convert Full to Core

Convert Core to Full

Ansible

Apache Spark

DRBD setup on Centos 6.7

Solaris Security Tips

Solaris system information

Solaris system information

SSL0208E IKEYMAN VeriSign error

SSL0208E IKEYMAN VeriSign error

How to install an SSL certificate on IHS (IBM HTTP Server)

How to install an SSL certificate on IHS (IBM HTTP Server)

Calculating percentages in bash

Calculating percentages in bash

PRODUCTS