Inside the mind of the javatarian

configuring ssh in Ubuntu

javatarian — Tue, 07 Jul 2009 18:37:03 +0000

There are several things which one can change after installing ubuntu and using SSH. Here are some of the things which I would do, along with their descriptions (in red):

Sample changes in ssh_config file (found at /etc/ssh):

ForwardX11 yes Forward X11 display

ForwardX11Trusted yes Forward X11 display only from trusted sources

ServerAliveInterval 5 Send small packets of data every 5 seconds so that SSH connection does not time out

configure a new email cron job in Solaris 10

javatarian — Mon, 23 Mar 2009 19:36:42 +0000

I needed to configure a new cron job in Solaris 10 which runs a shell script and then emails the results of the script to a few email addresses. The task contained 2 parts:

Configuring email on Solaris 10: we have an SMTP server already configured. All I had to do was open /etc/main/submit.cf (first back it up) and then edit the line which reads:

D{MTAHost}[127.0.0.1]

D{MTAHost}[SMTP_HOST_NAME]

Restart sendmail by issing the commands: /etc/init.d/sendmail stop and /etc/init.d/sendmail start

Configure crontab: First of all you need to make sure that you can run cron jobs. Go to /usr/lib/cron (assuming you have root privileges) and open the file cron.allow (assuming it exists). If your name appears in the list, you can add cron jobs. If not just add your UNIX username. If this file does not exist, see if cron.deny exists. If this exists and your name is not in there, then you can use crontab. If only cron.deny exists and is empty, all users can use crontab. If neither file exists, only the root user can use crontab. The allow/deny files consist of one user name per line.

Edit your crontab file by:

export EDITOR=vi ;to specify a editor to open crontab file.

crontab -e Edit your crontab file, or create one if it doesn’t already exist.

crontab -l Display your crontab file.

crontab -r Remove your crontab file.

crontab -v Display the last time you edited your crontab file. (This option is only available on a few systems.)

A line in crontab file like below removes the tmp files from /home/someuser/tmp each day at 6:30 PM.

30 18 * * * rm /home/someuser/tmp/*

Importing key-cert pair into Sun Web Server 7.0

javatarian — Fri, 07 Nov 2008 22:29:43 +0000

This blog is for those people who are trying to import a key-cert pair generated from outside of Sun Web Server 7.0. This can happen if for example, you have a load balancer in front of the web server and you want to import the load balancer SSL cert for the Sun Web Server also. Why would you do that ? For one, if you want to NOT terminate SSL on the load balancer you would want the Sun Web Server to handle the SSL, you would need to do this exercise. This might also be needed if you want to do client authentication using certificates and want the Sun Web server to handle it. One more reason might be that you already own a key-cert pair and have built a new Sun Web Server 7.0 instance.

The most important step in this exercise is to convert your key-cert pair in a JKS keystore. If you have received you key-cert pair as a PKCS#12 file then you can use a simple library from Jetty : jetty-6.1.8.jar. You can download it from the following link: http://repository.codehaus.org/org/mortbay/jetty/jetty/6.1.8/.

Run the following command:

java -classpath jetty-6.1.8.jar org.mortbay.jetty.security.PKCS12Import MyCert.pfx MyCert.jks

This will convert your cert from PKCS#12 format to JKS format.There is another very interesting tool from IBM, keymanager (http://www.alphaworks.ibm.com/tech/keyman). Using this tool you can create a new JKS keystore and then just drop your private key and certs into the keystore and you are done ! Make sure that you import the key first and then the cert.

Once you have your JKS keystore with the key-cert pair, use the ‘wadm’ command in Sun Web Server 7.0 to import this keystore into the existing keystore:

1. wadm –user=admin

Please enter admin-user-password> typed-admin-password-here

2. wadm> list-configs

test-config

3.wadm> migrate-jks-keycert –config=test-config –keystore=/tmp/MyCert.jks

Please enter keystore-password> storepass
Please enter key-password> keypass (just press Enter if you don’t want a key password)

This will import an existing key-cert pair in a JKS format into the Sun Web Server 7.0 keystore.

Apache Web Server on Solaris 10

javatarian — Tue, 21 Oct 2008 21:27:20 +0000

I downloaded Apache Web Server 2.2.9 from apache’s website and tried to compile it. At first the installer could not find cc or gcc in my path and complained (thanks to Sun, most paths don’t get added to a user’s profile when he is first created). I thought that gcc was just not there and downloaded it from sunfreeware.com and installed it. The gcc installer did not go very smoothly and i did see some errors. Either ways, I decided to proceed with the installation of Apache with the path to gcc just installed. This time the installer complained about “gcc cannot create executables”. I googled it a lot and in the end I found out that gcc DID come installed with Solaris at /usr/sfw/bin and when changing the PATH variable to point to that location, the apache installer did not complain and everything went fine with the installation.

However, the default installation does not install ssl and other modules. To do that you have to give the option –-enable-modules=”all” and –-enable-mods-shared=”all” (in place of “all” you can specify module names too). However, when I gave the option, it did not recognize them. I thought something wrong with my configuration. On doing some more research, I found out that this version of apache had a bug and it is not parsing the command line options properly. I am not sure if it is only on solaris or on other platforms also. Anyways, I decided to give apache version 2.2.8 a try, unzipped it and everything went smoothly with ssl and all other modules.

On enabling SSL on Apache, if you get an error from httpd-ssl.conf about “255.255.255.255″ not being able to reolve, I think it is a bug in Solaris which has perhaps been fixed in some later versions of Solaris. But for the time being, just go ahead and change the to and Apache should be able to start properly.

smcwebserver remote access

javatarian — Wed, 08 Oct 2008 23:33:20 +0000

After installing Sun Directory server, one would jump on to start cacaoadm (the common agent container administrator) using “cacaoadm start” and then would go ahead and start smcwebserver using “smcwebserver start”. One issue which I recently found is that sometimes smcwebserver does not allow remote access which means that you need to access http://hostname:6789/ on the physical host on which it is installed (a netstat -na | grep 6789 will show that it accepts connections only from 127.0.0.1, the loopback address). To resolve this issue and allow access from remote hosts issue the following 2 commands:

svccfg -s svc:/system/webconsole \setprop options/tcp_listen = true

svcadm refresh svc:/system/webconsole

Of course once this is done don’t forget to restart smcwebserver (smcwebserver restart)

Access Manager user profile page- readonly issue

javatarian — Fri, 26 Sep 2008 20:52:46 +0000

Seems like there is an issue while trying to set an attribute to “readonly” so that when a user logs into AM, he can only see but can’t change those attributes. Sun’s documentation says that to do this, you need to edit the file amUser.xml found in /etc/opt/SUNWam/config (or the relevant path in linux), then delete the iplanetAMUserService using the amadmin command

/opt/SUNWam/bin/amadmin –runasdn uid=amadmin,ou=people,dc=sun,dc=com –password mypassword –deleteservice iplanetAMUserService

and then reimport the new amUser.xml using-

/opt/SUNWam/bin/amadmin –runasdn uid=amadmin,ou=people,dc=sun,dc=com –password mypassword –schema amUser.xml

However, when i edited amUser.xml and changed the “any” property of an attribute (say, “cn”), the attribute just disappears from the user’s page. I have seen this issue in Sun forums also, but don’t see any resolution.

Grand Central!

javatarian — Thu, 25 Sep 2008 23:54:50 +0000

What do you think when you hear Grand Central ? Are you thinking about the magnificent structure which stands in midtown Manhattan? Guess what, time to look further…… www.grandentral.com came into existence about 2 years ago and does not seem like many people know about it. I don’t even know why I put it into my blog, but it seems like a wonderful thing… another interesting service provided by Google

Well, if you want to know what GrandCentral.com does without actually having the time to read about it, here is the jist… GC helps you organize your calling lists and your multiple telephone number all in one place. They give you one telephone number of your choice and when somebody call you on that number you can get the call on all the phone which you have registered (you can change which phones ring). More than that, you can call anybody directly from your GC web account just by a few clicks.. You can screen calls, record greetings, get voice main thru email and a lot of other things…. bottom line, you have to check it out… just go to www.grandcentral.com

Access Manager User Profile “Force Password…”

javatarian — Wed, 24 Sep 2008 21:49:52 +0000

In Access Manager, as I was trying to figure out a way to remove the option for “Force User Password Change on Next Login” I found out that there is simply no way to do that other than going into the jsp found in console/User directory: UMUserPasswordResetOptions.jsp and removing the last

element in the file which causes the option to be displayed. Sun could have done a much better job in this respect of giving the admins an option of what is displayed and what is not displayed.

/etc/hosts on UNIX box

javatarian — Tue, 24 Jun 2008 15:16:37 +0000

If you are having a problem resolving hosts on a UNIX box even when you do have a /etc/hosts file configured with the hosts which are not there on the DNS server, check to make sure that you have a /etc/nsswitch.conf file. I know that by default a few UNIX systems like HP-UX do have it as a sample file but are renamed to something else. A ls -al nsswitch* will get you a list of all files which start with nsswitch. Copy one of them to /etc/nsswitch.conf and edit the line which starts with hosts:

hosts: files [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] dns

This will ensure that your hosts will be resolved first by looking into /etc/hosts and if not found there the DNS server will be used. This can be very useful in the even the DNS server crashes or is unavailable for any reason.

Reading Books

javatarian — Fri, 08 Feb 2008 02:34:51 +0000

Lately, I have been thinking about working people and reading books! From the perspective of a student, it is so normal to read books, do your assignments and go to the library, but does the same apply for us professionals too? I know that we don’t have to do assignments the same way student do, but we do have our own work which is nothing less than a student assignment if not worse. So why do I and for that matter a lot of people (of course people I know like friends and coworkers) complain about not getting time to read books?

A lot of sociologists say that reading books is the most important way in which our brains process and retrieve new information. Doing a bit of research on the internet I found that “The great advantage of reading is that there is much more material written in all forms than that on tape and video that one would listen to, and the perception of the ear to respond to critical information is not as effective as that to the eye.”

Knowing myself as an IT professional and a lots of other professionals in all walks of life, it has become much more apparent to me that the computer has taken the place of a lots of things in life – playing games, making social contacts, writing a diary (i am doing the same thing), reading news, shopping and just about anything else.

Another important aspect which comes to my mind, particularly with respect to my IT profession, is reading online. I remember that as part of one of my IT certification exams, as I was preparing to purchase a good old book, one of my friends gave me an e-book which after reading I understood that it had just about everything I needed to know (needless to say I completed the certification successfully).

Whenever I need to get myself updated to any new technology, I don’t need to purchase a book – just google and get it!

I wonder whether just like fashions, will book reading come back and become vogue again?