How to update Ubiquiti UniFi controller on CentOS 7.

Note: This needs to be done after hours as devices may lose connectivity for about 10 seconds to re-provision.

1. Get URL for latest stable UniFi Controller: https://www.ui.com/download/ Then click on UniFi. Then look for software category. Then click on UniFi Network Application Debian file. Then click Download link. Accept EULA. Then review download link location.
2. SSH into server and log in as root.
3. Stop the UniFi controller service
   # service unifi stop
4. Download the Unix version of the UniFi controller replacing the version number in the URL from Step 1:
   # wget https://dl.ui.com/unifi/6.xx.xx/UniFi.unix.zip
   
5. Unzip the downloaded file:
   # unzip UniFi.unix.zip
6. Move existing UniFi controller to a backup folder:
   # mv /opt/UniFi/ /opt/UniFi_bak
7. Move new UniFi controller files to final location:
   # mv UniFi/ /opt
   
8. Copy existing database (with all info about your UniFi devices) files to final location:
   # cp -rf /opt/UniFi_bak/data/ /opt/UniFi/data/
9. Change ownership of files to match what your controller runs as:
   # chown -R ubnt. /opt/UniFi
10. Start new UniFi controller software:
    # service unifi start
    (wait for database to be upgraded in background, may take a few minutes before you are able to log in)
    

Optional prune database to optimize performance issues:

https://help.ubnt.com/hc/en-us/articles/204911424-UniFi-How-to-Remove-Prune-Older-Data-and-Adjust-Mongo-Database-Size#3.%20How%20to%20Prune%20Linux

How to Enable IPv6 on pfSense with Time Warner Cable internet

Here are some quick instructions on how to enable IPv6 on pfSense when using Time Warner Cable (residential or business class DHCP provided) internet access.

1. Under interfaces click on WAN. Select DHCP6 from drop down menu on IPv6 configuration type. Make sure DHCPv6 Prefix Delegation size is set to 64. Uncheck Block bogon networks. Click Save.
2. Under interfaces click on LAN. Select Track interface from drop down menu on IPv6 configuration type. Make sure Track interface is set to WAN under Track IPv6 Interface. Click Save.

That's it. You should see on your pfSense dashboard that the WAN and LAN interfaces each have an IPv6 Time Warner IP address. Release/renew DHCP IP addresses on your LAN devices and they should now pick up IPv6 Time Warner IP addresses.

How to download a file using Powershell

Here is how to download a file using Powershell without needing any additional tools. Great for Hyper-V Core systems or remote access.

powershell.exe "Import-Module BitsTransfer; Start-BitsTransfer -Source http://domain.tld/somefilename.exe -Destination c:\PathToAFolder"

Site-to-Site IPSEC VPN using Mikrotik Routerboards

A good video on how to setup the VPN is here:

http://gregsowell.com/?p=1290

Example:  Site A has static IP address and Site B has dynamic IP address. On Site B Mikrotik router, you will need to add the following script to update the VPN policy. To do this using Winbox, go to System -> Scripts. Click + sign. Give the script a name. Then paste the following code into the box below:

:local WANip [/ip address get [find interface="ether5"] address]
 
:log info "Interface IP is $WANip"
 
:local WANip [:pick "$WANip" 0 ([:len $WANip] - 3)]
 
:log info "IP sans the slash notation is $WANip"
 
/ip ipsec policy set 0 sa-src-address=$WANip

Click Okay to save the script. 

To schedule the script to run every 5 minutes (in case the WAN IP address changes), in Winbox go to System -> Scheduler. Give the task a name. Start date can be ignored. Set Start time to 1 second (00:00:01). Set Interval to 5 minutes (00:05:00). Where it says On Event, type in the name of the script you entered above. Click okay.

Note:  Here is a list of ports that will need to be opened on both Mikrotik routers in order for the VPN traffic to pass successfully:

Chain: Input, Protocol: 50 (ipsec-esp), Action: Accept

Chain: Input, Protocol: 51 (ipsec-ah), Action: Accept

Chain: Input, Protocol: 17 (udp), Any Port: 500, Action: Accept

Note: In version  Mikrotik OS version 6.39.1, you may experience the following error with IPSEC tunnels:

Expecting IP address type in main mode when using preshared key for authorization (see RFC 2409 section 5.4).

If you see this error, open Winbox, go to IP -> IPSEC. Then go to Peers tab. Double click on the Peer IP address. Then where it says My ID Type, change it to auto. Click Okay. Repeat the same procedure for the other router. This should re-establish the IPSEC tunnel.

How to Add Exchange Autodiscover SRV Record at Godaddy

Here are the instructions on how to add an Exchange Autodiscover record over at Godaddy.

1. Log into your Godaddy account.
2. Click on Domains, then click on the Launch button next to domain you wish to edit.
3. Click on DNS Zone File tab.
4. Towards bottom of page, find SRV Records heading and click Add Record.
5. Where it says Name, type in @.
   Where it says Target, type in the FQDN of your Exchange server. Ex. servername.business.tld
   Where it says Protocol, type in _tcp
   Where it says Service, type in _autodiscover
   Where it says Priority, type in 10
   Where it says Weight, type in 10
   Where it says Port, type in 443 (unless you've changed the port that Exchange Web Services listens on)
   Where it says TTL, leave at default 1 Hour or change to 1/2 Hour. 
6. Click Finish.
7. Be sure to click Save Changes to ensure the zone file changes are applied.

Lock down Exchange to receive only from GFIMaxMail servers

After adding a client to the GFIMAXMail email filtering service, you should lock down Exchange to only receive e-mail from GFIMAXMail servers to prevent spammers from bypassing the filtering.

1. Open Microsoft Exchange Management Console.
2. Open Server Configuration then Hub Transport.
3. If using Microsoft Windows SBS2008 or SBS2011, find the default connector named Windows SBS Internet Receive SERVERHOSTNAME where SERVERHOSTNAME is the name of the server you are working on. Double left click on it to bring up the Properties window.
4. Click on the Network tab.
5. Under Receive mail from remote servers that have these IP addresses, remove all of the entries.
6. Add the IP netblock for your LAN (ex. server IP address 192.168.16.3, so add 192.168.16.0/24).
7. Add the following IP netblocks that correspond to GFIMAXMail's server clusters:
   
   • 174.36.154.0/24
   • 192.69.16.0/24
   • 192.69.17.0/24
   • 192.69.18.0/24
   • 192.69.19.0/24
   • 208.43.37.0/24
   • 208.70.88.0/24
   • 208.70.89.0/24
   • 208.70.90.0/24
   • 208.70.91.0/24
   • 5.10.67.0/24
   • 92.51.176.0/24
   • 94.186.192.0/24
8. When finished adding IP address ranges to the Network tab, click Okay.

A better option would be to add an ACL on your firewall for all incoming Port 25 traffic and add the IP address ranges above, but not all firewall support that type of granular control.

Updating Microsoft Windows Small Business Server 2011 (SBS2011)

There are several important updates that need to be manually installed on Microsoft Windows Small Business Server 2011. Download the files below. Before installing them, perform a full server backup. Then install the updates in this order:

1. Microsoft Windows Server 2008 R2 Service Pack 1
   (download the X64 file only as SBS2011 never came in X86/32-bit version).
2. Microsoft Windows Small Business Server 2011, Update Rollup 4
   (optional but highly recommended)
3. Microsoft Exchange Server 2010 Service Pack 3
4. Microsoft Exchange Server 2010 Service Pack 3, Update Rollup 6
   (optional but highly recommended)
5. Microsoft Sharepoint Foundation 2010 Service Pack 2

Recommended: reboot between each step and take a backup between each step.

You'll need a couple of hours for the average server to install all of the updates. 

SBS2011 error messages after installing Sharepoint 2010 updates

You may get various error messages after installing Sharepoint 2010 updates (such as SP1). This is due to the requirement of upgrading the Sharepoint database after installing updates.

To check this issue, open an elevated Sharepoint 2010 Management Shell and run the following:

(get-spserver $env:computername).NeedsUpgrade

If the the output says True, then you need to upgrade the Sharepoint database. To do that, open an elevated Command Prompt and run the following:

cd \"Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN"
PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures

It should take about 5-10 minutes depending on hardware and the size of the database. It should say successfully upgraded database. I recommend rebooting the server afterwards just to be sure.

For more info: http://blogs.technet.com/b/sbs/archive/2011/07/06/potential-issues-after-installing-sharepoint-foundation-2010-sp1.aspx

How to add Exchange Autodiscovery SRV record using WHM

In order to allow smartphones and e-mail clients (Outlook 2007, 2010, and 2013 in particular) to automatically configure the necessary Exchange server address and settings, an Autodiscovery SRV record needs to be created. If you use cPanel to host your domain name & DNS settings, then you can follow these directions to add an Autodiscovery SRV record into the DNS management in WHM.

1. Log into WHM.
2. Click on DNS Functions then find the domain you want to edit and click Edit.
3. Where it says Add New Entries, enter the following into the first text box:

_autodiscover._tcp

4. You can modify the TTL on the record if you want, or leave it at the default 14400 seconds.
5. Where it says Select choose SRV.
6. Where it says Priority enter:

10

7. Where it says Weight enter:

10

8. Where it says Port enter:

443

9. Where it says hostname enter the external FQDN of your exchange server:

remote.somedomain.com.
(don't forget the period at the end of the hostname)

10. Click Save button at bottom.

11. Use Microsoft's Exchange Autodiscovery tool to check your work:

https://testconnectivity.microsoft.com/

For more info:  https://www.thirdtier.net/2009/02/setting-up-an-external-autodiscover-record-for-sbs-2008/

Network adapter tweaks for Windows Server 2003, 2008, SBS 2008, and SBS 2011

These technologies are great if your environment support them end to end, but if not you may see some of the following issues.

Symptoms include:

• Sporadic Network issues.
• Service failing (Because of network login issues)
• Delay in service start (Because of network login issues)
• Unexplained issues that Seem to be network related but other areas have already been investigated

Resolution: To keep it as simple and reliable as possible

1. Update to latest drivers
2. Disable Everything that says offload or scaling in the NIC properties
3. Disable it for the OS as well

Windows Server 2008 / Server 2012 / SBS 2008 / SBS 2011

• netsh interface tcp set global rss=disabled
• netsh interface tcp set global chimney=disabled
• netsh interface tcp set global autotuninglevel=disabled

Windows Server 2003 / SBS 2003

• netsh int ip set chimney disabled

Copied from: http://exchangemaster.wordpress.com/2010/05/12/disable-toe-and-rss/
and: http://www.symantec.com/business/support/index?page=content&id=TECH197934

Windows Server 2012 R2 Core Notes

To enable PING on Server 2012 R2:

netsh firewall set icmpsetting 8

To enable File & Printer Sharing through filewall:

netsh advfirewall firewall set rule group=”File and Printer Sharing” new enable=yes

To get a list of features on Server 2012 R2:

dism.exe /online /Get-Features

To enable Remote Desktop Connections to the server over a network:

netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes

To enable remote management of Server 2012 R2 via mmc over a network:

netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes

netsh advfirewall firewall set rule group="remote event log management" new enable=yes

netsh advfirewall firewall set rule group="Windows Remote Management" new enable=yes

 netsh advfirewall firewall set rule group="remote volume management" new enable=yes

sc config VDS start=auto

Create a Scheduled task to run daily at 10pm:

schtasks.exe /Create /SC DAILY /ST 22:00 /TN BACKUP /TR c:\pathto.cmd

Free GUI tool to manage Server 2012 R2 Core:

http://corefig.codeplex.com/

note: to transfer the extracted contents from the ZIP file to the server, enable the File and Printer Sharing firewall rule above, then connect to the server via SMB: \\servername\c$

Another free GUI tool that combines Corefig with Hyper-V management capabilities:

http://pshvm.codeplex.com/

A commercially available free tool to remotely manage Hyper-V on Server 2012 R2 Core:

http://5nine.com/5nine-manager-for-hyper-v-free.aspx

A free tool to diagnose issues with Remote Management:

http://blogs.technet.com/b/jhoward/archive/2008/11/14/configure-hyper-v-remote-management-in-seconds.aspx

note: when the server and client machines are on Workgroups, add the server administrator to the Credential Manager control panel applet on the client machine, and allow anonymous dcom on the client. This fixes errors such as E_ACCESSDENIED 0x80070005 when using 5Nine Manager for Hyper-V.

How to download files on the console without any additional tools:

powershell.exe "Import-Module BitsTransfer; Start-BitsTransfer -Source http://domain.tld/somefilename.exe -Destination c:\PathToAFolder" 

To download files from an FTP server using ftp.exe, enter these two Windows Firewall rules to allow ftp.exe to connect:

netsh advfirewall firewall add rule name="File Transfer Program" dir=in action=allow program=%SystemRoot%\System32\ftp.exe enable=yes protocol=tcp 

netsh advfirewall firewall add rule name="File Transfer Program" dir=in action=allow program=%SystemRoot%\System32\ftp.exe enable=yes protocol=udp

How to install Logwatch on cPanel servers running CentOS 6

Logwatch isn't included by default in CentOS 6 & cPanel installs. You can install it manually by following these instructions:

1. Go get the latest version of logwatch by going to: http://sourceforge.net/projects/logwatch/
   Make sure you download the NOARCH rpm file.
2. Log into your cPanel server, and run the command as root or with appropriate sudo permissions:
   

   $ rpm -Uvh logwatch-7.3.6-1.noarch.rpm

3. Now you need to edit the logwatch.conf file to add some lines to get it working:
   

   $ nano -w /usr/share/logwatch/default.conf/logwatch.conf

4. Add the following lines after tmpdir = /var/cache/logwatch:
   

   #Output/Format Options
   #By default Logwatch will print to stdout in text with no encoding.
   #To make email Default set Output = mail to save to file set Output = file
   Output = mail
   #To make Html the default formatting Format = html
   Format = text
   #To make Base64 [aka uuencode] Encode = base64
   Encode = 0

5. Save the file.

That is it. You can test your changes immediately by running the following command or wait until the daily cronjob is run.

$ perl /etc/cron.daily/0logwatch > /root/output.txt
$ less /root/output

Fix MySQL Databases that won't delete on cPanel

If you get a customer who tries to add a MySQL database or restore a database with a . (period) mark in the name, the database will fail to be created, but under the customer's cPanel MySQL Databases, it will show up as a database. Clicking delete doesn't remove the database.

To delete this database, log into the server via SSH and run the following as root:
$ cd /var/cpanel/databases
$ nano -w customerusername.yaml

Then delete the line with the name of the broken database. Save and exit.

Optionally, you can run the following command to make sure it is working.

$  /usr/local/cpanel/bin/setupdbmap

Count how many times your Wordpress login page has been requested

With all of the hacking and botnet activity probing Wordpress sites the past few months, you might wonder how many times your Wordpress login page (wp-login.php) has been requested. Here's a command that you can run from the terminal prompt to see:

/home/user $ grep -c wp-login access.log

On my personal Wordpress site, I found the following results:

• May 5th to 12th - 598 http requests 
• May 12th to 19th - 7,555 http requests
•  May 19th to 22nd - 55 http requests

Very interesting indeed.

VBS Script to pull Computer/Server Model information

SystemName = "localhost"

set tmpObj = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & SystemName & "\root\cimv2").InstancesOf ("Win32_ComputerSystem")
for each tmpItem in tmpObj
  MakeModel = trim(tmpItem.Manufacturer) & " " & trim(tmpItem.Model)
next
Set tmpObj = Nothing: Set tmpItem = Nothing

msgbox MakeModel

Send e-mail alert when Windows Server reboots

Here is how you can send an e-mail alert when a Windows Server reboots. This has been tested on Server 2008, Small Business Server 2008, and Small Business Server 2012. It should work for Server 2012, but I have not had a chance to test this.

1. Download sendemail.exe file and save it to a folder on server. I like to save it to a folder called C:\Scripts
2. Open Notepad/Wordpad/Text Editor and add the following:
   c:\Scripts\sendemail.exe -f localadmin@domain.com -t alerts@yourdomain.com;alerts2@yourdomain.com -u "SERVERNAME rebooted" -m "SERVERNAME has rebooted!" -s smtp.ispsmarthost.com
3. Save the file as rebootalert.cmd in the C:\Scripts folder.
4. Open Task Scheduler.
5. Add a new Task and call it Reboot Alert. Set the User to be SYSTEM. Set Trigger to be At System Startup. Set Actions to be Start a Program and add the path C:\Scripts\rebootalert.cmd.

Test the script by rebooting the server. You should receive an e-mail alert that the server rebooted.

Other helpful links:
http://glazenbakje.wordpress.com/2012/12/30/exchange-2013-how-to-configure-an-internal-relay-connector/

http://www.bluecompute.co.uk/blogposts/configure-email-notification-for-windows-server-backup/

Steps to upgrade Wordpress to latest version

Here are the steps to upgrade Wordpress to the latest version using SSH terminal.

1. Download the latest version of Wordpress:
   

   http://wordpress.org/download/

2. Backup Wordpress install:
   

   [/home/user/public_html] $ tar -cz wordpress > wordpress.tar.gz

3. Backup MySQL database:

   [/home/user/] $ mysqldump --add-drop-table -h localhost -u username -p databasename > mysql-backup-datehere.sql

4. Compress the sql backup file and store elsewhere:
   

   [/home/user/] $ tar -cz mysql-backup-datehere.sql > mysql-backup-datehere.sql.tar.gz

5. Extract new Wordpress files overwriting existing files:
   

   [/home/user/] $ tar -zxvf wordpress-version.tar.gz

6. Visit the Wordpress upgrade page and perform database upgrade:
   

   http://www.domain.com/wp-admin/upgrade.php

Fin.

Query domain computers for Dell & other Service Tags

Create a VBS script and enter the following:

On Error Resume Next
Const ForWriting = 8
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objDictionary = CreateObject("Scripting.Dictionary")
strDomain = InputBox("Please Enter the local DNS Domain  ie:  blat.local  ","Hostname"," ")
strPCsFile = "Service_Tag.txt"
strPath = "C:\scripts\" ' Create this folder
strWorkstationID = "C:\scripts\Service_Tag.txt"
i = 0
'#########
Set objFSO3 = CreateObject("Scripting.FileSystemObject")
If objFSO3.FileExists(strPath & strPCsFile) Then
 Set objFolder = objFSO3.GetFile(strPath & strPCsFile)
Else
  Set objFSOf = CreateObject("Scripting.FileSystemObject")
  If objFSOf.FolderExists(strPath) Then
   Set objFolder = objFSOf.GetFolder(strPath)
  Else
   Set objFolder = objFSO3.CreateFolder(strPath)
  End If
 Set objFile1 = objFSO3.CreateTextFile(strPath & strPCsFile)
 objFile1.Close
End If
'#########
Wscript.Echo "This program will return the Dell Service Tag on remote computer(s)"
strMbox = MsgBox("Would you like info for the entire domain: " & strDOmain & " ?",4,"Hostname")
If strMbox = 6 Then
'Set objPCTXTFile = objFSO.OpenTextFile(strPath & strPCsFile, ForWriting, True)
Set objDomain = GetObject("WinNT://" & strDomain) ' Note LDAP does not work
objDomain.Filter = Array("Computer")
For Each pcObject In objDomain
objDictionary.Add i, pcObject.Name
'Wscript.Echo objDictionary(i)
i = i + 1
Next
For each DomainPC in objDictionary
strComputer = objDictionary.Item(DomainPC)
GetWorkstationID()
Next
Set objFilesystem = Nothing
WScript.echo "Finished Scanning Network check : " & strPath & " If the file is empty you entered an incorrect DNS domain"
Else
strHost = InputBox("Enter the computer you wish to find the Dell Service Tag from","Hostname"," ")
GetWorkstationID2()
End If
Sub GetWorkstationID()
On Error Resume Next
Set objWMIservice = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
set colitems = objWMIservice.ExecQuery("Select * from Win32_BIOS",,48)
For each objitem in colitems
 
      strWriteFile = strComputer &"   Dell Service Tag: " & objitem.serialnumber
Next
'#############
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objOutputFile = objFileSystem.OpenTextFile(strPath & strPCsFile, ForWriting, True)
objOutputFile.WriteLine(strWriteFile)
objOutputFile.Close
'#############
End Sub
Sub GetWorkstationID2()
On Error Resume Next
Wscript.echo strComputer & ": " & objitem.serialnumber
Set objWMIservice = GetObject("winmgmts:\\" & strHost & "\root\cimv2")
set colitems = objWMIservice.ExecQuery("Select * from Win32_BIOS",,48)
For each objitem in colitems
      Wscript.echo "Computer: " & strHost & "   Dell Service Tag: " & objitem.serialnumber
   strWriteFile = "Computer: " & strHost &"   Dell Service Tag: " & objitem.serialnumber
   Next
'%%%%%%%%%%
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objOutputFile = objFileSystem.OpenTextFile(strPath & strPCsFile, ForWriting, True)
objOutputFile.WriteLine(strWriteFile)
objOutputFile.Close
'%%%%%%%%%%
End Sub

Rename a Windows domain connected workstation remotely

From the server/domain controller, run NetDom which will rename the workstation to what you want.
You need to reboot the workstation after running this command.

netdom renamecomputer old_name  /newname:new_name  /userd:domain_admin_login /passwordd:domain_admin_pwd

Sources: http://support.microsoft.com/kb/298593/en-US and http://technet.microsoft.com/en-us/library/cc788029.aspx

Another way to rename a computer is to use Powershell from a server or domain controller.

Rename-computer -computername “targetcomputer” -newname “newcomputername” -domaincredential domain\domain_admin -force -restart

 Source: http://technet.microsoft.com/en-us/library/hh849792.aspx

Links to .Net Frameworks Installers

.Net Framework Installers

• 1.1 Redistributable:     http://www.microsoft.com/en-us/download/details.aspx?id=26
• 1.1 SP1 Update:   http://www.microsoft.com/en-us/download/details.aspx?id=33
• 2.0 SP2 Redistributable:    http://www.microsoft.com/en-us/download/details.aspx?id=1639
• 3.5 SP1 Redistributable:    http://www.microsoft.com/en-us/download/details.aspx?id=25150