I had an issue using PuTTY (free Windows SSH client) this afternoon when trying to login to a work server. The error message seemed very odd:

Unable to open connection to andrewbevitt.com
gethostbyname: unknown error

OR BY IP ADDRESS

Unable to open connection to 220.233.157.156
Network error: Invalid argument

Turns out that it’s a Windows 7 feature. I had the PuTTY executable sitting on my Desktop as part of my domain account so apparently something executed out of $HOMEDIR\* gets limited.

Solution: Copy the executable to a local disk partition.

I’ve just put up a new tutorial (strangely enough about the title)! You can read it here.

I’ve been playing with Windows Deployment Services for rolling out Windows 7 Professional (from Server 2008 R2) over the last couple of days. Aside from a missing NIC driver everything seems to be fairly straight forward.

Plenty of documentation already exists on this subject, but I spent the good part of a day wading through it, so here I present a “get you up and running quickly” list of docs:

1. Technet Step-by-Step (for Server 2003)
2. Sysprep Windows 7
3. Better Instructions for Discover Images (i.e. for non-pxe hardware)

Of course this set of articles is meant to just by a quick and dirty start… you’ll have to read deeper if you want definitive instructions on unattended remote installs. But not too much deeper. WindowsNetworking.com has the start of a set of articles on Windows 7 deployment which will probably help you out with that.

This is for as much my reference as anyone else.

I really like pfsense it makes a really good firewall, router, vpn connector – alone or together. The web interface is intuitive and the first-run wizard “just works”. I am using it to run an OpenVPN VPN.

OpenVPN comes with a feature called “TLS Auth”: which basically uses TLS to encrypt the SSL handshake between client and server. Ok that wasn’t basic: makes saying hello safe. However the pfsense GUI for configuring an OpenVPN server does not, yet, support tls-auth. As documented in the previous link you can add custom configuration options and manually create the file until v1.3 is released.

Here’s the point: The pfsense + openvpn boot scripts will write the OpenVPN configuration files and security certificates to: /var/etc/openvpn_serverX.* (X being the instance number). So for consistency you might be inclined to create your tls-auth file as /var/etc/openvpn_serverX.tls.

DON’T!

The /var/etc folder gets cleared on reboot. Which is a feature of pfsense’s PHP init scripts + in hind sight sensible.

So today’s lesson is: When manually specifying tls-auth support for OpenVPN on pfsense-1.2.X put the tls-auth file in /etc/openvpn_serverX.tls so that it is persistent.

If you’re running Zimbra, or planning to, then chances are you will want to use SSL to secure your client connections. The Zimbra wiki has quite a few articles on doing this but they all seem a little over written if all you need to do is create a CSR and sign it (with your own CA or using a paid for service).

So here is my no frills howto make, sign, and deploy:

Always use absolute path names – otherwise you’ll get strange warnings – everything seems to work – but you’ll get strange warnings.

1. Generate a CSR (as root):
   /opt/zimbra/bin/zmcertmgr createcsr comm -new -subject "/C=Country/ST=State/L=City/O=Company/OU=Department/CN=zimbra.domain.name" -subjectAltNames "webmail.domain.name,pop3.domain.name"
   You can leave out subjectAltNames altogether if you don’t need it.
2. This will create /opt/zimbra/ssl/zimbra/commercial/commericial.csr (and .key) copy the CSR to where your CA needs it.
3. Sign the CSR. If you’re using your own CA:
   openssl ca -config openssl.cnf -policy policy_anything -out certs/commercial.crt -infiles commercial.csr
4. Copy signed CRT + CA CRT to:
   • /opt/zimbra/ssl/zimbra/commercial/commercial.crt
   • /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt
5. Install the certificate (as root):
   /opt/zimbra/bin/zmcertmgr deploycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.crt /opt/zimbra/ssl/zimbra/commercial/commericial_ca.crt

Now use zmcontrol to stop and restart your Zimbra processes and off you go.

If you receive errors about TLS and ctx when trying to start LDAP then it’s likely your CA didn’t install properly. Follow the instructions in this post and then zmcontrol start. Once up and running try step 5 again.

This isn’t a howto! Seriously. You should know your data. Which means you should contrive your own policies and procedures for backing up. This is simply the stack I’ve decided best suits my needs.

• Windows desktops: robocopy batch script. Target is mirrored content on a local server.
• Windows servers: as above – but to a Linux server (virtual machine) for offsite rsync.
• Linux desktops: rsync mirroring to local server.
• Linux servers: rdiff-backup to offsite location.

For my offsite location I am using Amazon Web Services: EC2 as the rdiff-backup target; EBS as tentative storage for the rdiff-backup data; and S3 for periodic snapshots of the EBS volumes.

My EBS store is a, software, RAID6 array made up of 100G volumes. I am also using LUKS to encrypt each volume at the block level.

This stack gives me encrypted, offsite, continental distributed, reverse incremental backups. In my opinion that’s basically the holy grail. The only possible issue will arise if I lost the keys to unlock the LUKS encryption. But that wont happen. LUKS allows for a key file and 8 password style keys. With that flexibility I can guarantee I will always have access / the ability to change keys.

I’ve just posted a new tutorial on how to do Bulk Provisioning of Linksys SPA9*2 SIP desk phones with tftp using xml configuration files. This works for both the 5.2.8 and 6.1.3a firmware for both the SPA942 and SPA962 (with or without the side car).

I spent a few hours this afternoon upgrading some of the work firewalls, which run pfSesne, from v1.2 to v1.2.1. Which was released a few days ago. Here are my notes and warnings after following the Install and Upgrade documentation.

In theory, the upgrade is meant to be fairly straight forward. You can try to do an online upgrade. However there are documented issues with that. The other option is to reinstall, which in this case means: reflash the CF cards. So long as you have a config backup then you can simply restore your settings and off you go. All in all:

1. Download the new image file
2. Stick the CF card in your CF card adapter
3. zcat pfsense.img.gz | dd of=/dev/XYZ bs=16k
4. Stick the CF card back in the firewall
5. Boot and restore the config

Gotcha #1: The new image does not have any network setup by default. In theory, once again, you should have a serial cable (DSUB 9) that you use to access the serial console of your firewall. Configure a LAN interface address, then use the web interface to restore the config file. Unfortunately I did not have a serial cable; we’ll leave why out of it. I dealt with this by building a config file within the embedded image before writing to the CF card. You’ll need QEMU to do this. Note these steps derived from the Mac_OS_X_together_with_qemu section of the Install documentation.

# Unzip the embedded image and start it with QEMU;
# - Two NICs LAN / WAN
# - The qemu command is all one line
gunzip pfsense.img.gz
qemu -hda pfsense.img -net nic,vlan=0 -net nic,vlan=1 -serial telnet::7890,server,nowait
# Now open a terminal and fake a serial console with telnet
telnet localhost 7890
# You'll need to configure your network devices during boot.
# I used generic settings so I could flash the image to multiple cards
# When you reach the main menu push 8 for a shell
mount -u /cf
cd /conf
vi config.xml
# Check the interfaces are configured properly then
exit
# Choose option 6 to halt the emulated machine.
# Write the updated image to your CF card
dd if=pfsense.img of=/dev/XYZ bs=16k

QEMU is available for most major incarnations of most operating systems. The above are fairly Linux specific but should be easy enough to translate; dd is a physical disk dump program.

Gotcha #2: Bogon Networks! Are updated by a cron script on the 1st of each month at 3:01AM. Unfortunately the default list includes IP’s assigned by Optus Wireless Broadband – which means if I’m using one of Works USB modems I can’t access the servers. That’s bad!. Really the bogon list should be updated during the setup wizard if you turn bogon filtering on. See this pfSense forum topic for how to manually update your bogon filter.

Gotcha #3: Your backup config file DOES NOT contain certain settings. OpenVPN configurations for example. Make sure you have a copy of any custom settings not contained in the backup config file; otherwise be prepared to reconfigure.

And that’s all.

Just a brief note on segfaults when compiling Asterisk 1.6.0 (through to 1.6.0.3-rc1 and perhaps onwards). If you find that the Asterisk process segfaults when a caller starts to record a VoiceMail message then go back to the build step:

make menuselect
Compiler Flags -> DONT OPTIMIZE

And then recompile / reinstall.

I’ve just uploaded a new tutorial to the Tutorials page on MultiWAN Routing with a Linux server (direct link).