How-To

Capture PuTTY Session Logs

In the past week I have had my good share of working on remote systems where I needed to utilize the tool PuTTY to issue commands; not all of them documented. To assist me in documenting my steps I often use the session logs. However this normal has been a manual process in the heat of the moment and sometimes enabling logging is an afterthought.

To guarantee that this is done I have preformed the following steps to the default configuration of my PuTTY client and all saved sessions so that logs are saved and dated for future reference. I wish to record those here for any of you who would like to do the same.

[Press Start]

 

Open PuTTy

Under Category, choose Logging

Under Session Logging, choose the option “All session output”

Under file name: choose a directory and log filename

Using the PuTTY log parameters I configure my logs to consists of host, year, month, data and time for each session.

I also selected the option to “Always append to the end” of the session log which is currently open”

Finally, saving this new log settings to the Default Settings profile in putty making this the default logging option for all future connections and saved profiles.

Note: Profiles that existed before this change will need to be modified if you wish to also log the session output.

Log Parameters:

  • &H = hostname for the session
  • &Y = year
  • &M = month
  • &D = day
  • &T = time

Example Log’s:

Short Video on how to do this

Linux Commands, And More Commands

I have posted about commands in the past. I am now ‘rebooting’ that post adding additional commands that I find useful.

File Transfer:

$ scp somefile.txt server:/tmp Secure copies somefile.txt to remote host /tmp folder

$ scp sysadmin@server:/www/*.html /www/tmp Copies *.html files from remote host to current system /www/tmp folder

$ scp -r sysadmin@server:/www /www/tmp Copies all files and folders recursively from remote server to the current system /www/tmp folder

$ rsync -a /home/backup /backup/ Synchronizes source to destination

 

File and Folder Archive:

$ tar cf home.tar home Creates tar named home.tar containing home/

$ tar xf file.tar Extracts the files from file.tar

$ tar czf file.tar.gz files Creates a tar with gzip compression

$ gzip file Compresses the file and renames it to file.gz

 

Networking Stuff:

$ ifconfig -a Display all network ports and ip address

$ ifconfig eth0 Display specific ethernet port ip address and details

$ ip addr show Display all network interfaces and ip address(available in iproute2 package,powerful than ifconfig)

$ ip address add 10.0.0.1 dev eth0 Set ip address

$ ethtool eth0 Linux tool to show ethernet status

$ mii-tool eth0 Linux tool to show ethernet status

$ ping host Sends echo request to test connection

$ whois domain Get who is information for domain

$ dig domain Get DNS information for domain

$ dig -x host Reverse lookup host

$ host google.com Lookup DNS ip address for the name

$ hostname -i Lookup local ip address

$ wget file Download file

$ netstat -tupl Listing all active listening ports(tcp,udp,pid)

$ ssh user@host Connects to host as user

$ ssh -p port user@host Connects to host using specific port

$ telnet host Connects to the system using telnet port

 

Permissions:

$ chmod 777 /data/test.c Sets rwx permission for owner , rwx permission for group, rwx permission for world

$ chmod 755 /data/test.c Sets rwx permission for owner,rx for group and world

$ chown owner-user file Changes the owner of the file

$ chown owner-user:owner-group file-name Changes the owner and group owner of the file

$ chown owner-user:owner-group directory Changes the owner and group owner of the directory

 

Process Management:

$ ps Displays your currently active processes

$ ps aux | grep ‘telnet’ Finds all process id related to telnet process

$ pmap Memory map of process

$ top Display all running processes

$ kill pid Kill process with mentioned pid id

$ killall proc Kill all processes named proc

$ sleep 10 & Sleeps at the background

$ kill ‘JobNumber ‘ Terminates the job

$ jobs Display the jobs

$ pkill processname Send signal to a process with its name

$ bg Resumes suspended jobs without bringing them to foreground

$ fg Brings the most recent job to foreground

$ fg n Brings job n to the foreground

 

Useful File Commands:

$ cd .. To go up one level of the directory tree

$ cd Goes to $HOME directory

$ cd /test Changes to /test directory

$ ls gives the contents of a folder.

$ ls -a gives all the contents of a folder.

$ mkdir FolderName creates the folder FolderName.

$ cd Directory makes the Directory current directory

$ pwd prints the working directory

$ cp ~/Desktop/Berk/backups/science.txt . copy science.txt to the current directory

$ mv backups/science.txt /Desktop/Emi moves science.txt to folder Emi

$ rm temp.txt removes the temp.txt file

$ clear clear screen

$ cat science.txt Display contents of a file on the screen

$ less science.txt Displays on a different page ( type q to close the page)

$ less science.txt and then /name finds the occurences of name

$ head science.txt displays the first ten lines of the file

$ tail science.txt displays the last ten lines of the file

$ tail -20 science.txt displays the last 20 lines of the file

$ grep ‘searchedkeyword’ science.txt searches and finds the keyword in the file.(case sensitive)

$ grep -i SeaRchEdKeyWoRd science.txt case insensitive search

$ grep -i ‘SeaRched Sentence is this one’ science.txt case insensitive search

instead of i we can use;
-n precede each matching line with the line number
-v display those lines that do not match
-c print only the total count of matching lines

$ find -name “*.txt” -print finds the text files in the current directory

$ diff a.txt b.txt gives the different lines

$ wc -w science.txt gives the word count

$ wc -l science.txt gives the line count

$ cat > list1
pear
banana

ctrl+d

creates a list and we can print this list by using:

$ cat list1 command line.

$ cat biglist | grep p | sort gives sorted list elements which include p

$ sort < biglist > sortedlist sorts the biglist and writes it to the sortedlist

$ ls list* outputs the filenames starting with ‘list’

$ ls *list outputs the filenames ending with ‘list’

$ ls ?un outputs the filenames ending with ‘un’ but just one letter. (e.g. sun, gun, bun)

$ man ____ gives information about the command in the underlined section.

$ whatis ____ gives information about the command in the underlined section.

$ ls -l gives detailed information about the gfiles in the directory

u:user
g:group
o:other people
rwx: read write execute
rw: read write
r: read
x: execute

$ chmod u+x TheFile adds writing permission to the user(owner) of TheFile

$ chmod go-rwx biglist to remove read write and execute permissions on the file biglist for the group and others

$ chmod 754 TheFile 7, 5, 4 represents the individual permissions for user, group, other (7:rwx, 5:rx, 4:r)

4 – stands for “read”
2 – stands for “write”
1 – stands for “execute”
0 – no permissions

$ du -s * The du command outputs the number of kilobyes used by each subdirectory.

$ df . The df command reports on the space left on the file system.

$ gzip science.txt Compresses into a gzip file

$ gunzip science.txt.gz De-compresses into the original file

$ tar cvf New.tar addthisfileintotar Create a tar file called New and add this file.

$ tar xvf New.tar Extracts the tar file

$ zcat science.txt.gz reads zipped files without unzipping

$ file * Classifies the files in the current directory ( folder, text, gzip, etc.)

$ name=Berk
$ echo Hello $name Prints ‘Hello Berk’

$ sha1sum FileName | grep e509760917361307015 Compares the checksum of a downloaded file and the calculated one.

$ gpg -c file Encrypts file

$ gpg file.gpg Decrypts file

 

User Related:

$ id Shows the active user id with login and group

$ last Shows last logins on the system

$ who Shows who is logged on the system

$ groupadd admin Adds group “admin”

$ useradd -c “Jermal Smith” -g admin -m sam Creates user “sam” and adds to group “admin”

$ userdel sam Deletes user sam

$ adduser sam Adds user “sam”

$ usermod Modifies user information

 

System Statistics:

$ top Displays the top CPU processes (Ctrl+C to exit)

$ vmstat 2 Displays virtual memory statistics

$ sudo tcpdump -i eth0 Captures all packets flows on interface eth0

$ sudo tcpdump -i eth0 ‘port 80’ Monitors all traffic on port 80 ( HTTP )

$ lsof Lists all open files belonging to all active processes.

$ lsof -u myuser Lists files opened by specific user

$ watch df -h Shows changeable data continuously

 

System Info:

$ uname -a Displays Linux system information

$ uname -r Displays kernel release information

$ uptime Shows how long system running + load

$ hostname Shows system host name

$ hostname -i Displays the IP address of the host

$ last reboot Shows system reboot history

$ date Shows the current date and time

$ cal Shows this month calendar

$ whoami Shows who you are logged in as

 

Hardware Info:

$ dmesg Detected hardware and boot messages

$ cat /proc/meminfo Hardware memory information

$ cat /proc/cpuinfo CPU model information

$ cat /proc/interrupts Lists the number of interrupts per CPU per I/O device

$ sudo lshw Displays information on hardware configuration of the system

$ lsblk Displays block device related information in Linux (sudo yum install util-linux-ng)

$ free -m Displays used and free memory (-m for MB)

$ lsusb -tv Shows USB devices

$ dmidecode Shows hardware info from the BIOS

$ hdparm -i /dev/sda # Shows info about disk sda

$ hdparm -tT /dev/sda # Do a read speed test on disk sda

$ badblocks -s /dev/sda # Test for unreadable blocks on disk sda

 

How to Remove Users From the Office 365 Deleted Users

And… its time to purge those 365 deleted users. Although we can wait for the retention policy to do it for us. I wanted to do this “now”.

I had wrote the following steps in the past and thought I would share here.

[Press Start]

To delete the account for one or more users

Sign in to Office 365 with your work or school account.

Go to the Office 365 admin center.

Go to Users > Active Users.

Choose the names of the users that you want to delete, and then select DELETE Delete.

In the confirmation box, select Yes.

Done!

[Pause]

Well, not so fast. The deleted users is not fully gone yet. It takes 30 days after you have deleted the user for it to purge from Office 365. However there is a way to do this faster

[Press Start]

Connect to Exchange Online using the Windows Azure Powershell module.

To connect you enter the following cmdlet’s:

  1. Store your credetials (this is stored in memory): $msolcred = get-credential
  2. Connection to Office 365: connect-msolservice -credential $msolcred

Once connected you can issue the following command to list deleted users:

get-msoluser –returndeletedusers -maxresults 100

To remove a deleted user permanently:

remove-msoluser –userprincipalname UID@UPN.com -RemoveFromRecyclebin

If you had multiple users, the following cmdlet would work to remove all deleted users recycle bin:

get-msoluser –returndeletedusers -maxresults 100 | remove-msoluser -removefromrecyclebin -force

That’s it… Your done. Good Luck

Original Post of mine can be found here

Quick How To Share a Document with OneDrive for Business


You can share file(s): Documents and such with Onedrive for Business

1.      In the file list, right-click a document, or select a document and then select Share.

2.      Select Get a link.

3.      Choose who to share with, and if they can view or edit the file.

4.      To share with people inside your organization, choose:

5.      View link – account required – people inside your organization can view, copy, or download the document.

6.      Edit link – account required – people inside your organization can edit, copy, or download the document.

7.      To share with people outside your organization, choose:

8.      View link – no sign-in required – people outside your organization can view, copy, and download the document.

9.      Edit link – no sign-in required – people outside your organization can edit, copy, and download the document.

10.  For external links, select SET EXPIRATION, and choose when you want the link to expire.

11.  Click Copy and paste the link in an email or post it.

Note: Links created that don’t require a sign-in can be opened by anyone, so make sure the content can be shared publicly. Consult your Corporate Information Security Policy and IT if needed.

Note: Sharing of folders is not possible at this time.

In Place Upgrade Of Windows Server 2008 R2 Standard

If you have a need to upgrade a server running Windows Server 2008 R2 Standard to either the Enterprise, or Datacenter edition, it’s possible to do so online, without re-installing Windows. This not only a simple process, it saves you time.

Open an elevated command prompt and type DISM /Online /Get-CurrentEdition. This returns the current Windows version.

Type DISM /Online /Get-TargetEditions to list the Windows editions to which this server can be upgraded to.

Type DISM /Online /Set-Edition:ServerDataCenter /ProductKey:xxxxxx will upgrade the operating system. All that’s required to complete the upgrade is a reboot.

Done!

Ref Info:

DISM Windows Edition-Servicing Command-Line Options – https://technet.microsoft.com/en-us/library/hh825157.aspx

KMS Client Setup Keys – Link

Office 365 IRM & Azure Rights Management

I recently configured IRM to protect documents and email communications as part of a security initiative.

Information Rights Management (IRM) in Exchange Online uses Active Directory Rights Management Services (AD RMS), an information protection technology service in Office 365. IRM protection is applied to email by applying an AD RMS rights policy template to an email message. Usage rights are attached to the message itself so that protection occurs online and offline and inside and outside of your organization’s firewall

Need to know info:

  • Time to complete this task: 30-60 minutes
  • You need to be assigned admin permissions to manage IRM
  • Knowledge of using Windows PowerShell to connect to Exchange Online

Steps Taken:

Step 1: Activating Azure Rights Management

  1. Log into the Office 365 admin center
  2. In the left pan expand the services settings
  3. Click Rights Management
  4. On the Rights Management page, click Manage
  5. On the Rights Management page, click Activate
  6. You will be prompted with the question: Do you want to activate Rights Management? click activate.

You should now see Rights Management is activated

Step 2: Using Exchange Management Shell to log into Office 365

Here I use PowerShell ISE to step through he process

# Login to the Office 365 Account

Set-ExecutionPolicy RemoteSigned

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session

Step 3: Use the Exchange Management Shell to configure the RMS Online key sharing location in Exchange Online

#Displaying the IRM Configuration

Get-IRMConfiguration

# List of Locaitons

#North America https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc

#European Union https://sp-rms.eu.aadrm.com/TenantManagement/ServicePartner.svc

#Asia https://sp-rms.ap.aadrm.com/TenantManagement/ServicePartner.svc

#South America https://sp-rms.sa.aadrm.com/TenantManagement/ServicePartner.svc

#Office 365 for Government (Government Community Cloud) https://sp-rms.govus.aadrm.com/TenantManagement/ServicePartner.svc

Set-IRMConfiguration -RMSOnlineKeySharingLocation “https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc”

#Checking that the configraiton was applied

Get-IRMConfiguration

Step 4: Importing Trusted Publishing Domain (TPD) from RMS Online

Import-RMSTrustedPublishingDomain -RMSOnline -name “RMS Online”

Test-IRMConfiguration -RMSOnline

Step5: Enabling IRM in Exchange Online

Set-IRMConfiguration -InternalLicensingEnabled $true

Step 5: Testing the IRM configuration

Get-IRMConfiguration

Test-IRMConfiguration -Sender jsmith@jermsmit.tld

Expected Results should show that each area verified has passed

Ref Links:

https://technet.microsoft.com/en-us/library/jj983436(v=exchg.150).aspx

https://support.office.com/en-us/article/Set-up-Information-Rights-Management-IRM-in-SharePoint-admin-center-239ce6eb-4e81-42db-bf86-a01362fed65c

Summery  image of my PowerShell ISE

 

How do I remove the Windows.old

After a recent update of my Windows 10 installation, I was left with the expected Windows.old folder containing 16 GB of old data.

It’s time to clean up.  Here are the steps I followed to make this happen.

Steps:

  1. Click in Windows’ search field, type Cleanup, then click Disk Cleanup.
  2.  Click the “Clean up system files” button.
  3. Scroll down the list until you see “Previous Windows installation(s).”
  4. Check the box next to the entry. Click OK to start the cleanup.

 

VMware vCenter 6 Phantom Snapshots

I’ve been using vCenter 6 for a while now and noticed an odd issue pertaining to snapshots. It seems that all guest show a “revert to current snapshot” state even if a snapshot does not actually exist.

However viewing under the Snapshot Manger… shows no existing snapshots associated with the virtual machine guests.

I’ve noticed this this issue does not exist when using the vSphere Web Client.

These symptoms have been confirmed by VMware official in the following KB: https://kb.vmware.com/kb/2111363

For now there are no resolution steps…

Symptom Recap:

  • There are no snapshots on virtual machine(s).
  • Virtual machines show Revert to current snapshot (right-click on the virtual machine > Snapshot > Revert to current snapshot) enabled in vSphere Client when connected to the vCenter Server 6.0.
  • When viewing the Snapshot Manager (right-click on the virtual machine > Snapshot > Snapshot Manager) for the virtual machine in the vSphere Client, there are no snapshots present.
  • Directly logging into the ESXi host using the vSphere Client shows the Revert to current snapshot grayed out.
  • Creating and deleting a snapshot does not resolve this issue.
  • In the vSphere Web Client Revert to current snapshot appears grayed out.

Work around: 

  1. Ignore the vSphere Client results and use the vSphere Web Client
  2. Use PowerCli to display snapshots.

Example command I like to use:

 

ntopng on Ubuntu 14.04

I just completed my ntopNG appliance setup. Once more I can look into my network traffic to get an idea of what’s going on.

Below you will find the steps to complete the install

Here are the steps

Log into the ubuntu server host and issue the following commands:

  1. sudo into root: sudo -i
  2. wget http://www.nmon.net/apt-stable/14.04/all/apt-ntop-stable.deb
  3. dpkg -i apt-ntop-stable.deb
  4. apt-get update
  5. apt-get -y install pfring nprobe ntopng ntopng-data n2disk nbox
  6. service apache2 restart

The steps provided here are the official ntop.org directions for their stable build packages.

Please note you will need to have a management and monitoring interface for your configuration.

In my configuration, I will be listening on a mirrored port to capture network traffic to be displayed under ntopNG

 

Are you interested in learning more about Ubuntu.  Check out the following book:  Ubuntu Unleashed 2016 Edition

Using Get-SPWebTemplate to list available site templates in SharePoint 2013

In this tech-short we will go over a simple yet effective way to list out the available site templates in SharePoint 2013.

Using the New-SPSite PowerShell cmdlet allows you to specify the name of a template to use. In my case I was unaware of the name of available templates in my SharePoint installation.  Using the Get-SPWebTemplate command to produce a list for me.

Steps

  1. Open the SharePoint 2013 Management Shell
  2. The the following command: Get-SPWebTemplate | Sort-Object “Name”

The results are a list Templates which could be used in this environment.

 

If you wanted to do the same with PowerShell locally or remote the following steps can be taken.

Open PowerShell and issue the following commands:

  1. New-PSSession -ComputerName SharePoint
  2. Add-PSSnapin Microsoft.SharePoint.Powershell
  3. Get-SPWebTemplate | Sort-Object “Name”