Technical blog of Rafael Wolf
If anyone is looking to do a repair on their outlook but can’t find scanpst.exe well here it is ;)
If anyone else has other version let me know where to download and I can host it on my site for them and you!
scanpst.exe for Outlook 2007 – 7-zip archive: Download (1.3 MB)
Thanks!
So you’re having a problem restoring a CloneZilla disk image via SSH / SFTP server eh? Well you’re in for a treat! If this helped you why not toss me a $5’er via my PayPal?
The fix:
Look at your SSH server users home directory. If you have your “image” which is usually in a FOLDER you need to NOT make your home directory on your SSH server the folder with the image in it.
For example: If your image is in a path and folder called: C:\Temp\xp.2017-03-01-14-img <– in that directory you may have gz files or other “img” types of files including text files, etc…lots of stuff most likely.
If you have your home folder set at this: C:\Temp\xp.2017-03-01-14-img – CloneZilla looks for DIRECTORIES inside of there that have files and THUS – since there are NO directories inside of the xp.2017…folder, IT WILL ERROR!
Now, if you make your home directory “C:\Temp” CloneZilla FIND the directory named: xp.2017-03-01-14-img <– THEN IT WORKS!
So all you SSH’ers…make sure your home directory on your ssh server is set to where your FOLDER is but not that folder WITH THE IMAGE in it!
If you’re on Linux your home folder might be something like: /home/$youruserhere$/some_sub_dir
* Since Linux users are usually pimpin power users of systems I assume most of what I’m saying makes total sense but if you’re a Windows derp you might need some hand holding :P
As a side in my use case I forgot my stupid USB disk that had the image on it for the machine I was restoring BUT there was a copy of it on a Windows machine (not domain connected). The easiest thing was to stand up a Windows based SSH server on that PC with the image of it (hence my example of a home directory as a Winderps path) and I found a great one after slugging through a few losers programs. Rebex has a great, simple to use Windows based SSH server: http://labs.rebex.net/tiny-sftp-server
Make sure to read the “readme” file they provide and you can edit the .conf file in notepad (but the defaults are great beside the path to your image folder). Default user and pass is: tester and password. Perfect for my short term use! Be sure to set your home path properly <– can’t stress this enough obviously!
This actually took me about an hour to figure out AND nobody and I mean NOBODY on the forums properly answered this question (IMHO).
I had this CPanel problem today, actually it’s been for quite some time but I didn’t get around to checking it until lately.
My CPanel server was in a compromised state, there was an old Sugar CRM installed on a virtual host that was quite old. That page got hacked and subsequently that virtual domain got hacked.
Long story short is it took me about 2 hours (it feels like) to tack things down, delete / move those compromised pages and kill the process sending out spam.
In the end run this commands:
ps -C exim -fH eww
Now, if you see “mailnull” running, KILL IT!
kill pid <– here
This is my output for the ps command:
UID PID PPID C STIME TTY STAT TIME CMD
mailnull 32274 1 0 12:15 ? Ss 0:00 /usr/sbin/exim -bd -q60m
I’d also recommend just checking your crontabs in any compromised account to make sure something won’t come back on you!
Supportexpertz posts here had a great script to iterate through all the users and show their crontabs and how to implement / run it! Thanks!
http://www.webhostingtalk.com/showthread.php?t=885195
I needed to migrate a Windows XP box because it has a special piece of software…what special piece of software you ask? A real museum piece! Lotus 1-2-3 with a special quote form I didn’t have time to migrate into something more contemporary.
I ran into lots of issues, here’s how I worked past those issues and made it happen:
* Fair warning here, you MAY have to re-register Windows when it boots up (I had to for XP but it worked to do so)
First: Read the how to from VirtualBox: https://www.virtualbox.org/wiki/Migrate_Windows
* After renaming the agp440.sys and the intelppm.sys then running the MergeIDE bat file image the machine per their instructions
1 – Make an image of the current physical box with clonezilla. It will bust it up into different size files, the default is 2000 megabytes (2 gig chunks). I’d make it much larger, if you have an 80 gig drive make it 85000 (85 gig just to be safe). I didn’t happen to do that but I think it’s an arbitrary thing ultimately since when you read the image back into the disk clonezilla automatically does it’s thing regardless of chunk size.
2 – Create a new XP virtual machine in VirtualBox (can’t hold your hand on this one…it would take too long to tell you how to do that so I assume you’re not a total derp and you can manage this step).
3 – Select the new XP image > settings > storage > select the CD drive (Empty) > Click the drop down to the far right of “Optical Drive” and select your clonezilla ISO (I assume you have this in a folder on the new machine running VirtualBox).
4 – Boot the machine and image your saved image back to the virtual drive. Once done shut the machine down.
5 – Here’s where I ran into a lot of problems on boot up:
Virtual Box boots up and it’s just a black screen. For this you need to be quick on the draw and hit F8 repeatedly to bring up the safe mode prompt. Then boot into safe mode, you should see either more black screen OR files flying accross the screen.
If you also see the lines at the bottom just haning there and doing nothing this is also the fix for this problem:
I found that in c:\windows\inf\ <– that folder on my imaged machine was EMPTY! Copy the data from your old physical box into your new one. I had to rename the INF folder to INF.kill > make a new INF folder then dump my files in there. You might also want to delete any “oem” inf files, in Linux you can do a: “ls | grep oem” to see the files with oem in their names then “rm -f oem*.inf” to delete all the INF files, note there are “PNF” files still left. I left those…not sure what they’re for!
Once you do that…more problems but we can fix them.
I got a blue screen that said: {Registry File Failure}:
Good one! It says: \SystemRoot\System32\Config\DEFAULT or its log or alternate. It is corrupt, absent, or not writable.
All you need to do here on XP is restore the registry backup! In c:\windows\system32\config there’s a file named “default” and “default.save”. Rename the “default” to “default.kill” so the system won’t look at it then rename “default.save” to “default”. The .save file is your registry’s “last known good” ;)
You can also go to your old physical box > boot up a Linux Live disk > migrate to that folder and copy your current “default” file onto removable media (USB disk) > then sneaker net it over to your other box > overwrite the default in the c:\windows\….config folder.
Reboot! Try safe mode just to be safe.
Success (at least for me). You then login and you get errors about: “The file or directory c:\windows\system is corrupt and unreadable. Please run the Chkdsk utility.”.
** Fair warning again – this totally HOSED me when it booted up because when it booted up it didn’t want to run the registration wizard so I re-did the migration knowing what to check (see above notes so far) and it went perfectly the second time…I think the original image back was borked since the INF folder was empty and the registry file was bad.
Computer > right click c: > properties > tools > error checking > check both boxes > start > reboot
Windows will go through a litany of file systems checks and repair the error. Windows should now come up normally.
After that’s all done > install your guest additions > make sure your drivers area good and things work. If it mostly works I’d call it a success!
One last thing – you need to delete any OEM inf files in c:\windows\inf folder > you can ignore the *.pnf files. Delete all the OEM one’s. When I booted up my Live Linux distro I went to the terminal > cd’d to the directory (wherever yours mounts it) then did a:
ls | grep oem
or you might need to do: ls | grep OEM
Just to make sure you have all the oem INF files in the list and your syntax is correctly typed THEN you can do: rm -f oem*.inf <– enter
Done!
Now reboot and let it boot up normally.
This is basically what I did – just do it! You have the saved image and as long as it imaged correctly you can do this all day ;)
OpenFire Web Chat confusion abounds online. It drives me FREAKING CRAZY all the incompetence online lately and when I search for stuff I have to thread bits and pieces I find into a workable tapestry that THEN works.
It is taking all my strength not to %&*#*’ing swear and lose all “professionalism” as it makes me feel better!!!
Anyway…
So you installed Ignite Realtime Chat and now what? My reference to get started was this blog: http://www.unixmen.com/install-openfire-ubuntu-12-04-lts – not quite what I needed since any sane person setting up a server wouldn’t put a desktop on it nor would you access it then from a local host address. It was a good start though and I got the JDK install string from them so eah, I’ll throw them a bone.
First:
Install Ubuntu Linux LTS 14.xx
Install JDK (Java): apt-get install openjdk-7-jre
Go here and download the .deb file for Debian – Ubuntu is based on Debian: http://www.igniterealtime.org/downloads
Note you can also do like I do and make a temp directory, I have a habit of doing that here:
mkdir /var/ftp
cd /var/ftp
Then you “wget” the file which when I did this it was the 4.0.1 version: wget http://download.igniterealtime.org/openfire/openfire_4.0.1_all.deb
Then do: dpkg -i openfire_4.0.1_all.deb
Go to your hostname in your browser and configure the install: http://yourhostname:9090. Note that if you want to access it in the future use port 9091, I think it’s disabled by default I’m not sure, I quickly used 9090, went through the install and then accessed it on 9091. You’ll want to get a legit SSL cert too eventually.
Now, that we’ve got it installed and YES it’s that freaking easy. Done! You can do a command to see where it’s installed, “whereis openfire”. Note those two paths.
Second:
Install a few pluggins, go to: plugins > available plugins: Fastpath Service, and Fastpath Webchat. Where the HELL is the fastpath webchat plugin? %&*#*’ing hell some moron in their infinite wisdom doesn’t list it on the plugins page! Who knows why the gods themselves did so, supposedly because of technical security issues, whatever. You need to go to the forums and download the stupid thing. Can you believe that? WTF!!!??? Here is the forum url: https://community.igniterealtime.org/thread/51024. Again, are you f’ing kidding me? The war file is here: https://community.igniterealtime.org/servlet/JiveServlet/download/221248-16051/webchat.war so you can go do this to “install” the plugin:
cd /usr/share/openfire/plugins
wget https://community.igniterealtime.org/servlet/JiveServlet/download/221248-16051/webchat.war
Done! Now go to the “plugins” tab and you should see fastpath and fastpath webchat!
Now, go to the fastpath tab > create a workgroup > do your thing > put your user into that workgroup, I deleted all the default crap and made my own. I can’t hold your hand too much on this one…it would take too long and I’m not that committed to hand holding – be a good admin and figure it out ;-) I got you this far!
Third:
The next thing is your HTML for the “chat button” on your website. See if you can see your jive script file here: http://yourhostname:9090/webchat/jivelive.jsp
…I’ll finish this momentarily, I have to work on something else.
I installed a DokuWIKI with https on Ubuntu 14. It’s pretty straight forward however I rand into a small issue where search wasn’t yielding any results.
To fix this I found this article about using the indexer.php file from the command line.
https://www.dokuwiki.org/cli
What you do then is:
cd /var/www/bin… <- where your dokuwiki is installed, mine was installed in the root of www but most of the time you’ll find it in a /var/www/doku folder I think
chmod +x indexer.php
This makes the script executable. You can test it to see if it works by typing cd .. > ./bin/indexer.php. You should see it index. Now your search works. So what we now need to do is schedule that script to run. It’s supposed to run with some pixel and when you update a page but for me, that’s not working and I don’t have time to figure that out so this is the quickest fix I can live with.
I usually make a folder in /var called ftp and put my notes, scripts and downloads into that folder…it’s an old habit. You can put your script wherever you want, change the paths accordingly.
Create a script that we can put into a cron.
I usually do this to create the file:
touch /var/ftp/indexer.sh
nano /var/ftp/indexer.sh
Paste the below script contents into that file:
#!/bin/sh
cd /var/www/bin
./indexer.php
Save it.
Then type: crontab -u www-data -e
* This is on Ubuntu anyway, you need to run the script as www-data or else it seems perms to the files get changed to “root” and it messes up the ability to save the meta information (wiki changes). Reference: StackOverflow http://stackoverflow.com/questions/8475694/how-to-specify-in-crontab-by-what-user-to-run-script
Choose 2 > nano as your editor, it is the easiest editor in the list.
For our crontab put this in to run the indexer every 4 hours:
0 1,4,8,12,16,20 * * * sh /var/ftp/index.sh
Mind the space between the zero and the 1. The zero means to kick it off at 1:00 for example, 4:00…if I had a 5 in there it would be 1:05 or 4:05.
I recently brought email “in house” for a client. The setup they had was:
mail going to their web hosting provider (CPanel web host) > they then had their email server (Exchange 2003) setup with a pop3 connector that would pop email down every 15 minutes to user inboxes > users would then get their email.
This setup is less than ideal primarily because:
Ideally it should be as direct as possible and in your control as much as possible.
The solution I came up with was to replace their lame Netgear VPN firewall which was not a real solution because of how limited and inflexible it is with a far more flexible and feature rich open source firewall called PFSEnse. We’ve got almost 30 of these deployed for a number of clients in various configurations depending on their needs.
What we needed then was an anti-spam solution since the one benefit of the CPanel pop connector solution was that server did a bulk of the filtering for viruses, malware (I assume) and spam.
We used postfix forwarder and connected it to active directory which worked PERFECTLY however, I wasn’t able to figure out how to filter out zip file and other attachments. Eventually I found the solution and you can too if you check out their forums BUT what wasn’t clear was clamav and updating it.
As it stands, clamav doesn’t get automatically updated and you have to make a cron separately to do it.
So from the console do this:
That should update clamav definitions every 4 hours, the first * = minutes, the second section with the 0,4, 8…etc is the hours in the day so at midnight (0 hours) it runs freshclam which fetches clamav updates.
I’d recommend using: PFSense + postfix forwader + mailscanner
It seems like mailscanner started blocking zip file attachments (among others) and anything it missed, the postfix forwader header and mime mods I made also caught some. In addition to the RBL’s it’s a solid system.
Note that in mailscanner you’ll get a footer in a blocked piece of content like this: “For all your IT requirements visit: http://www.transtec.co.uk“
That’s because those guys sponsor mailscanner I guess (or develop it, not sure) and you can edit that out on PFSEnse x64 bit in this directory, all the report text files have it at the bottom:
/usr/pbi/mailscanner-amd64/local/share/MailScanner/reports/en
* Assuming you use the English version, if not it’s a directory higher and in the language you chose in the setup
The setup they now have is: Email to their firewall which runs postfix forwarder tied to active directory for valid recipient checking > mailscanner to check for viruses, spam and bad attachments > postfix forwarder for more checking > user inbox. It’s a fast, more direct and realtime method without much delay, certainly not 15 minutes! LOL!
I had a client recently get Vonage Business. We’re using a PFSense which is in my honest opinion, “Enterprise Class”. It scales like no other for the price!
I’m going to document my troubleshooting, more to come. My client was experiencing voice jitter, voice fading and call dropping on occasion.
The first thing I did was a trace route. Linux that command is: traceroute hostname, Windows it’s: tracert hostname. In my example I trace routed to the SIP provisioning IP / host name of Vonage which at the time of writing is: prov.vocalocity.com.
I did the trace route on CTS Telecom (Fiber), Charter and Comcast. The interesting thing is that on CTS and Charter it worked from start to finish!
I’m removing the first 5 hops so you don’t know where I live :P Stalkers!
Charter HOME connection trace:
traceroute to prov.vocalocity.com (205.139.46.227), 30 hops max, 60 byte packets
…
6 lag-200.ear3.Chicago2.Level3.net (4.35.108.149) 50.797 ms 42.233 ms *
7 ae-1-3501.edge4.Chicago3.Level3.net (4.69.203.254) 41.505 ms ae-14-3604.edge4.Chicago3.Level3.net (4.69.204.166) 20.111 ms 20.375 ms
8 208.174.226.209 (208.174.226.209) 21.629 ms 21.607 ms 21.618 ms
9 cr2-tengig-0-5-3-0.chd.savvis.net (206.28.96.5) 19.501 ms 50.857 ms 57.366 ms
10 206.28.97.129 (206.28.97.129) 76.101 ms 74.702 ms 75.813 ms
11 hr1-te-1-0-0.atlantaat1.savvis.net (204.70.197.157) 74.757 ms 72.764 ms 74.133 ms
12 das1-v3006.at1.savvis.net (205.139.48.54) 64.993 ms 64.200 ms 64.097 ms
13 63.128.70.218 (63.128.70.218) 62.473 ms 52.542 ms 51.231 ms
14 * * *
15 * * *
16 * * *
17 * * *^C
…it never finishes!
Notice I preface this with a HOME connection…why? Because the business Charter is DIFFERENT!
Charter BUSINESS trace:
Tracing route to prov.vocalocity.com [205.139.46.227]
over a maximum of 30 hops:
…
6 18 ms 15 ms 15 ms bbr01aldlmi-bue-1.aldl.mi.charter.com [96.34.2.8]
7 * * * Request timed out.
8 30 ms 22 ms 22 ms ae-2-3601.edge4.Chicago3.Level3.net [4.69.203.230]
9 20 ms 22 ms 32 ms 208.174.226.209
10 21 ms 22 ms 21 ms cr2-tengig-0-5-3-0.chd.savvis.net [206.28.96.5]
11 38 ms 38 ms 38 ms 206.28.97.129
12 37 ms 38 ms 38 ms hr1-te-1-0-0.atlantaat1.savvis.net [204.70.197.157]
13 50 ms 45 ms 49 ms das1-v3005.at1.savvis.net [205.139.48.50]
14 40 ms 44 ms 55 ms 63.128.70.218
15 40 ms 38 ms 38 ms 205.139.46.227
16 37 ms 41 ms 38 ms 205.139.46.227
Trace complete.
It finishes and the ROUTES are different!
Charter must route their traffic differently based on home user or business.
Comcast was much like the Charter failures for home users:
5 te-0-4-0-19-ar02.pontiac.mi.
te-0-4-0-18-ar02.pontiac.mi.
6 be-33668-cr01.350ecermak.il.
7 c-eth-0-3-0-pe05.350ecermak.
8 ber1-tengig3-3.chicagoequinix.
9 cr1-tengig-0-5-3-0.chd.savvis.
10 206.28.97.129 (206.28.97.129) 52.204 ms 55.201 ms 48.346 ms
11 hr1-te-1-0-0.atlantaat1.
12 das1-v3006.at1.savvis.net (205.139.48.54) 49.561 ms 49.876 ms 56.578 ms
13 63.128.70.218 (63.128.70.218) 53.821 ms 58.421 ms 46.651 ms
14 * * *
15 * * *
16 * * *
17 * * *
I had to actually call Comcast tier 1 tech support – yes, the people who just tell you to reboot your router. Then, after discussing it with the tier 1 tech he logged into the modem I was on and did his own trace route. He said, it works for me. It finishes. I said, really – what IP address did you resolve to and get to? He told me and it was some IP address in the Netherlands! I then insisted he get this escalated because who in their right mind would do VOIP from the midwest to servers across the Atlantic ocean to the Netherlands? That makes no sense.
You have to push these guys to THINK!
After submitting my ticket, the trace routes FINALLY work like they should.
I can’t say this fixed my call quality issues but I’m still troubleshooting. These things take time BUT don’t EVER rule out the ISP’s network as possibly causing the problem. This is the 2nd time and ISP has had the problem with routing on their backbone that has affected service. The other time I dealt with Frontier about their backbone in Muskegon, MI – they were great about it and I actually talked to the guy who fixed it out of New York. I did an IP Who Is lookup which lists the maintainers email (that never works) and the telephone of the maintainer – which told me to call another number, then after a brief phone tree battle I got to the guy who fixed it!
Moving on…
I also updated / forced the phones on the network to use Google DNS servers, 8.8.8.8 and 8.8.4.4. I am trying that rather than the local DNS server and in favor of using Comcast’s which is 75.75.75.75 and 75.75.76.76. Comcast (believe it or not) DNS servers have 150 ms + ping times OMG! Google DNS servers; something like 20 ms or less, maybe a touch over BUT they’re fast. I don’t know if that will make a difference to the phone quality (probably not) but it’s another thing I’m touching and changing.
QoS might be next BUT once your traffic hits the public InternetS all bets for QoS are off. QoS is really for your local network and routing but my client is barely touching their WAN – they’re too busy working and nobody steams or uses the Internet for more than work.
I’ll update this as I move forward, I thought about SIP proxy with the PFSense and QoS on that SIP Proxy per some tutorials on the PFSense forum but haven’t gone there yet.
I had an interesting thing I hadn’t seen before on a VMware guest that was a Windows Server 2012 machine.
Symptoms:
System process (PID 4) 50% cpu or higher: vmware 5.x + server 2012.
I looked at another 2012 server and noticed it had the e1000 NIC in it and I remember when building this current server I had changed it to the vmxnet3 thinking, oh…vmnet3 NIC must be better than the e1000. I was wrong. I don’t think Server 2012 likes the vmxnet3 for whatever reason (driver related) regardless of whether you have VMware Tools installed or not because I did; and it wasn’t having problems. So I Changed the NIC from vmxnet3 to e1000.
Again; it’s related to a networking issue (References):
http://blogs.technet.com/b/yongrhee/archive/2009/08/07/how-to-troubleshoot-high-cpu-in-the-system-process.aspx
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1077
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2231
I don’t think any of those happen to actually say, switch from vmxnet3 to e1000 BUT that’s what I did and the problem went away!
I experienced something interesting the past week for a client. Slow performance on iSCSI, SAN and VMWare when large throughput or heavy network i/o was occurring. They had a setup like this:
VMware > All VM’s on a big fat volume iSCSI to the SAN > SAN < 1 TB volume
Inside the guest (Server 2012 for example), you then make an iSCSI connection to the SAN to run their db’s, file shares, etc. They were using Sage 2014 and it was VERY slow especially when printing or running reports. It took me what seemed like FOREVER to figure it out BUT in the end it was all about the MTU. If you don’t know what MTU is, go look it up :P
In the end make sure your MTU matches this with a Dell setup:
SAN interfaces = MTU 9000 (they had a Dell Equallogix PS4100 – that might be auto configured, I think it is)
Switch where SAN & VMWare connect = MTU 9252 (they had a Dell Force10 S60)
VMware = MTU 9000 (that means ALL vswitches)
Note that you ALSO want MTU on the interface where your VM’s talk to the rest of your network. For me that was the vmkernel port and the physical switch ports on the core switch that connected the physical to the virtual – MTU 9252.
There’s a decent kb from VMWare that pointed me in the right direction. Oh, I also believe I disabled the ACK on the VMware iSCSI connector inside the VMWare server based on another KB but this didn’t really help me as far as I know, I have not turned it back on. Again, check that out online if the MTU confirmation doesn’t work for you it might be the ACK on the iSCSI connector.