Aslam Latheef

Active Directory

How do I force replication in Active Directory?

10:07 AM

Linux

Setup Apache to forward java (*.jsp) requests from Apache to Tomcat

11:05 AM

Linux

Enabling Remote JMX

11:03 AM

Each application server has a slightly different process for enabling remote JMX Access. It's best to consult with your application server for specific instructions.

For a default tomcat install, one can simply add the following line at the top of server/tomcat/bin/catalina.sh after initial comments (remember, many customers or admins modify start up scripts to a great extent, but the principle of enabling JMX remains same)

CATALINA_OPTS="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=12345 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false"

One can then use JConsole (jconsole is available in openjdk software) to connect to <IP>:12345, where IP has to be replaced with host IP.

Note: You should ensure port 12345 is opened from where the host is monitored. So, if you are would like to monitor JMX values from a third party monitoring such as zenoss, make sure port is opened to zenoss.

Wondering why we used CATALINA_OPTS instead of JAVA_OPTS?

Read the comments in catalina.sh

JAVA_OPTS (Optional) Java runtime options needs to be used when the "start","stop", or "run" command is executed.

CATALINA_OPTS (Optional) Java runtime options used when the "start" or "run" command is executed.

You may encounter following error during tomcat shutdown:

Error: Exception thrown by the agent : java.rmi.server.ExportException : Port
already in use: 12345;nested exception is: java.net.BindException: Address already in use

To avoid error like this when shutting down tomcat, Port 12345 need not be in use while the instance is shutting down.

We are therefore using CATALINA_OPTS and disabling the exceution of this option during tomcat shutdown via "stop" in catalina.sh.

After the following lines in catalina.sh

elif [ "$1" = "stop" ] ; then

shift

FORCE=0

if [ "$1" = "-force" ]; then

shift

FORCE=1

fi

Change

"$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \

"$_RUNJAVA" $JAVA_OPTS \

This was actually a bug reported in apache site, you can find details for this issue at:

Tomcat shutdown bug while using JMX port

If you need JMX monitoring enabled via zenoss, please refer the following article:

Monitoring Using ZenJMX

Linux

Tomcat Cluster

11:24 AM

Clustering

How do I enable a bigger cluster log file?

11:44 AM

Cloud Computing

Best Practices for Windows 2003 Clusters

11:39 AM

The following is a checklist for common items that should be implemented or considered when you need to install a Windows based cluster for a customer:

Number of Cluster Nodes - typically this is (2) nodes but can go up to (4) node configurations within OpSource.
Number of NIC's - Network interfaces are often bonded together for fault tolerance. But, for a cluster, we usually require additional dedicated interfaces for cluster traffic. As a result, the recommendation is usually (2) NIC's one for internal cluster traffic and the other NIC for external application traffic.
Windows OS Type - When installing a cluster, you are REQUIRED to install Windows 2003 Enterrpise 32-bit or 64-bit
Shared Disk Partition(s) - A part of clustering involves usually a shared volume that is used to "float" amongst the nodes in a given cluster. Disks that are to be used for clustering then are required to be seen and owned by all nodes participating in the cluster. So, we typically use hte following mediums to achieve this:
1. DAS Storage via SCSI or SAS cable
2. SAN Storage via Fiber
SAN Storage Configuration - SAN storage LUN's should be created as distinctly separate LUN's so the proper redundancy can be achieved when a disk fails. This will prevent all partitions created for a cluster to be on the SAME LUN and thereby causing a bigger outage event of one of the disks were in a failed state for whatever reason.
DNS Naming - All names used by the cluster MUST be in DNS as both A and PTR records. This also includes any virtual or cluster management names setup for use by the cluster. If these names are not present, naming issues usually result and cause weird connection errors within the cluster.
Networking Configuration - By nature of the cluster, a minimum of (2) networks should be defined for a proper cluster configuration. One of these networks can be the TRUST VLAN setup by default. The other usually is a private non-routed network used solely for cluster communication. If there are (2) nodes in a cluster, you may opt for a cross over cable to achieve this. Otherwise, configuring a flat VLAN with no routing will suffice.
Uninstalling Internet Explorer Security Component - These add-on components usually cause major issues when installing the application portion of software specifially when an application tries to connect via CIFS or UNC to the remote server to run the installer. Uninstalling this component takes these sorts of issues out of the picture.
Security Patches - All cluster nodes should be at the same patch revision to ensure the same operating environment is maintained when failing over from one node to another.
Creation of AD SSO Objects - For any cluster setup, at a bare minimum, (1) service account is REQUIRED to act as a dedicated account that is not a named user so that the cluster can function across all nodes with the appropriate rights. Additional accounts are typically added as it applies to the application needs. For example, MSSQL usually requires 2-3 accounts for various services it maintains.
Assignment of Admin Rights to AD SSO Objects - Assigning administrative control or the like to the service accounts used for cluster operations is imperative to a properly configured setup. Avoid adding individual accounts on a per server basis but rather assigning them to AD Security Groups and then assigning those groups access to what is needed on the target cluster nodes.

Apache

Moving SSL Certs from IIS to Apache

11:18 AM

Moving SSL Certs from IIS to Apache

These instructions will help you convert SSL certificates generated for IIS to private key, and cert files you can use on unix, or Apache for windows.

First Export your IIS certificate into a pfx file (this is something you should do anyways for backup)

Run mmc.exe
Click the 'Console' menu and then click 'Add/Remove Snap-in'.
Click the 'Add' button and then choose the 'certificates' snap-in and click on 'Add'.
Select 'Computer Account' then click 'Next'.
Select 'Local Computer' and then click 'OK'.
Click 'Close' and then click 'OK'.
Expand the menu for 'Certificates' and click on the 'Personal' folder.
Right click on the certificate that you want to export and select 'All tasks' -> 'Export'.
A wizard will appear. Make sure you check the box to include the private key and continue through with this wizard until you have a .PFX file.

Next run openssl to extract the private key, and the cert file.

Export the private key file from the pfx file

openssl pkcs12 -in filename.pfx -nocerts -out key.pem

Export the certificate file from the pfx file

openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

This removes the passphrase from the private key so Apache won't prompt you for your passphase when it starts.

openssl rsa -in key.pem -out server.key

Active Directory

How do I export a list of users who belong to a specific AD group?

10:05 AM

Active Directory

How to open firewall ports for Active Directory in Hybrid Cloud

10:18 AM

Labels

How do I force replication in Active Directory?

Initiating Replication Using the Sites and Services Manager Snap

Using ftp in iad03

Using FTP in IAD03

Setup Apache to forward java (*.jsp) requests from Apache to Tomcat

Enabling Remote JMX

Tomcat Cluster

System Requirements

Network Requirements

Configuring Tomcat for Cluster

How do I enable a bigger cluster log file?

Best Practices for Windows 2003 Clusters

Moving SSL Certs from IIS to Apache

Moving SSL Certs from IIS to Apache

How do I export a list of users who belong to a specific AD group?

How to open firewall ports for Active Directory in Hybrid Cloud

Daily Views

About me

Search This Blog

Blog Archive

Popular Posts

Contact Form

Translate

Wikipedia