PEM Certificate description & Import

 While we try to upload the PEM Certificate to ACM or Listener Certificate for LB

We need to upload the Private Key and Certificate Body to the Certificate manager

We can easily identify the Private Key from the PEM file whereas for Certificate Body we need to use PTI-Intermediate Certificate.

# Private key of the SSL certificate
-----BEGIN PRIVATE KEY-----
Blah Blah Blah

-----END PRIVATE KEY-----

# Public key of the SSL certificate (the server certificate)
-----BEGIN CERTIFICATE-----
Blah Blah Blah
-----END CERTIFICATE-----

# Trust chain intermediate certificate
-----BEGIN CERTIFICATE-----
Blah Blah Blah
-----END CERTIFICATE-----

# Trust chain root certificate
-----BEGIN CERTIFICATE-----
Blah Blah Blah
-----END CERTIFICATE-----

We can extract the private key form a PFX to a PEM file with this command:
# openssl pkcs12 -in filename.pfx -nocerts -out key.pem
Exporting the certificate only:
# openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem
Removing the password from the extracted private key:
# openssl rsa -in key.pem -out server.key

Import (AWS CLI) - [Credits to AWS Doc]
The following example shows how to import a certificate using the AWS Command Line Interface (AWS CLI). The example assumes the following:
The PEM-encoded certificate is stored in a file named Certificate.pem.
The PEM-encoded certificate chain is stored in a file named CertificateChain.pem.
The PEM-encoded, unencrypted private key is stored in a file named PrivateKey.pem.
To use the following example, replace the file names with your own and type the command on one continuous line. The following example includes line breaks and extra spaces to make it easier to read.
$ aws acm import-certificate --certificate fileb://Certificate.pem \
      --certificate-chain fileb://CertificateChain.pem \
      --private-key fileb://PrivateKey.pem 

# To check the contents of the pfx file
openssl pkcs12 -info -in <PFX File>
WORKING SOLUTION :
To extract the certificates in PEM format from a PFX file, follow the below procedure:
Copy the PFX file to a Linux system with the OpenSSL utility installed.
Log on to that Linux system and navigate to the directory where the PFX file was copied in the previous step.
Execute the below commands to extract the certificates:
Extract the RSA Key from the PFX file:
$ openssl pkcs12 -in <PFX_file> -nocerts -nodes -out nutanix-key-pfx.pem
Extract the Public Certificate from the PFX file:
$ openssl pkcs12 -in <PFX_file> -clcerts -nokeys -out nutanix-cert-pfx.pem
Extract the CA Chain from the PFX file:
$ openssl pkcs12 -in <PFX_file> -cacerts -nokeys -chain -out ca-pfx.pem
Convert the RSA Key from PFX format to PEM:
$ openssl rsa -in nutanix-key-pfx.pem -out nutanix-key.pem
Convert the x509 Public Certificate and CA Chain from PFX to PEM format:
$ openssl x509 -in nutanix-cert-pfx.pem -out nutanix-cert.pem
$ openssl x509 -in ca-pfx.pem -out ca.pem
Download nutanix-key.pem, nutanix-cert.pem and ca.pem from the Linux system to a local desktop.
After following the steps above, the needed certificates and keys will be generated in preset working directory and it can be used as follows.
Private Key Type: RSA 2048-bit
Private Key: nutanix-key.pem
Public Certificate: nutanix-cert.pem
CA Certificate/Chain: ca.pem
openssl pkcs12 -in dsc-shop-uat.se.com.pfx -nocerts -nodes -out key-pfx.pem
openssl pkcs12 -in dsc-shop-uat.se.com.pfx -clcerts -nokeys -out cert-pfx.pem
openssl pkcs12 -in dsc-shop-uat.se.com.pfx -cacerts -nokeys -chain -out ca-pfx.pem
openssl rsa -in key-pfx.pem -out key.pem
openssl x509 -in cert-pfx.pem -out uat-wildcard.pem
openssl x509 -in ca-pfx.pem -out chain.pem
cat UAT\ Chain/UAT-SUBCA-01.cer > cert-chain.pem
cat chain.pem >> cert-chain.pem
cat cert-chain.pem


While import the Certificate: (Select IAM as import to)
Paste key.pem for Certificate private key (PEM encoded)
Paste uat-wildcard.pem to Certificate body (PEM encoded)
Paste cert-chain.pem to the Certificate chain (PEM encoded) - optional

##################
To Find the Expiry date for the certificate
##################
openssl x509 -in uat-wildcard.pem -noout -enddate
Incase if you face the below issue while try to extract
Error outputting keys and certificates
00DE31EC01000000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:341:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()
Please use legacy as on option,
$ openssl pkcs12 -in dsc-shop-uat.se.com.pfx -nocerts -nodes -legacy -out key-pfx.pem
$ openssl pkcs12 -in dsc-shop-uat.se.com.pfx -clcerts -nokeys -legacy -out cert-pfx.pem

Enable IP Forwarding for Docker

 By default even if we are able to communicate to outside world from linux, the communication will not happen from docker.

Add the following to /etc/sysctl.conf:

net.ipv4.ip_forward=1

then restart the network service.

sudo service network restart

Switch User(SU) without Password

 Switch user without password.

    In my case, i've got two users on same machine and whenever i do su - <user> is still asking password  and we'll not achieve automation on this manner.

      Hence the solution is 

#> sudo -u <user> -i

    This command will take us directly into the user without prompting us with password.

Tree command on GIT Bash

By default, tree command will not be available in Git Bash,
$ cmd //c tree //a //f

 -- c  Turn colorization on always.

-- a  All files are listed.

-- f  Print the full path prefix for each file.

Create and configure Linux Partition on VM

Lets discuss how can we add a new partition on Linux VM.
1. First edit the settings on the VM and add harddisk,

2. Run fdisk -l. you can see a new /dev/sdb with what space you provided. it is still the Raw harddisk partition. We need to partition it and make it usable.

3. Assume that /dev/sdb is the new hdd we had, run the following commands,
[root@LINUX] # fdisk /dev/sdb
it'll ask a prompt, we should give n as option to create a new partition and mention the first and last cylinder for its size. then give w to write the partition table.

4. To verify the partition, run the fdisk -l, now it'll show the partition. assume /dev/sdb1 is the partition which we created now. now we should make the partition readable to linux. run the following command,
[root@LINUX] # mkfs -t ext4 /dev/sdb1

5. Now mount the partition manually to some partition. in my case i am going to create a separate var partition for my jenkins, so i ran the following commands,
[root@LINUX] #  mv /var /var-OLD
[root@LINUX] # mkdir /var
[root@LINUX] # mount /dev/sdb1 /var

6. To add this mount permantenly please add the entry to /etc/fstab file
[root@LINUX] # vi /etc/fstab

/dev/sdb1 /var ext4 defaults 0 0

7. Reboot your machine, you are all set.

FYI,
incase for jenkins, if you move /var to /var-OLD and create new partition. please do this step, else you'll not able to connect to the VM through SSH/Putty client. and start the sshd service.

[root@LINUX] # cp -fr /var-OLD/empty /var
[root@LINUX] # service sshd status

Device eth0 does not seem to be present, delaying initialization

How To Fix “Device eth0 does not seem to be present, delaying initialization” Error

I was playing with My Virtualbox today and i tried to clone some Centos Servers. But after this, when starting the eth0, it is no more available.

check network:

# ifconfig

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

 Try to start Eth0 device

# ifup eth0
Device eth0 does not seem to be present, delaying initialisation

To Solve this :

Delete networking interface rules file so that it can be regenerated and reboot your CentOS system.

# rm /etc/udev/rules.d/70-persistent-net.rules
# reboot

New Mac address has been generated:

# This file was automatically generated by the /lib/udev/write_net_rules
# program, run by the persistent-net-generator.rules rules file.
#
# You can modify it, as long as you keep each rule on a single
# line, and change only the value of the NAME= key.

# PCI device 0x8086:0x100e (e1000)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="08:00:27:fe:c1:03", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

Now edit /etc/sysconfig/network-scripts/ifcfg-eth0,

Add   new  HWADDR generated or  remove it 
Remove UUID   line

Restart the networking service

# service network restart (OR) /etc/init.d/network restart
Shutting down interface eth0:                              [  OK  ]
Shutting down loopback interface:                          [  OK  ]
Bringing up loopback interface:                            [  OK  ]
Bringing up interface eth0:  Determining if ip address xxx.xxx.xx.xxx is already in use for device eth0...
                                                           [  OK  ]

# ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:FE:C1:03
          inet addr:xxx.xxx.xx.xxx  Bcast:xxxxxxxx  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fefe:c103/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4400 errors:0 dropped:0 overruns:0 frame:0
          TX packets:129 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:387597 (378.5 KiB)  TX bytes:19567 (19.1 KiB)

Junction on Windows

Introduction:
Directory symbolic links are known as NTFS junctions in Windows, Windows 2000 and higher supports directory symbolic links, where a directory serves as a symbolic link to another directory on the computer. For example, if the directory D:\SYMLINK specified C:\WINNT\SYSTEM32 as its target, then an application accessing D:\SYMLINK\DRIVERS would in reality be accessing C:\WINNT\SYSTEM32\DRIVERS. Directory symbolic links are known as NTFS junctions in Windows. Unfortunately, Windows comes with no tools for creating junctions—you have to purchase the Win2K Resource Kit, which comes with the linkd program for creating junctions. I therefore decided to write my own junction-creating tool: Junction. Junction not only allows you to create NTFS junctions, it allows you to see if files or directories are actually reparse points. Reparse points are the mechanism on which NTFS junctions are based, and they are used by Windows' Remote Storage Service (RSS), as well as volume mount points.

Usage:

* To determine if a file is a junction, specify the file name:

        junction c:\test

* To list junctions beneath a directory, include the –s switch:

        junction -s c:\

* To create a junction c:\Program-Files for "c:\Program Files":

        C:\>md Program-Files (If the source and destination folder names are similar, don't create directory)

       C:\>junction <New name with path> <Existing directory with path> 

       C:\>junction c:\Program-Files "c:\Program Files"

* To delete a junction, use the –d switch:

        junction -d c:\Program-Files

Windows 2008 R2 slave failed to connect via DCOM

Scenario:

          If we configure Windows 2008 R2 node to Jenkins, it fails to connect to the node.

Solution 1 :
      Try connect the node through JNLP, it'll connect.

Solution 2:
       If we want to connect through Windows service, please follow the steps.

1. If you see the below error,

        Access is denied. [0x00000005]
 at org.jinterop.dcom.core.JIComServer.init(JIComServer.java:542)
 at org.jinterop.dcom.core.JIComServer.initialise(JIComServer.java:458)
 at org.jinterop.dcom.core.JIComServer.<init>(JIComServer.java:427)
 at org.jvnet.hudson.wmi.WMI.connect(WMI.java:41)
 at hudson.os.windows.ManagedWindowsServiceLauncher.launch(ManagedWindowsServiceLauncher.java:107)
 at hudson.slaves.SlaveComputer$1.call(SlaveComputer.java:170)
 at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
 at java.util.concurrent.FutureTask.run(FutureTask.java:138)
 at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
 at java.lang.Thread.run(Thread.java:619)
Caused by: rpc.FaultException: Received fault. (unknown)
 at rpc.ConnectionOrientedEndpoint.call(ConnectionOrientedEndpoint.java:142)
 at rpc.Stub.call(Stub.java:112)
 at org.jinterop.dcom.core.JIComServer.init(JIComServer.java:538)

2. Turned off the firewall (this could be configured correctly to be safer, but I didn't care since its in a firewalled "safe" part of the net)
4. Launch 'regedit.exe' as 'Administrator' 
5. Find the following registry key: 'HKEY_CLASSES_ROOT\CLSID{76A64158-CB41-11D1-8B02-00600806D9B6}' refer here
6. Right click and select 'Permissions' 
7. Change owner to administrators group. 
8. Change permissions for administrators group. Grant Full Control. 
9. Restart Remote Registry Service 
10. Restart the Windows machine.

How To Take Ownership & Full Control Of The Registry

If you are encountering the above errors, without a doubt you’ve encountered a protected registry key.  Normally these keys are only open to modification by the System, but if you follow the steps below you’ll learn how to make your user account a poweful registry editing demi-god.  Open up regedit and let’s get started!

Step 1

In regedit (Registry Editor) Right-Click the protected key in question.  From the context menu that appears, Select Permissions…

Tip: If you want, you could take control of the top tree of the registry.  In effect you would have full control of the entire registry, however this is not recommended for security purposes unless you plan on removing said permissions when you finish working.

Step 2

In the Permissions window that appears, Click Advanced.

Step 3

Click the Owner tab and Select your username from the list.* Now Check the Replace owner box and Click Apply. (Yes! This is one of the few instances where the Apply button is actually useful!)

*If your username is not on this list Click Other users or groups… and manually add it.

Step 4

Click the Permissions tab and then the Add… button.  In the Select User window Typeyour username into the white box and Press OK.

Step 5

A new Permission Entry window should pop-up, just Check the Allow Full Control box and Click OK.

Step 6

Back on the previous window your username should be on the list with Permissions set toFull Control.  Now all that is left to do is to save and exit all open windows by Clicking OK a couple times.

Done!

You should now be able to edit any of the entries within the registry key that you just modified permissions for.  Don’t forget that if you want maintain proper security protocol, after you are done you can go back in and Remove your user from the list of names with Full Control.  Have a groovy time editing the registry without restriction!

Prevent Root Login on Linux

Scenario:

            Block the root login on Linux Machines through SSH ports.

Solution:

            Run the grep "PermitRoot" /etc/ssh/sshd_config command let you know the status of block / open.

 If the value is no then blocked,

PermitRootLogin no    ==> Can't perform root login thru SSH

PermitRootLogin yes  ==> Can able to perform root login directly through SSH Client / Putty.

Note:

•     Eventhough root account is blocked, you can still login with other account and use su - root command to switch to the root account.
• Still you can use VSphere client to login to the machine using root account.

Renew Clover License

Please follow the steps to renew the clover license

• Please login to the Atlassian https://my.atlassian.com
• Use the login credentials,
• Click on Licenses Section,
• Click on New Evaluation License under Evaluations,
• Copy the License Key: to the clover.license file on the build machine
• Re-trigger the build, it'll get pass

Note:
            Each license valid for only one months, you have to renew the license key for every month.

How to find Processor Architecture

LINUX

• Go to the Terminal and type the command,
• uname -i         ---- Tells the Processor Architecture

WINDOWS

Solution 1:

1. Open System by clicking the Start button  , right-clicking Computer , and then clicking Properties .
2. Under System , you can view the system type.

Solution 2:

         Refer the PROCESSOR_ARCHITECTURE value which can be found in Windows Registry at this location:

1. start -> run -> regedit,

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Environment. 

This value on my 32-bit Intel machine is x86 and on another 64-bit machine with Intel Xeon processor is AMD64.

Install VMWARE Tools on Linux

To install VMWARE Tools on Linux.

1. Go to Home -> Inventory -> Hosts & Clusters
2. Right Click on VM -> Guest -> Install/Upgrade VMWARE Tools.

            Now the VMWare tools ISO gets loaded to the CDROM Automatically according to the architecture. now we should install the tools manually

1. Find the CDROM and mount it. follow the previous post MOUNT CDROM to find the the cdrom,
2. Deceide the installation mode.

Installing VMware Tools from the Command Line with the RPM Installer

1. Mount the CDROM,
2. cd /mnt/cdrom
3. rpm -ivh /mnt/cdrom/VMwareTools-5.0.0-<xxxx>.i386.rpm
4. /usr/bin/vmware-config-tools.pl
5. your linux box should have C libraries related to the kernel,
6. else install kernel-devel using yum or find the rpm and install
7. ps -ef | grep vmware-tools

Installing VMware Tools from the Command Line with the Tar Installer

1. Mount the CDROM,
2. cd /mnt/cdrom
3. tar zxf /mnt/cdrom/VMwareTools-5.0.0-<xxxx>.tar.g
4. cd vmware-tools-distrib
5. ./vmware-install.pl
6. ps -ef | grep vmware

Convert Unicode file in Linux

Scenario:
          I got a file, when we open it using VI editor. i found <96> & <93> characters instead of - & "". none of the utils helped me open the file as it is.

Solution:

• Get revision / open the file in any editor,
• Copy the contents and paste it in WORD (Best decryptor of any format of content)
• Save the file as .doc,
• Open the .doc and copy the contents,
• Open the VI editor in the linux box and paste the contents and save the file
• We got the file as the orignal notations.

Issue:

      Developers used to convert the pdf to txt using some utility, due to this we can't open the file with the expected CHARSET. i've tried dos2unix, unix2dos, iconv nothing helped. :(

Install PERL Module Digest::MD5

This Post tells us about to install Digest::MD5 module of perl,

Pre-Requirements,
 We need GCC to install the perl modules into linux, please refer GCC Install Guide link to install GCC.

Steps:

• Download Digest-MD5-2.52.tar.gz from the CPAN,
• Uncompress the file into a Directory,
• Change directory to Digest-MD5-2.52
• [root@castle-hat Digest-MD5-2.52]# cd Digest-MD5-2.52
• Run the Makefile with perl compiler,
• [root@castle-hat Digest-MD5-2.52]# perl Makefile.PL
• Run make -- may ignore some warnings,
• [root@castle-hat Digest-MD5-2.52]# make
• Run Make test, look for All tests successful.& Result : PASS
• [root@castle-hat Digest-MD5-2.52]# make test
• Run Make Install
• [root@castle-hat Digest-MD5-2.52]# make install
• To check whether the module properly installed / not, (if prompt comes without exception, then it means installed on the machine)
• [root@castle-hat Digest-MD5-2.52]#  perl -e 'use Digest::MD5;'
• [root@castle-hat Digest-MD5-2.52]#

GCC on RHEL6

Here is the Document which states how to install GCC with dependencies,

Problem:

————————————————————————————

[root@test01.com Packages]# rpm -ivh gcc-4.4.4-13.el6.x86_64.rpm
warning: gcc-4.4.4-13.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
error: Failed dependencies:
 cloog-ppl >= 0.15 is needed by gcc-4.4.4-13.el6.x86_64
 cpp = 4.4.4-13.el6 is needed by gcc-4.4.4-13.el6.x86_64
------------------------------------------------------------------------

Solution:

Run these commands:

1) First, let’s get glibc header:

[root@test01.com Packages]# rpm -ivh glibc-headers-2.12-1.7.el6.x86_64.rpm
warning: glibc-headers-2.12-1.7.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
Preparing...                ########################################### [100%]
   1:glibc-headers          ########################################### [100%]

2) Now, glibc devel:

[root@test01.com Packages]# rpm -ivh glibc-devel-2.12-1.7.el6.x86_64.rpm
warning: glibc-devel-2.12-1.7.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
Preparing...                ########################################### [100%]
   1:glibc-devel            ########################################### [100%]

3) Let's see if cpp installation works now:

[root@test01.com Packages]# rpm -ivh cpp-4.4.4-13.el6.x86_64.rpm
warning: cpp-4.4.4-13.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
error: Failed dependencies:
 libmpfr.so.1()(64bit) is needed by cpp-4.4.4-13.el6.x86_64

4) Let's sort out above error:

[root@test01.com Packages]# rpm -ivh mpfr-2.4.1-6.el6.x86_64.rpm
warning: mpfr-2.4.1-6.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
Preparing...                ########################################### [100%]
   1:mpfr                   ########################################### [100%]

5) Try if cloog is working for you:

[root@test01.com Packages]# rpm -ivh cloog-ppl-0.15.7-1.2.el6.x86_64.rpm
warning: cloog-ppl-0.15.7-1.2.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
error: Failed dependencies:
 libppl.so.7()(64bit) is needed by cloog-ppl-0.15.7-1.2.el6.x86_64
 libppl_c.so.2()(64bit) is needed by cloog-ppl-0.15.7-1.2.el6.x86_64

6) Install ppl:

[root@test01.com Packages]# rpm -ivh ppl-0.10.2-11.el6.x86_64.rpm
warning: ppl-0.10.2-11.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
Preparing...                ########################################### [100%]
   1:ppl                    ########################################### [100%]

7) Try again, if gloog is working:

[root@test01.com Packages]# rpm -ivh cloog-ppl-0.15.7-1.2.el6.x86_64.rpm
warning: cloog-ppl-0.15.7-1.2.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
Preparing...                ########################################### [100%]
   1:cloog-ppl              ########################################### [100%]

8) Install cpp:

[root@test01.com Packages]# rpm -ivh cpp-4.4.4-13.el6.x86_64.rpm
warning: cpp-4.4.4-13.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
Preparing...                ########################################### [100%]
   1:cpp                    ########################################### [100%]

9) Finally, install gcc:

[root@test01.com Packages]# rpm -ivh gcc-4.4.4-13.el6.x86_64.rpm
warning: gcc-4.4.4-13.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY
Preparing… ########################################### [100%]
1:gcc ########################################### [100%]

10) Alternatively instead of step 9, you can use YUM,

[root@test01.com Packages]# sudo yum install gcc-4.4.6-3.el6.x86_64.rpm 

eth0 not coming up on boot / network restart

eth0 (Network Card) is not coming up while system boot / reboot / or during service network restart,

It's a reported bug for RHEL 6, Follow these steps to get up and running network connection ...

Edit "/etc/sysconfig/network-scripts/ifcfg-eth0" file, which is your defualt first NIC configuration file.

If you are using DHCP server to take IP then, edit it like this;
#vi /etc/sysconfig/network-scripts/ifcfg-eth0
ONBOOT="yes"
BOOTPROTO="dhcp"

Save & restart networking service,

#service network restart               

OR

#/etc/init.d/network restart

If you are providing manual IP then, edit it like this;

DEVICE=eth0
           IPADDR=10.10.10.10
           NETMASK=255.255.255.0
           NETWORK=10.10.10.0

GATEWAY=10.10.10.253
           ONBOOT=yes
           BOOTPROTO=none
           USERCTL=no

Save & restart networking service,



#service network restart          

     OR

#/etc/init.d/network restart



OR

 you can use simple Network Configuration tool  to configure IP's but the highlighted two lines are compulsory to add manually in the file.