Cool Tools

JavaScript Base64-Encoding Binary Data in IDM (a.k.a using Java and JavaScript within the IDM engine)

aburgemeister — Wed, 18 Nov 2009 11:30:30 -0700

Base64-encoding data is found in places all over the IT world and in home users' systems as well. Being able to encode data in Java or ECMAScript/JavaScript can be valuable when those are the languages available to you. This sample shows how to convert from one format to another and eventually encode data for use within a directory like eDirectory.

In a recent article I mentioned the possibilities of ECMAScript/Javascript within Java for scripting within Java applications or just for your own system. While working on an issue recently the need to convert a string of characters representing binary to a Base64-encoded representation of that binary value was manifest. As the issue was for use within Novell Identity Manager the following was able to be used to accept the string of binary and then convert it to a valid Base64-encoded value. The same could be done within any application with access to the com.novell.xml.util package (or a suitable replacement to do the Base64-encoding) and a Rhino implementation to run the rest of the conversion code from string to binary. ECMAScript/JavaScript Development Without a Web Browser

<code interpreter="rhino">
function b64encbinstring(binstring) {
	importPackage(java.io);
	importPackage(java.lang);
	importPackage(Packages.com.novell.xml.util);
	var mylong0 = java.lang.Long.parseLong(binstring, 2);
	var bos = new java.io.ByteArrayOutputStream();
	var dos = new java.io.DataOutputStream(bos);
	dos.writeLong(mylong0);
	dos.flush();
	var bytedata = bos.toByteArray();
	var base64c = new Packages.com.novell.xml.util.Base64Codec();
	var base64string=new Packages.java.lang.String(base64c.encode(bytedata, (8-Math.ceil(binstring.length/8)), Math.ceil(binstring.length/8), false));
	return base64string;
}

b64encbinstring('00101010110111100001010101000101101');    //Line to Base64-encode a string of zeros and ones and return the appropriate string.
</quote>

This may not be the most-elegant method of doing what is needed but it was something that otherwise would have required custom Java code to do the same compiled into the application in one way or another. If somebody can condense the code above to make is simpler or avoid unnecessary steps please feel free to do so in the comments section.

Cool Solutions

DSImport - Win32 Tool to Update eDirectory from CSV Files

wschreiber — Fri, 13 Nov 2009 10:57:19 -0700

DSImport: eDirectory CSV Import Tool

DSImport allows you to process information from CSV files to ...

import new objects
modify existing objects
delete existing objects
compare with existing objects

Usage:

Tab "Info"

Show this short overview
Get Updates
Use the link to my web site to check for updates and get the most recent version

Tab "Tree & Context"

Select the tree and container
In the tree view, choose a tree and container as a base for your CSV operation
This is especially important if your CSV does not contain the full DNs, but only CNs or short object names
The right panel shows default settings for your CSV - choose the settings that best fit your CSV contents

Tab "CSV -> eDirectory"

Click "Load CSV" to read your CSV and check the result in the CSV grid.
Nothing will be sent to eDirectory at this stage.
If the columns do not match the way you want your data structured, change the settings (see above) and reload the file
Check the comments on "Using the correct CSV file structure" below.
Excluding specified colums/attributes from the operation
If you would like to exclude selected columns from being imported into eDirectory, click on the CSV grid column header.
Selected columns are green, unselected columns are displayed red.
Operating on individual objects
You may right-click on an object in the CSV grid to perform an action (add, delete, modify) on an individual object CSV line
Editing CSV grid data
Double-clicking into a grid cell allows you to edit the contents of a data cell.
NB: the change will be temporary and will NOT change the imported files

Tab "Results"

Check the results screen for logging and error information.
You may use right-click to clear or save the list

Using the correct CSV file structure

The first CSV line should typically contain the eDirectory names of the attributes
The first column should be the CN or the DN of the objects
Lines starting with '#' are treated as comments and will be ignored

Freeware written by Wolfgang Schreiber

File Owner: Dr. Wolfgang Schreiber
Email: wstools@WolfgangSchreiber.de
Date: 2009/11

Platforms: Windows Win9x/WinNT/Win2k/WinXP

Revision history:
2009/11 First release

Cool Solutions

PortaMail Live

Quartz Development — Wed, 04 Nov 2009 15:25:25 -0700

PortaMail Live is our new PortaMail product. It enables users to finally synchronize their GroupWise Calendar, Contacts, Tasks and Email directly with their device over the air without the need for third party server software or desktop PC.

It's so simple to use, ask your administrator to switch on SOAP on the GroupWise server and note the SOAP port used, configure PortaMail Live on your device and sync.

Supports secure sockets if the server supports them, security certificates can be created by a Console One plugin and need to be applied to your Post Office for SSL to work.

Email
You can include attachments.
You can synchronize either today's emails or a previous number of days worth of emails.
Select the actual mailboxes you want to synchronize.
Filter either un-read or read messages.
Calendar
Select the sync window for the amount of data you want to keep up to date.
You control the amount of data that stays on your handheld device.
Synchronizes device repeating calendar items to GroupWise.
Contacts
Select multiple Address Books within GroupWise. Select the default GroupWise Address Book for new device Contacts to be created.
Tasks
Select the sync window for the amount of data you want to keep up to date.
You control the amount of data that stays on your handheld device.

System Requirements:

Windows Mobile 5.0/6.0/6.1/6.5 + touch screen device.
Microsoft Windows® 9.x, ME, NT 4, NT 2000, 2003, XP, Vista, Windows 7.
Microsoft ActiveSync version 4.5 and above or Windows Mobile Device Center.
GroupWise 7.x/8.x.

download url:
http://www.quartzdevelopment.com/Trial/PortaMailLiveSetup.exe

Cool Solutions

Nagios Monitoring for NSS Volumes on OES Linux

brunold — Thu, 29 Oct 2009 15:10:35 -0600

Nagios is a powerful monitoring tool that can be used to check your systems and the services running on it. We currently monitor more then 500 server and 12.000 services with it.

This new check program allows to monitor several NSS volume parameters on your OES Linux systems. I created it after a question on how the purgeable space on a volume can be monitored. I found some cool solution articles about the virtual file services and used some samples to create this check program. It is based on perl and needs the perl and perl-XML* packages from OES (SLES) to be installed on the server.

Here is a sample where I monitor the volume DATA:

# check_oesnss_vol.pl -V DATA -w 10000 -c 5000 -M

OK: NSS Vol: DATA, Pool: POOL1, Size: 41000 MB, Used: 3423 MB, Free: 37577 MB, Files: 341, Purgeable: 3399 MB, addComp: 24 MB|DATA=42949672960;3585662976;39364009984;341;3560329216;24940544;8;92

You provide the volume name, the warning and critical levels and it will check those values and provide some additional information like the files on that volume, the purgeable space and the space you saved by using compression.

Using additional parameters like -M, -G or -k you can define to get the output in MB, GB or kB, whereas the performance data (everything after the pipe) is always reported in Bytes. Using those performance parameters allow you to created trend graphics using additional Nagios plugins like NagiosGraph.

As the Monitoring Exchange website hosts most of the Nagios addons, I placed this new cehck program there as well. Please check that site for additional information about this and about many other check programs.

Rainer

Download: http://www.nagiosexchange.org/inventory/Check-Plugins/Operating-Systems/Novell/check-oes-linux-nss-volume-usage

Cool Solutions

EZDial (Beta)

martingz — Wed, 28 Oct 2009 16:56:23 -0600

If you have a VOIP Cisco Unified Call Management System, you can now offer your clients the ability to dial their phone using the GroupWise address book.

• Make phone calls using the GroupWise address book
• Supports personal address books, mobile and home entries
• Supports Name Completion entry
• Fully self contained, no installation required
• Configuration saved by user for shared PC’s

"This work is Beta and I need some testers."

Note: Currently will not work correctly with GroupWise 8 address book

Cool Solutions

GroupWise External User Import

matt — Wed, 28 Oct 2009 14:51:51 -0600

GroupWise External User Import (GWEUI) is a utility that provides for the automated creation of External User accounts in a Novell GroupWise email system.

It reads in a comma-separated variable (CSV) file and imports the data into the system creating an External User object ("white shirt"). This is not a full GroupWise account, rather a placeholder so that users from other systems can appear in the system-wide address book.

http://www.weisberg.net/downloads/gweui11.txt

Workgroup Cool Solutions

Delete Empty Columns from a CSV file

bputtali — Tue, 27 Oct 2009 12:17:57 -0600

In Novell Log Manager, a user can export search results as a CSV file. Usually the generated CSV has more than 300+ columns corresponding to the 300+ event fields in a Sentinel schema of which more than 200+ columns may be empty.

So you may have data in the 1st column and data in 300th column but you need to scroll across all those empty columns in between to even see the data. Moreover Open Office, Excel, Google Docs most often throw up an error while trying to open a CSV file with so many columns.

To solve this problem, I have written a simple perl script that removes all the empty columns from the specified input file and writes it to the specified output file. After which the resultant output file can be looked at and edited easily in any of the editors.

To run this script, simply open up a terminal in Linux and type -

perl deleteEmptyColumnsFromCSV.pl Input_CSV_Filename Output_Filename

Substitute Input_CSV_Filename with the name of the CSV file from which you want empty columns to be removed and Output_Filename with name of the file to which the output needs to be written.

Cool Solutions

GPTrustee

gavo — Fri, 23 Oct 2009 17:19:00 -0600

I loved Tbackup.exe. Too bad it doesn't support long file names. I know there are plenty of great server based alternatives for backing up and restoring trustee rights, but ....

Recently I wanted to migrate a volume from a NetWare server to an OES2 Linux server. Sure, the consolidation utility will do that for me and take care of the trustee rights but what if it all goes horribly wrong? Never happens right?

All I wanted to be able to do was backup the trustee rights of the source volume, perform the migration, and then compare the destination trustees to my originals.

GPTrustee is a very simple windows application that from a Windows XP client with the NetWare client installed will allow you to backup trustee rights to a text file and restore trustee rights from a text file.

Trustee rights are stored in a plain text format, you can take a before and after and using a text file comparison tool such as Beyound Compare, check for differences.

GPTrustee is BASIC - it will backup and restore trustee rights of DIRECTORIES only. It will also not backup and restore extended attributes, IRF's etc. This was good enough for what I needed.

To Backup

Map a drive to the root of the NetWare volume you wish to backup the trustees of
Run GPTrustee and follow the prompts

To Restore

Map a drive to the root of the NetWare volume you wish to restore the trustees to (it must be the same drive letter as was used for the backup – check the backup log for this drive letter)
Run GPTrustee and follow the prompts

GPTrustee has only been tested with Windows XP SP3. It is provided in good faith on the chance it is useful to someone else. It has performed as described for me, but please, test it carefully in your environment to ensure it is suitable for you as it is supplied with no warranty expressed or implied.

Cool Solutions

Utility to Set Directory Quotas on a NSS Directory

dvijayababu — Thu, 22 Oct 2009 11:45:12 -0600

Prerequisites

Perl must be installed and running on the Linux server where this utility will be used.
NSS must be installed to get the VFS support.
(The SDK for this API set can be downloaded from http://developer.novell.com/wiki/index.php/Virtual_File_Services_for_NetWare)

Details

This tool is used to set the directory quotas on a nss directory.

It uses Virtual File Services to set the directory quotas.

How to use the utility:

From a terminal prompt type:

perl setDirectoryQuota.pl <enter>

Following menu will be displayed:

1.To set directory quotas
2.Exit
Select Action:

A sample output on selecting 1 would be:

Select Action: 1
Enter directory Name to set directory quota: /media/nss/NEW/directory
Enter the size (in MB): 10
--------------------------------------------------------------------------
direcoty quotas set on directory /media/nss/NEW/directory
--------------------------------------------------------------------------

Cool Solutions

Novell GroupWise 8.0.1 View Designer

sabrown — Tue, 20 Oct 2009 15:01:48 -0600

Novell GroupWise 8.0.1 View Designer
10/16/2009

Installation

Make sure you have the 32-bit version of GroupWise 8.0.1 or greater installed.
Copy the files of VDESIGN.EXE, GWVDA1EN.DLL, GWVDA1EN.HLP to the directory where you installed the GroupWise Windows client (i.e. c:\program files\Novell\GroupWise\ ).
To run the View Designer, run the VDESIGN.EXE program.

Viewing the Documentation

You can view the View Designer help file by double clicking on the GWVDA1EN.HLP file or from the Help menu with the View Designer program.

Cool Solutions

CurrPorts v1.76 - Monitoring Opened TCP/IP network ports

scotspgc — Sun, 18 Oct 2009 23:04:54 -0600

CurrPorts is network monitoring software that displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.

In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file.

CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)

Cool Solutions

Diagnostic tool for DNS Records

hemajoshi — Tue, 13 Oct 2009 11:09:20 -0600

Domain services for Windows is tightly integrated with DNS. Primary Domain controller typically acts as DNS server for the Domain. Upon adding Domain Controller or Workstation to the domain, DNS zone records for these will be created and updated in “domain.db” file of Forest Root Domain.

This tool validates whether DNS entries for forward lookup and reverse lookup of each domain controller and workstation of the DSfW domain is properly created. This is a health check for DNS to ensure proper functioning of DSfW Domain.

To check the DNS record entry for each domain controller and member server, run the script at command line as:

perl  check-dns.pl

Output of the script states the health of DNS records for each domain controller / member server by listing the records with “OK” / “NOT OK” .

Cool Solutions

Dynamic GroupWise user statistics (GWSTATS)

haax — Wed, 07 Oct 2009 10:42:29 -0600

This set of scripts is to be used for user statistics on GroupWise postoffices.

It is based on the original gwstats script by Rob Anderson and has the following features:
- Dynamic web based viewing with sorting options
- User statistical history

Cool Solutions

nts-fuseds (Framework to host and manage various NTS [UK Services] applications)

cdrew — Wed, 07 Oct 2009 10:24:56 -0600

nts-fuseds is a Framework to host and manage various NTS (UK Services) applications. It runs on Linux (i386) and Microsoft Windows platforms.

Requirements

Java (JRE) >= 1.6
Latest Novell International Cryptographic Infrastructure (NICI)
On the clients, the latest version of Adobe Flash Player

Getting Started

Linux:

Unpack the archive to a folder of choice (eg. /opt/novell/nts-fuseds)
Modify the BASE and JAVA_HOME variables to match your environment in bin/nts-fuseds file
CHMOD 755 bin/*.sh, bin/nts-fuseds
CHMOD 400 bin/*.bat
To start the service, run bin/nts-fuseds start
To stop the service, run bin/nts-fuseds stop

Windows:

Unpack the archive to a folder of choice (eg. C:\novell\nts-fuseds)
To start the service, run bin\startup.bat
To stop the service, run bin\shutdown.bat

General:

Access the framework by opening a browser to http:://:8400/
Default ports are http - 8400 ant https – 9400 (can be modified in conf/server.xml
Default manager user is ntsfuseds / guessthis. May be changed in conf/tomcat-users.xml
(OPTIONAL) tweak the memory parameters in bin/catalina.sh to suite your environment (JAVA_OPTS="$JAVA_OPTS -Xms256m -Xmx512m")
Modify webapps/ROOT/config and change host parameter to your server IP Address or DNS name
(Optional) to have the pages served over TLS/SSL, modify webapps/ROOT/config changing secure parameter to true and assigning the appropriate port (default 9400) and uncomment the last section under the heading "Force SSL for entire site " in webapps/ROOT/WEB-INF/web.xml
Tomcat log may be read at logs/catalina.out

Available Applications: (Coming soon)

eDirectory Health Monitor
Identity Manager Driver Monitor
Ldap Server Statistics

Known Issues:

Internet Explorer does not work when using TLS/SSL due to self-signed certificate

Click to view.

Cool Solutions

Base64-to-hexadecimal converter

aburgemeister — Thu, 01 Oct 2009 11:29:03 -0600

Earlier a need to convert base64-encoded values to the appropriate hexademical string came up and needed to be done multiple times from the command line in a scripted fashion. Unfortunately the latter requirement prevented me from using a website that does the conversions (at least, without a bit of work) as I usually use this one:

http://home2.paulschou.net/tools/xlate/

So off to Perl to see how quickly I could conjure something up. With the help of pre-installed and available MIME modules for Perl and some tips from Google on the best way to print data in its hex form this little script came into being. It is not an overly-high performer as it only takes one string per invocation but it could easily be adapted to read from another source and then process multiple times without loading a new Perl environment every time. In the meantime it either takes STDIN base64-encoded values or it will prompt for values. Everything except the actual hash is written to STDERR so you can filter that out and process from there if needed.

ab@mybox0: ~> echo 'RR19QlE2ED2IDSMhVKKjc0mpe4Lxx7nhHgyXBQ1wbKY=' | ./base64tohex.pl

ab@mybox0: ~> ./base64tohex.pl RR19QlE2ED2IDSMhVKKjc0mpe4Lxx7nhHgyXBQ1wbKY=

Data Center

iPrintUp: Automatic Update of iPrint Drivers on Your XP/2000 Workstations

mvdb — Thu, 01 Oct 2009 10:32:39 -0600

Are you having a hard time keeping all your workstations up-to-date with the right printer drivers?

Well, here is the solution to automatically do this. iPrintUp.

Once you upload a new driver to the Broker, and you assign the driver to a printer, the information in eDirectory about the printer will trigger an install of the new driver the next time a workstation logs on.

Read the manual (included) for all the details.

September 14th 2009:
New version 2.3.1
Now iPrntUp can write a log file (updated exe/dll/ini and manual).
Also removed some restrictions, the description field now can be used for other purposes too.
Better support for Windows 2000 workstations.
Corrected problem when driver already exists on the local machine.
Corrected problem when ipp printer didn't have a "driverversion".

October 1st 2009 Version 2.4.1
Extended log options.
Added better support for PrinterPropertiesPro users.

Cool Solutions

Abend Log Summarizer

jimc — Wed, 16 Sep 2009 16:12:57 -0600

The program has two functions. One is to gather the data from all abend.log files on on NetWare servers in a given tree, and the other is to rename the log files in a cycle as abend.1, abend.2 etc to keep the file size down. The program uses various Novell API calls to extract server and tree names, and requires a recent version of Novell Client 32 on the Workststation. The user needs to be logged into the tree with sufficient rights to at least read all sys:system folders, and of course it will not be useful with OES/Linux or OES/Windows servers.

Running the program should be straightforward and obvious to an experienced Novell administrator. Gathering the log data is not a destructive process, but repeated running of the rename log function will eventually cause log files to be lost (only the last 25 are kept). The program outputs the abend date and time in both the text format in the log file, and also in the MS serial format, based on 1900. This is useful if you are trying to spot patterns for events occurring across multiple servers. The fields in the log are:-

- Server Name - and if it was different at the time of the abend
- Date - text format
- Date - serial format
- Abend type, number and processor
- OS Version
- Abend Message
- Running Process
- Interrupted Process
- "Created By" - not always recorded

I should note that I needed to get this running again (its an update of some very old code) in something of a hurry to help deal with a significant problem we are trying to fix at the time of writing. It has been worked over no more than was necessary to get the data with NW65 log format and to push the code into a vaguely publishable state. Bugs may well exist, although if you stick to the data retrieval its read only so strictly non destructive.

Both binary and source code are included in the distribution. The source adds so little to the file size that there seems no point in including it. You will need a copy of MS Visual Basic 6 to compile the source, but I imagine it is fairly readily portable to later versions. Large chunks of the source code are from Novell libraries and example codes, and other parts are from Microsoft API libraries. This code is not subject to the Open Source License, but is available unrestricted from those suppliers.

I'll freely admit this isn't the greatest VB code ever written, and the libraries based on third party code are pretty minimally commented. The main routine is reasonably commented so it should be easy to change it to suit individual requirements. In particular there is no kind of internationalisation, and I imagine it would be necessary to change and recompile the code if the server is not running English Language. It shouldn't be too hard though, depending on how different the abend log is in other languages.

Oh, and why am I still using MS VB6? Well it works, this is an update of old code, there's probably not much point in a major rewrite for however many years of life pure NetWare has left, and there are things I'd rather do learn .net when I only create WIndows Applications about once every nine months.

Cool Solutions

setquota.sh - Set Directory Quotas on NSS with OES2 Linux

tfe — Thu, 10 Sep 2009 17:03:56 -0600

I wrote a short script to set directory quotas for lots of directories. It uses the metamig utility and dynamically creates the needed xml file.

Usage:

Simply add the basepath and the quotasize as parameters:

eg:

 ./setquota.sh  /media/nss/DAT/user/homedirs  1024000

After listing all affected dirs, you have to confirm the job.

Now the quotas for all directories in the basepath (not in further subdirs) will be set.

After that you can optional save the xml file for executing the job later.

Hint:

the quota size is in KB
you have to enable Directory Quotas for this volume in nssmu or iManager

Hope that helps somebody!
Tobi

Cool Solutions

ndsd-multi : a way to start multiple eDirectory instances simultaneously in Linux

aburgemeister — Thu, 10 Sep 2009 15:10:02 -0600

Since the release of eDirectory 8.8.0 support for multiple instances of eDirectory on a single box has been available. Using the ndsconfig and especially the newer ndsmanage tool configuring multiple instances of eDirectory is also very easy to do. One feature that has been missing since that time has been the ability to start/stop multiple instances as easily as one can start/stop the first root-based eDirectory instance of a root-installed eDirectory during startup/shutdown. The time has come to overcome that.

To this day the eDirectory init script (/etc/init.d/ndsd) only starts the first instance of eDirectory it finds in the /etc/opt/novell/eDirectory/conf/.edir/instances.0 file which only works for a root-based eDirectory installation. Starting/stopping other instances isn't a terrible thing to do, but if you forget to stop your instance before rebooting all of the other instances (besides the aforementioned first instance) are killed (which could lead to corruption of the DIB eventually), and if you forget to start your other eDirectory instances you can have more downtime than desired. Creating a script from /etc/init.d/skeleton for this task is fairly simple but I need to make note of a few decisions made during this process just to help make sure everything is clear with the script.

First, I presume in most cases this will be used for root-based installations of eDirectory. With that in mind I believe this script, with one minor but planned-for modification, will work with non-root installations of eDirectory. A variable defined as $EDIR_BASE_PATH exists which specifies the base of the eDirectory application installation, which by default is a null value. This is the prefix before /opt/novell/eDirectory.... or /var/opt/novell/eDirectory which does not exist for a root-based installation. Change this one variable to the location where a non-root eDirectory installation is extracted and I believe this script will work for those, though I have not tested that at all at this point.

Second, I assume the script, when running, will have 'root' rights. Modifying it to not need that should be possible but as this is made to be a startup/shutdown script it doesn't make sense to me to do that. Copy/paste code to do that kind of thing if you'd like but having a system where this is not needed but starting/stopping multiple instances is while having multiple users owning the instances seems like a fairly odd situation.

Third, I assume 'sudo' is okay on your system. As this runs as 'root' I can't imagine it's a huge deal since SUSE's /etc/sudoers file allows root to do whatever no matter what. Other distros (I have not tested RedHat) may have complaints, but workarounds in /etc/sudoers should be trivial. I tried going with startproc but because (in theory) all of the eDirectory instances use the same binary and since I did not want to duplicate what the 'ndsmanage' or 'ndsd' scripts do already in creating my own PID file I am using sudo. It does the job nicely and if you would like to change things that is fine but this is the way it is for now.

Fourth I decided to create a log file for this script in (by default) /var/opt/novell/eDirectory/log/ndsd-multi.log which is root-owned. Currently default permissions are set by the system and you can change them. This log file is never truncated or rotated so keep track of it if you reboot often.

Fifth, the script uses the 'logger' command when it starts/stops instances since implementing that could be useful and was trivial to enable syslog events from the script overall. The logger output is very basic and not dependent on success/failure at all..... just there so you can keep track and do a little debugging of this script's interactions with eDirectory.

Sixth, because multiple instances are involved and any number could be up/down at a time the start/stop statuses are not reliable at all. I'm open to suggestions on how to make this perfect; my only idea currently is to sum up all of the return codes from sudo and if any of them are non-zero the sum will be non-zero and that can be the status, but I hate doing weird stuff like that since it just means everything shows up broken instead of everything showing up working.

Seventh, the script works for multiple users on the same system. I did this by creating a configuration file located at (by default) /etc/opt/novell/eDirectory/conf/ndsd-multi.conf which has one nds.conf file (which corresponds to one eDirectory instance each) per line. These files are case-sensitive as always and there should be no spaces before/after them... just one eDirectory configuration file per line. The script determines who owns that eDirectory instance and then tries to start it appropriately with the existing ndsmanage command. Logs are written as mentioned above.

Eighth, I opted to have the 'status' feature of this script call ndsstat for each instance that is configured. This can have a large annoying delay if an instance is down though that should not be the norm. Also the status output is not written to the log file mentioned above as it doesn't seem to be as useful (you're already getting the status somehow and presumably using the output) and it could cause the file to bloat more than expected (a fair bit of output can come from the ndsstat command).

Ninth, so far this script does not like my Solaris 10 box. For reasons like this I like writing in Perl that just works across platforms a bit more nicely than Bash, but oh well for Solaris users at this point in time. I imagine an experienced Solaris admin can port this in about ten minutes after they finish laughing at my poor coding.

Tenth, this should not be used on the instance already managed by the /etc/init.d/ndsd script as it duplicates that effort. Either do not use the other at all or do not use this one for that one's eDirectory instance.

Eleventh, and hopefully this is obvious, but use bunzip2, bzcat, file-roller or something like that to extract the script from the compressed file attached to this post.

Identity and Security

ZCM Adaptive Agent Deployment Script Wizard

Provogeek — Wed, 09 Sep 2009 17:47:21 -0600

Problems with deploying the ZENworks Configuration Management Adaptive Agent?

This script wizard was designed to build a script that can be used to successfully deploy the ZCM Adaptive Agent in most situations when a standard deployment would probably fail. When an agent deployment fails, it normally causes IT over head to visit the workstation that failed to determine the cause of the failure and to manually install the agent. This script will help minimize visits to those workstation to perform a ZCM deployment.

Problems Encountered When Deploying Adaptive Agent:

Simple File Sharing is enabled. In a new ZENworks environment with no Active Directory, IT would need to visit every workstation to disable Simple File Sharing to allow the ZCM server to deploy the agent to the workstation. In an existing ZENworks environment, a Group Policy would be needed (or application object) to make this change to the workstations. This means you must first wait for this change to deploy to your workstations before you can begin the Adaptive Agent deployment.
ZENworks Asset Management and/or ZENworks Patch Management are installed onto a workstation as well as the ZfD agent. The ZCM Adaptive Agent will remove the ZfD agent, but it does not remove the ZAM or ZPM agents from the workstation. In environments that currently use ZfD, an application object is required to perform this installation. This also requires coordination of the agent removals prior to the ZCM Adaptive Agent deployment.
Not all workstations are connected to the network when a deployment is initiated from ZCM causing IT to constantly check inventory to confirm they have gotten the agent deployed to all workstations. So if a user’s workstation is not on when the agent is deployed initially, that workstation will not get the agent when the user returns to work thus causing IT to constantly perform a discovery over a long period (typically a month) to find those workstations and get the agent deployed.
Sometimes an environment can just be in chaos, some workstations’ users will have the proper rights to do the agent removals and install, others won't. Over time, local admin passwords can be different and not documented, so IT is unsure what the password is for a particular workstation.
In early versions of ZCM, the updating to the current version of the Adaptive Agent on workstation does not deploy to all workstation.
A deployment of ZCM was done with out removing ZAM or ZPM leaving those agents installed and running. This causes two inventory scanners and/or two patch management scanners to run on the workstation. The fix? Uninstall the old agent and the ZCM Adaptive Agent and reinstall the Adaptive Agent.

This script wizard solves all of these problems. The script that is built is intended to run from with in a network login script. So you can be assured that if the user logs into your network, they will more than likely be running your network login script. Since it runs from the logins script the problem with Simple File Sharing do not exist. The automated removal of the previous ZENworks agents (ZfD, ZAM, ZPM) will ensure the workstation is properly prepped before the ZCM Adaptive Agent is installed with out having to coordinate the removal. This means that IT does not have to wait for the completed processing of an application object to get started on the ZCM Adaptive Agent deployment. Users whose workstations are not turned on at the time the deployment is started will get the agent the next time they log into the network. No monitoring of the network discovery needed. The script can be built with administrator credentials to install on the workstations with users who do not have local administrator rights. The script performs version checking to ensure that the workstation has the specified version installed, if it does not, it will install it. The script that is built can also remove and reinstall the ZCM agent if needed.

Currently available features in the ZCM Script Wizard:

The ability to enable or disable prompting of the user before beginning either the install of the uninstall.
The ability to enable or disable messages on the workstation showing the progress of the script.
Independent removal of the ZENworks For Desktops agent
Independent removal of the ZENworks Asset Management agent
Independent removal of the ZENworks Patch Management agent
Prompt user for reboot or do not prompt user for reboot or suppress reboot.
Deployment of the ZCM Adaptive Agent
Removal of the ZCM Adaptive Agent
Reinstallation of the ZCM Adaptive Agent
Installation of the ZCM Adaptive Agent using a registration key
The ability to remove or install software as a different user
Local administrator password detection
Auto Login functionality to automate beginning to end
Error reporting to either a log file or a Syslog server
Customization of messages presented to users.

End-User Computing

Domain Services for Windows Health Check Tool

hemajoshi — Wed, 09 Sep 2009 10:12:10 -0600

This tool will check the status of the services that should be running and report accordingly.

#!/bin/bash

. /opt/novell/eDirectory/bin/ndspath > /dev/null 2>&1
export LDAPCONF=/etc/opt/novell/xad/openldap/ldap.conf
clear
echo -e "################################################################################################################################## \n"
echo -e  "********************* DSfW Domain Controller Sanity Check ********************* \n"
echo -e "################################################################################################################################## \n"
LDAPCONF=/etc/opt/novell/xad/openldap/ldap.conf /usr/bin/ldapsearch -Y EXTERNAL -b '' -s base dn -LLL > /dev/null 2>&1
if [ $? == "0" ]
then
	echo -e  "1. LDAPI interface working \n"
else
	echo -e "1. LDAPI interface *NOT* working \n"
	exit 1;
fi

host=`/bin/hostname`
domain=`perl -e '$dom = \`/bin/dnsdomainname\`; print uc($dom);'`

provision --locate-dc $domain > /dev/null 2>&1
if [ $? == "0" ]
then
        echo -e "2. Domain Controller is located and working \n"
else
        echo -e "Domain Controller is *NOT* located \n"
        exit 1;
fi


echo novell | /opt/novell/xad/bin/kinit Administrator@$domain > /dev/null 2>&1
if [ $? == "0" ]
then
	echo -e "3. kinit working \n"
else
	echo -e "3. kinit *NOT* working \n"
	exit 1;
fi

SASL_PATH=/opt/novell/xad/lib/sasl2 /usr/bin/ldapsearch -H ldap://$host.$domain -Y GSSAPI -b '' -s base dn -LLL > /dev/null 2>&1
if [ $? == "0" ]
then
	echo -e "4. LDAP SASL-GSSAPI bind working \n"
else
	echo -e "4. LDAP SASL-GSSAPI bind *NOT* working \n"
	exit 1;
fi

/usr/bin/rpcclient -k localhost -c dsroledominfo > /dev/null 2>&1
if [ $? == "0" ]
then
	echo -e "5. rpcclient working \n"
else
	echo -e "5. rpcclient *NOT* working \n"
	exit 1;
fi

adminSID=`wbinfo -n administrator | cut -f 1 -d ' '`
if [ "$adminSID" == "" ]
then
	echo -e  "6. wbinfo: name to SID conversion *NOT* working \n"
	exit 1;
else
	echo -e "6. wbinfo: name to SID conversion working \n"
fi

adminuid=`wbinfo -S $adminSID`
if [ "$adminuid" == "" ]
then
	echo -e  "7. wbinfo: SID to uid conversion *NOT* working \n"
	exit 1;
else
	echo -e  "7. wbinfo: SID to uid conversion working \n"
fi

wbinfo -s $adminSID > /dev/null 2>&1
if [ $? == "0" ]
then
	echo -e  "8. wbinfo: SID to name conversion working \n"
else
	echo -e  "8. wbinfo: SID to name conversion *NOT* working \n"
	exit 1;
fi

tmp=`wbinfo -U $adminuid | grep S-1-5-21`
if [ "$tmp" == "" ]
then
	echo -e "9. wbinfo: UID to name conversion *NOT* working \n"
	exit 1;
else
	echo -e "9. wbinfo: UID to name conversion working \n"
fi


smbclient -k -L $host.$domain > /dev/null 2>&1
if [ $? == "0" ]
then
	echo -e "10. smbclient working \n"
else
	echo -e "10. smbclient *NOT* working \n"
	exit 1;
fi

echo -e "##################################################################################################################################"
#If any of these doesn't work run "dcmake nds_restart_services"

Cool Solutions

supportconfig for Linux

jrecord — Fri, 04 Sep 2009 16:16:57 -0600

Download Now

The supportconfig RPM package has been renamed from ntsutils to supportutils.

Installation Instructions

Uninstall the ntsutils RPM package

rpm -e ntsutils

Download the supportutils package
Install the RPM

rpm -Uvh supportutils-1.01-54.1.noarch.rpm

Run the supportconfig command as root; use -h or man page to see more options.

supportconfig

To view the information files, assuming the tarball filename is: /var/log/nts_host1_090707_1500.tbz
cd /var/log
tar jxf nts_host1_090707_1500.tbz
cd nts_host1_090707_1500
ls -l
Perform a Basic Server Health Check with Supportconfig

If you have difficulties installing the RPM, do the following:

Change to the root of the file system

cd /

Download the supportutils package
Extract the RPM files

rpm2cpio supportutils-1.01-54.1.noarch.rpm | cpio -ivd

The preferred method is to install the RPM using the rpm command, not rpm2cpio.

Reporting Bugs

Updates to Version 2.25-140:

Fixed suseRegister under SLE9
Added Microsoft Virtual Server VM detection
Now includes core file lists and contents in crash.txt
Added NetworkManager to network.txt
Added chkbin logs to messages.txt
Added system environment files to env.txt
The -u switch defaults to an FTP upload
The -a switch default to an HTTPS upload
The sudoers configuration is included in pam.txt

Updates to Version 2.25-136:

Supportconfig now exports $LOG for plugin interaction
Includes full NCC details for proxy registration troubleshooting
Fixed the NCS resouce log file location

Note: Detailed system information and logs are collected and organized in a manner that helps reduce service request resolution times. Private system information can be disclosed when using this tool. If this is a concern, please prune private data from the log files. Several startup options are available to exclude more sensitive information. Refer to the man page to see these options.

Cool Solutions

Utility to Get Directory Quotas Assigned to a Directory

dvijayababu — Fri, 04 Sep 2009 13:43:24 -0600

Prerequisites

Perl must be installed and running on the Linux server where this utility will be used.
NSS must be installed to get the VFS support.
(The SDK for this API set can be downloaded from http://developer.novell.com/wiki/index.php/Virtual_File_Services_for_NetWare.)

This tool is used to get the directory quotas assigned to a directory.

It uses Virtual File Services to get the directory quotas.

How to use the utility:

From a terminal prompt type:

perl directoryQuota.pl <enter>

Following menu will be displayed:

To get directory quota
Exit

A sample output on selecting 1 would be:

Select Action: 1
Enter directory Name(with fully qualified path) to find directory quota: /media/nss/VOL1/test

---------------------------------------------------------
quota Amount(in KB)       : 300
used Amount(in KB)        : 0

If quota not assigned to a directory.

Select Action: 1
Enter directory Name(with fully qualified path) to find directory quota: /media/nss/VOL1/testdir

------------------------------------------------------------
       quota not assigned
------------------------------------------------------------

Workgroup Cool Solutions

Utility to Get User Quotas on a Volume

dvijayababu — Thu, 03 Sep 2009 16:06:48 -0600

Prerequisites

Perl must be installed and running on the Linux server where this utility will be used.
NSS must be installed to get the VFS support.
(The SDK for this API set can be downloaded from http://developer.novell.com/wiki/index.php/Virtual_File_Services_for_NetWare.)

This tool is used to get the user quotas on a volume.

It uses Virtual File Services to get the user quotas.

How to use the utility:

From a terminal prompt type:

perl userQuota.pl <enter>

Following menu will be displayed:

To get user quota on a volume
Exit

A sample output on selecting 1 would be:

Select Action: 1
Enter Volume Name to find user quotas: XYZ

---------------------------------------------------------
user Name                  : v123.novell
quota (in MB)             : 78
used Space (in MB)        : 0
---------------------------------------------------------
If user quota not assigned on volume.

Select Action: 1
Enter Volume Name to find user quotas: COMP

------------------------------------------------
            No User Quotas
------------------------------------------------

Cool Solutions

eDir Transaction ID Finder

ChrisRandles — Wed, 02 Sep 2009 16:00:12 -0600

Avoiding eDirectory Meltdowns With the 'eDirectory Transaction ID Finder

This program finds Transaction IDs embedded in eDirectory 8.7.3.x / 8.8x roll-forward log files (as found in the nds.rfl directory).

If repairs are not run regularly on your eDirectory servers, it is important to know the range of transaction IDs that are currently being issued on each server, so that you can take the necessary preventative action when required.

eDirectory is based on the FLAIM database engine, which has a maximum transaction value of FFFFE000 (hex) and as such it is possible to 'run out' of transaction IDs if a repair is not run (which will reduce the last transaction ID counter).

If a server does run out of transaction IDs, only Novell Technical Services has the ability to correct the problem.

See: eDirectory "Transaction ID" Warning / error -618 database stops working and won't open.
http://www.novell.com/support/viewContent.do?externalId=7002658&sliceId=1

By using this program and comparing results, it is also possible to approximate how long it will be before a particular server runs out of transaction IDs, allowing you to plan accordingly if you have a 24x7 eDirectory server.

Running The Program

The program uses a copy of the roll-forward log from any 8.7.3.x or 8.8x database.

The roll-forward log files are normally located in:

NetWare - SYS:\_netware\nds.rfl
Linux - /var/opt/novell/eDirectory/data/nds.rfl
Windows - C:\Novell\NDS\DIBFiles\nds.rfl

In most cases, the roll-forward log will be called 00000001.LOG and should have a fairly recent timestamp.

In some cases, there may be no log files, the log file may be only 512 bytes in size (no transactions) or there may be multiple log files.

Generally, only one log file is in use at any time by one eDirectory instance.

There are multiple ways to identify the current roll-forward log file. If there is only one log file in the nds.rfl directory then this is the file 'in use'. If there are multiple files, identifying the file with the latest time stamp should indicate which file is being used. The dsbk command can also be used:

On NetWare: dsbk getconfig
Depending on the eDir version, the results are displayed on the logger screen or on a separate 'dsbk' console screen.
On Linux: dsbk getconfig (if previously configured - if no /etc/dsbk.conf, will not work)
The output from the command is sent to the default log file (ndsd.log).
On Windows: From control panel, run the 'Novell eDirectory services' applet. Highlight the dsbk.dlm line, enter the word 'getconfig' in the 'Startup Parameters' box, and then click on start. Nothing will appear to happen, but the config info should have been written to the output log file.
The output is written to C:\Novell\NDS\backup.out

Via iManager - eDirectory Maintenance - Backup Configuration options.

If there are no log files, you may need to enable roll-forward logging before you can make use of this program (see eDirectory documentation).

NOTE: In most cases roll-forward log files appear to be created and updated even if roll forward logging is set to OFF.

NOTE: Although it can be OK to delete log files which are no longer used, do not do this unless you need the space. Be sure you do not delete or modify the 'current' roll-forward log file as it could have severe consequences.

Program Requirements:

The program has been tested on SLED10 and Windows XP, but should run on any OS that supports Perl 5.5.8 or later.

The program was tested with Perl 5.5.8 on Linux and Activeperl 5.10.1 on MS Windows.

Installation:

Make a new directory and place the roll.pl and allroll.pl programs in the directory. Acquire a copy of the the roll-forward log file from the server to be checked and place in the directory with the perl programs.

Execute the program using: perl roll.pl

Enter the name of the log file to be processed (case sensitive on Linux/Unix).

NOTES:
The program allroll.pl is included as a diagnostic utility which will extract ALL transaction IDs from a roll-forward log file regardless of age. The roll.pl program only references what it has identified as recent transactions and will not include transactions considered as 'old' data. Log files are actually re-used from the start, so the ordering of transaction IDs can appear to be inconsistent when viewing transactions from the whole file. The output file for the allroll.pl program is called 'All_eDir_Transactions.txt'.

When running dsrepair/ndsrepair in order to reduce the current transaction ID counter, please make sure you ONLY set the 2 options to 'yes' as indicated in TID#7002658. If any other combination of yes/no switches is used, the transaction ID will probably not be reduced.

Example Program Run / Output:

Name of roll-forward log file [Default=00000001.log]: 00000001.LOG

Processing!


Last Transaction ID identified: Hex   [6392b4e5] : HexMax [FFFFe000]
                                            Dec [1670558949] : DecMax [4294959104]

Number of Transactions left   : Dec [2624400155]  61.10% remaining

Cool Solutions