How to Convert Physical Machine to VMware Machines

How to convert Host or Vmware images to Vmware images

Configuring SQUID Proxy Server on LINUX

Introduction:

Squid server is a popular open source proxy and web cache. It has a variety of uses, from speeding up a web server by caching repeated requests, to caching web, name server query, and other network lookups for a group of people sharing network resources.

It is primarily designed to run on Linux / Unix-like systems. Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process.

Prerequisites:

a. Linux Machine Ex: RHEL5
b. squid-2.6.STABLE6-3.el5.i386.rpm

Installation on Linux
Use the following command to install SQUID RPM

# Rpm –ivh squid-2.6.STABLE6-3.el5.i386.rpm
Squid Basic Configuration
Squid configuration file located at /etc/squid/squid.conf. Open file using a text editor: with the following command.
# vi /etc/squid/squid.conf
Squid Configuration:
-------------------------------------------------------------------------------------------------------
Basic SQUID Config file: Uncommented lines

Cmd : > grep -v "^#" /etc/squid/squid.conf | sed -e '/^$/d' Port

http_port 3128 # Port

hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY


ACL Parameters :
acl password proxy_auth REQUIRED
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 631 # cups
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

Access Parameters
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow password
http_access deny all
icp_access allow all
visible_hostname CARMASQUIDProxy #You can change the name of the Proxy Server

No Authentication Configuration:
Specify the command for the external authenticator. Such a program reads a line containing "username password" and replies “OK" or "ERR" in an endless loop. If you use an authenticator, make sure you have 1 acl of type proxy_auth. By default, the authenticator_program is not used.
Change the http Access Parameter from http_access deny all to http_access allow all
Restart SQUID Proxy Server process

# /etc/ini.d/squid restart

Stopping squid: ................ [ OK ]
Starting squid: . [ OK ]

IE Proxy Server Configuration:

1. Open Internet Explorer
2. Go to Internet Options > Connections Tab > LAN Settings > Proxy Server
3. Enter IPAddress and Port of the SQUID Proxy Server
4. Try Accessing http://www.google.com
5. Done.
-------------------------------------------------------------------------------------------------------
Basic Authentication Configuration:

Specify the command for the external authenticator. Such a program reads a line containing "username password" and replies "OK" or "ERR" in an endless loop. If you use an authenticator, make sure you have 1 acl of type proxy_auth. By default, the authenticator_program is not used.
Add the following configuration parameter to squid config file enable Basic Authentication.

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/basic_passwd

Generate a basic authentication password file for any user “basic”

# htpasswd -c /etc/squid/basic_passwd basic
New password:
Re-type new password:
Adding password for user basic

Username: basic
Password file: /etc/squid/basic_passwd

Restart SQUID Proxy Server process
# /etc/ini.d/squid restart

Stopping squid: ................ [ OK ]
Starting squid: . [ OK ]

IE Proxy Server Configuration:

1. Open Internet Explorer
2. Go to Internet Options > Connections Tab > Lan Settings > Proxy Server
3. Enter IPAddress and Port of the SQUID Proxy Server
4. Try Accessing http://www.google.com > Enter Username and password (basic) > Authenticate it
5. Done.

Digest Authentication Configuration:

Specify the command for the external authenticator. Such a program reads a line containing "username password" and replies "OK" or "ERR" in an endless loop. If you use an authenticator, make sure you have 1 acl of type proxy_auth. By default, the authenticator_program is not used.
Add the following configuration parameter to the squid config file to enable Digest Authentication.

auth_param digest program /usr/lib/squid/digest_pw_auth -c /etc/squid/digest

Create a digest.sh file to generate digest using the following script.

/etc/squid/Digest.sh
-------------------------------------------------------------------------------------------------------
#!/bin/sh
user=$1
pass=$2
realm=$3

if [ -z "$1" -o -z "$2" -o -z "$3" ] ; then
echo "Usage: $0 user password 'realm'";
exit 1
fi

ha1=$(echo -n "$user:$realm:$pass"|md5sum |cut -f1 -d' ')
echo "$user:$realm:$ha1"
-------------------------------------------------------------------------------------------------------
Give executable permissions to the above create file.

# chmod +rwx /etc/squid/digest.sh
#./digest.sh username password 'Squid proxy-caching web server' >>/etc/squid/digest

Generate a digest for the user “Admin” with the password “password”

#./digest.sh admin password 'Squid proxy-caching web server' >>/etc/squid/digest

Restart SQUID Proxy Server process

# /etc/ini.d/squid restart

Stopping squid: ................ [ OK ]
Starting squid: . [ OK ]

IE Proxy Server Configuration:

1. Open Internet Explorer
2. Go to Internet Options > Connections Tab > LAN Settings > Proxy Server
3. Enter IPAddress and Port of the SQUID Proxy Server
4. Try Accessing http://www.google.com > Enter Username and password (Digest) > Authenticate it
5. Done.

how to do bulk import of users and Computers into Windows 2003 Active Directory?

CSVDE
how CSVDE can bulk import users and Computers into Windows 2003 Active Directory ?

Export LDAP data :

If you have a bulk data in your AD and you want to get the users and systems information, use CSVDE and get the results.

CSVDE -d "CN=Users,dc=domain,dc=com" -f Users.CSV


Import data to LDAP:

CSVDE -i(import) -f (filename) example.CSV (CSV file)


"CSVDE -i -f Example.CSV"

For more details go to Windows command prompt and type CSVDE

SAML

Download SAML Tech article

SAML

How to enable SSL connection in the Active Directory Server?

Certificate Services

Certificate Services is included with Windows Server 2003 but not installed by default. The service is used to issue and manage certificates for a Public Key Infrastructure (PKI).

Certificate Services allows a computer running Windows Server 2003 to receive requests for certificates from users and computers, verify the identity of a requestor, issue and revoke certificates, and publish a Certificate Revocation List (CRL).

Install the IIS Service

In order to install the CA you will first need to install IIS on a Windows Server 2003 computer.

1. Click Start > Control Panel > Add or Remove Programs.

2. In Add or Remove Programs, click Add/Remove Windows Components.

3. Under Components, click on Application Server (but do NOT select it) and press on the Details button.

4. In the Application Server window click to select IIS and click Ok.

5. Click Next

Enabling LDAP SSL Connection through Certificates:-

1. Log on as a member of both the Enterprise Admins group and the root domain's Domain Admins group.(Administrator)

2. Go to Settings > Control Panel > Select Add/Remove Programs > Click Add/Remove Windows Components.

3. In the Windows Components Wizard, select the Certificate Services check box. A dialog box appears to inform you that the computer cannot be renamed and that the computer cannot be joined to or removed from a domain after Certificate Services is installed. Click Yes, and then click Next

4. Click Enterprise root CA and then click next

5. Give the common name (LDAPCertificate) for the CA, and then click next

6. In the Certificate Database Settings page, Click next

If you have IIS Server then the Pop up will be displayed to stop IIS Service. Click “Yes” Enable ASP Pages, by click “Yes”

7. When the installation process is completed click Finish.

8. Restart your machine (DC)

Download Microsoft Support Tools from the Microsoft site.

Download: http://www.microsoft.com/downloads/details.aspx?FamilyId=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en

Install Microsoft tools and Go to Start > Run > cmd > ldp.exe > Open

Server: DC Machine Address Port: 636, SSL

2. How to establish a connection between LDAP clients to AD Server?

We can establish SSL connection between LDAP client and AD Server with the help of importing trusted root CA certificate into the client’s environment.

AD Server Side:

1. Start Microsoft Management Console (MMC).

2. Add the Certificates snap-in that manages certificates on the local computer

3. Expand Certificates (Local Computer), expand Trusted Root Certificate authorities

4. Select LDAPCertificate > Right Click > select All Tasks ( Export )

5. “Welcome to Certificate export Wizard” , click next

6. Select Cryptographic Message Syntax Standard PKCS #6 Certificates (.P7B format) , select include all certificates in the certification path if possible option , Click Next

7. Give the file name ( LDAP ) ,Click Next button

8. Click finish export wizard

Client:

1. Copy LDAP.p7b file from AD Server and paste it in the Client machine

2. Double click to open P7b certificate and select LDAPCertificate

3. do right click and select install option to install Third party certificate authority

4. Follow the instruction to complete the process.

Install Microsoft tools and Go to Start > Run > cmd > ldp.exe > Open

SSL Connection works …!