Category Archives: Useful Scripts & Applications

A client wants me to migrate a reasonably large hosting platform. Therefore, I am writing a little database and set of bash scripts in order to mitigate the hosting platform. The first thing that was incredibly apparent is that I wasn’t given much info on the existing state of affairs. This is because there was no info on the state of affairs.

Ultimately I can’t migrate what I don’t know about so first up, audit time!

The tools I have written have proved very popular and useful with management. In fact, they are so happy that they are going to form an ongoing part of the monitoring and management of the new environment too.  Those same tools are available to download from this blog.

Though I must mention that they are providing it without warranty or certification. They may or may not be fit for purpose, they may or may not cause you problems. What I am trying to say is use at your own risk etc.  As far as I am concerned, I am giving you ideas, not directly providing you tools.

So, the environment is in truth a bit odd. The old stuff is kinda all over the place – the details of which are not important.  It’s mostly VPS’s and these live on the OpenVZ hypervisor. Which isn’t really a hypervisor but that is a discussion for another time.  These VZ Hosts are on physical bits of kit across lots of racks and various SANs etc.

To make these scripts work, you need a linux box that can handle bash scripting with MySQL and Apache installed.  You will also need an SSH key pair (I recommend at least 4096 bit key lengths). Also a list of the primary IP addresses for the host boxes you want to audit.

In the download there is a copy of my MySQL schema and the four bash scripts I have written so far, which are:

1. vzmanagement.sh – this is the main script that pulls all the data and inserts it into the database, it’s the biggest script out of the lot and I dare say in places there is likely more efficient ways of doing things.  If you have a data centre that is bigger than mine and you find you need the extra efficiencies feel free to modify!
2. vzcpubalance.sh – this script was born when I realised I needed a quick way of changing the seemingly randomly allocated CPU bean counters across all the boxes all at once.
3. vznewkey.sh – this script simply takes the primary IP address of the VZ Host you are connecting to and initiates a new SSH Key Pair.  As you will see from the script I am a little paranoid about my encryption so by default it uses 8192 bit key lengths.
4. vzkeyrefresh.sh – this script collects the stored public SSH keys from the MySQL database. Creates an “authorized_keys” file and then sequentially logs into each active server and installs it thus meaning that all servers in your farm have all the other active servers public SSH keys and all the active staff’s public SSH keys. For those who have used it before, vzmigrate (the built in migration tool) heavily uses SSH to do its job and as a result key management can get troublesome, particularly if your doing a migration!  I will warn you – whilst this tool is very thoroughly tested in my environment, it may or may not work in yours.  If it doesn’t work properly – you may lock out of your own environment.  TEST IT FIRST!

To set this up, all you need to do is import the

• MySQL schema
• Populate the host name and the Primary IP addresses in the VZHosts table,
• Make sure your public key is on all the servers you are going to connect to
• Make sure that the variables at the top of each of the script files are appropriately set to your environment. (i.e. usernames and passwords) and then run ./vzmanagement.sh

Download is here

Remember – no warranties or support!

One of the projects I am working on is to get a multi-tenanted URL filtering proxy to work. That in itself has not been particularly difficult. It’s just a case of knowing where to find the various Linux config files in the product we have chosen: NetSweeper.  This project is now fully load-balanced with high availability (HA) failover and works with Internet Explorer and a few other mainstream browsers perfectly.  It even does Man-In-The-Middle style SSL intercepting to make sure it filters as much as possible.

Mozilla Firefox has been my downfall on this project.  Usually, I hold Firefox high, but for all its greatness, it sucks at listening to the operating system for proxy settings and using Window’s built-in authentication methods. 

There will be another article in a couple of weeks or so when I next look at this project about how I bully Firefox into doing SSL stuff. Also, forcing it to use Proxy settings but at the moment I haven’t had time to work on that.  What I have done though is get Firefox to work with Windows Single Sign On (SSO).

Basically you can manually set sites to which you want to use SSO. Simply, by visiting a special URL in the browser:

about:config

First of all you get a warning telling you that you need to be careful.  But then you get a very long list of configurable variables.  For SSO you need the variable called:

network.automatic-ntlm-auth.trusted-uris

(use the filter bar at the top and search for ntlm)

If you double click this setting you can url’s to which you want to enable SSO like so:

http://internalserver     or     http://www.google.co.uk

If you need more than one URL, just seperate them by a comma.

Now that’s all well and good. But the fact is that in a domain situation you probably need to do this on hundreds of computers.  I found a vbs script online that claimed to fix this problem and it works very well with only one problem.  Because some of our users have non-standard profile locations we needed to modify it a little.  You can find our version here:

Firefox NTLM Authentication / Single Sign On

Please note, to put that into production you will need to rename the extension to .vbs, put it in a network share and play with group policies.  That bit is down to you!

I wish I could take credit for this script but I found the original online and then one of my colleagues had a bored 10 minutes so he modified the script for me.

Edit (20151017): The vbs script I referenced is no longer available, here is a Google Cache copy of the article.

Learn how YGHT can help you increase your cybersecurity