Loading
Showing posts with label Windows 2003. Show all posts
Showing posts with label Windows 2003. Show all posts

Sunday, January 2, 2011

Configuring FTP in Isolation Mode in IIS 6

IIS FTP isolation mode enables you to have a separate directory per FTP user. For example if you had a dozen different users that all need access to your FTP server but you did not want them to see any directories but their own you could setup Isolation Mode. Isolation Mode supports users either on the local computer, or if you are a member of a domain it supports domain users.

We will begin by assuming you have FTP (and IIS) installed. Launch IIS Manager (IIS Manager 6.0 in Windows 2008). NOTE: in Windows 2008 make sure you install the IIS Management Console role so you can manage your FTP sites.
  • Delete or disable the default ftp site
  • Create a new FTP site with desired values - at the FTP User Isolation screen select Isolate Users or Isolate Users using Active Directory (which ever works better for your situation)
  • Specify path for your new FTP site
  • Set FTP Site Access Permissions to both Read and Write
Within the root FTP directory you must create either a directory named localuser or <your_domain_name>, depending on which isolation mode you are using.  In my case I am NOT using Active Directory so I created the directory localuser.

Within the localuser or <your_domain_name> directory create the desired user directories and assign each user sufficient permissions to their respective directory.


Example - creating directories:
md ftproot
md ftproot\localuser
md ftproot\localuser\localuser1
md ftproot\localuser\localuser2
md ftproot\localuser\localuser3
Example - setting Create NTFS permissions on each respective directory:
cacls ftproot\localuser\localuser1 /E /G localuser1:C
cacls ftproot\localuser\localuser2 /E /G localuser2:C
cacls ftproot\localuser\localuser3 /E /G localuser3:C

Wednesday, February 17, 2010

Restarting IIS using the command-line

You can restart IIS and disable Reliable Restart using the command prompt and Iisreset.exe. See the following command-line usage and parameters.

iisreset [computername]
 
/RESTART Stop and then restart all Internet services.
/START  Start all Internet services.
/STOP Stop all Internet services.
/REBOOT  Reboot the computer.
/REBOOTONERROR   Reboot the computer if an error occurs when starting, stopping, or restarting Internet services.
/NOFORCE Do not forcefully terminate Internet services if attempting to stop them gracefully fails.
/TIMEOUT:val Specify the timeout value (in seconds) to wait for a successful stop of Internet services. On expiration of this timeout the computer can be rebooted if the /REBOOTONERROR parameter is specified. The default value is 20s for restart, 60s for stop, and 0s for reboot.
/STATUS Display the status of all Internet services.
/ENABLE  Enable restarting of Internet Services on the local system.
/DISABLE Disable restarting of Internet Services on the local system.

Example (restart IIS on local computer):
iisreset /restart

Friday, January 1, 2010

Setup self-signed certificate on IIS 6



Create a self-signed SSL certificate with SelfSSL from the IIS 6.0 Resource Kit.

The IIS 6.0 Resource Kit contains a utility called SelfSSL.exe for quickly and easily creating and installing a self-signed certificate into IIS 6 for Windows 2003 or XP.
  • Download IIS 6.0 Resource Kit Tools
  • Install the resource kit
  • Go to Programs \ IIS Resources \ SelfSSL and select "SelfSSL"
  • Execute the following (modify for your environment):

    selfssl.exe /N:CN=www.powercram.com /K:1024 /V:180 /S:56792119 /P:443 /T

  • Go to https://localhost to test.
Explanation of selfssl.exe switches (used in command above):
  • /N:CN=www.powercram.com - common name of the certificate.
  • /K:1024 - key length.
  • /V:180 - number of days certificate is valid.
  • /S:56792119 - IIS site ID.  Default is 1 for "default site."
  • /P:443 - SSL port.
  • /T - Adds the self-signed certificate to "Trusted Certificates" list.

Monday, October 19, 2009

Exchange 2007 HOW TO: Add Email Addresses To Public Folders

How do we add email addresses to Public Folders?

It should be pretty simple - If Get-Mailbox shows the emailaddresses property for a mailbox, and Set-Mailbox allows you to use the -EmailAddresses switch to add email addresses, one can't be blamed for believing it'll work the same way for Public Folders.

Objects other than Public Folders need to be mailbox or mail-enabled to be Exchange recipients, Public Folders do not (Yes, they are mail-enabled by default). To modify mail-related attributes of Public Folders, you use the Set-MailPublicFolder command.

To add additional email address to a (mail-enabled) Public Folder:

$PF = Get-MailPublicFolder "Sales"
$PF.EmailAddresses += "Sales-EMEA@domain.com"
$PF | Set-MailPublicFolder

The first line gets mail-related properties of Public Folder "Sales" in a variable called $PF. Next, we add the additional email address, without wiping out the existing ones. Finally, we commit the change using Set-MailPublicFolder.

If you simply use Set-MailPublicFolder "Sales" -EmailAddresses "Sales-EMEA@domain.com", it will replace the existing values in the EmailAddresses property.

Another difference to note between how the Set-PublicFolder and Get-PublicFolder commands work, compared to Set-MailPublicFolder and Get-MailPublicFolder - the former takes a relative path of a Public Folder. For instance, to get the Sales PF if it's in the root of the Public Folder tree, we would need to add a \ before the name:
Get-PublicFolder \Sales
However, the Get/Set-MailPublicFolder commands work using the alias/display name of the PF. Why the difference? One way to look at it - when using Get/Set-PublicFolder, you're working with the actual Public Folder. When using Get/Set-MailPublicFolder, you're working with the Active Directory object created for that Public Folder (which holds mail-related attributes, making it possible for a Public Folder to be mail-enabled).

To change the primary email address of the Public Folder "Sales" from "Sales@domain.com" to the new address we just entered - "Sales-EMEA@domain.com":
Set-MailPublicFolder "Sales" -EmailAddressPolicyEnabled $false -PrimarySmtpAddress "Sales-EMEA@domain.com"
As you may have already figured out, we exempted the Public Folder from getting EmailAddressPolicies applied. In Exchange Server 2003/2000, you could change the default email address of a recipient, without unchecking the checkbox. Result: A few minutes after you completed the change, Recipient Policies would apply and change the primary email address back.

Exchange Server 2007 doesn't let you change the default email address without exempting the recipient from email address policies.

Wednesday, October 7, 2009

Mount an ISO image in Windows 7 or Vista (also works on 2003 and 2008)

The freeware utility from Microsoft to mount ISO Images in XP and 2003 doesn’t work in Windows 7 or Vista. Thankfully there’s another FREE utility that does, Virtual Clone Drive. With it you can mount .ISO, .CCD, .DVD, .IMG, .UDF and .BIN files.

FYI as of the latest version, it should work on Windows 7 or Vista 64 bit edition.

Monday, October 5, 2009

Set Time Zone From Command Line in Windows 2003, XP and 2000

Quick and easy way to set timezone from command line in Windows 2003, XP and 2000.
CONTROL.EXE TIMEDATE.CPL,,/Z Eastern Standard Time
CONTROL.EXE TIMEDATE.CPL,,/Z Central Standard Time
CONTROL.EXE TIMEDATE.CPL,,/Z Mountain Standard Time
CONTROL.EXE TIMEDATE.CPL,,/Z Pacific Standard Time
These are a little longer but they do the same thing.
RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl,,/Z Eastern Standard Time
RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl,,/Z Central Standard Time
RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl,,/Z Mountain Standard Time
RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl,,/Z Pacific Standard Time
See also Set Time Zone From Command Line in Windows 7 and Windows 2008

Keywords:
change time zone from command line windows xp
windows 2003 change timezone
command to get time zone in win xp

Monday, September 7, 2009

BartPE (Bart's Preinstalled Environment)

BartPE (Bart's Preinstalled Environment) is a lightweight variant of Microsoft Windows XP or Windows Server 2003 32bit operating systems, similar to a Windows Preinstallation Environment, which can be run from a Live CD or Live USB drive.

A BartPE system image is created using PE Builder, a freeware program created by Bart Lagerweij. It requires a legal copy of Windows XP or Windows Server 2003. Additional applications can be included in the image using plugins.

As a Live CD or USB, BartPE allows a user to boot Windows, even if a hardware or software fault has disabled the installed operating systems on the internal hard drive — for instance, to recover files. It can also be used to scan for and remove rootkits, viruses and spyware (that have infected boot files), or to reset a lost administrator password.

Description
As with Windows Preinstallation Environment, BartPE operates by loading system registry files into RAM, and not writing any registry changes back to boot media. Thus, both operating systems require no hard drive or network access. This also allows them to be run from non-writable media such as a CD-ROM.

Since each instance of BartPE is a new installation, the BartPE "boot" disk needs original Windows setup files in order to operate. The Bart PE Builder application interprets and condenses files from a Windows setup CD to create the BartPE installation. It can build from a Windows XP Pro or Home Edition CD, or from a preinstalled Windows XP version (without a CD).[1]

Additional applications can be included in the BartPE setup through the use of "plugins". A plugin contains setup information for a specific application, so that it can be included on the media and installed along with Windows at each BartPE boot. Currently there are a few hundred plugins available in addition to the dozen-odd that are included by default with BartPE. Since BartPE represents a totally independent operating environment, the most obvious application examples involve backup, restoration, diagnosis and error-correction of systems with malfunctioning primary storage drives. Plugin programs can nominally be added to the capacity of the BartPE media.

BartPE is known to have certain incompatibilities with the Windows XP CDs shipped with most Dell PCs. The Dell versions include changes to the Windows setup files that can cause the BartPE build process to fail. Two patches are currently available to correct the known problems.

BartPE cannot create Vista Live DVDs.

Download BartPE

Monday, August 17, 2009

Windows (XP, Vista, Windows 7, 2003, 2008) Commands

Here is a great list Windows XP/2000 commands that will make any Linux user feel at home at the command prompt. A lot of these commands are intended for administrating a network, but they are great for savvy home users as well.

  • at - Windows Scheduling utility
  • bootcfg - This utility allows you to set up your boot options, such as your default OS and other loading options
  • cacls - Changes the ACLs (security Settings) of files and folders. Very similar to chmod in Linux.
  • comp - This utility is very similar to diff in Linux. Use the /? switch to get examples of command usage.
  • defrag - Yes, XP comes with a command line disk defrag utility. Here's an example of how to create a scheduled task to defrag every day:

    schtasks /create /tn "Defrag C" /tr "defrag c: /f" /sc daily /st 04:30:00 /ru "System"
  • diskpart - Use this command to manage your disk partitions. This is the text version for the GUI Disk Manager.
  • driverquery - Produces a list of drivers, their properties, and their versions. Great for computer documentation.
  • eudcedit (unpublished) - Private Character editor. Yes with this program built into Windows XP you can create your own font!
  • findstr - Find String - similar to Linux's Grep.
  • fsutil (unpublished) - This is a utility with a lot of capability. Come back soon for great examples.
  • getmac - This command gets the Media Access Control (MAC) address of your network cards.
  • gpresult - This generates a summary of the user settings and computer group policy settings.
  • gpupdate - Use this utility to manually apply computer and user policy from your windows 2000 (or newer) Active Directory domain.
  • ipconfig - This handy tool displays IP settings of the current computer and much more.
  • MMC - Microsoft Management Console. This is the master tool for Windows, it is the main interface in which all other tools use starting primarily in Windows 2000 and newer systems.
  • more- Utility used to display text output one screen at a time. Example:

    more c:\windows\win.ini
  • msconfig - The ultimate tool to change the services and utilities that start when your Windows machine boots up. You can also copy the executable from XP and use it in Win2k.
  • msinfo32 - An awesome diagnostic tool. With it you can get a list of running processes, including the residing path of the executable (great for manually removing malware) and get detailed information about hardware and system diagnostics.
  • narrator - Turns on the system narrator (can also be found in accessibility options in control panel). Will will allow your computer to dictate text to you.
  • netsh - A network configuration tool console. At the 'netsh>' prompt, use the '?' to list the available commands and type "exit" to get back to a command prompt.
  • netstat - A local network port tool - try netstat -ano.
  • nslookup - A DNS name resolution tool.
  • openfiles - Allows an administrator to display or disconnect open files in XP professional. Type "openfiles /?" for a list of possible parameters.
  • Pathping - A cross between the ping and traceroute utilities. Who needs Neotrace when you can use this? Type "pathping " and watch it go.
  • recover - This command can recover readable information from a damaged disk and is very easy to use.
  • reg - A console registry tool, great for scripting Registry edits.
  • sc - A command line utility called the Service Controller. A power tool to make service changes via a logon/logoff or startup/shutdown script.
  • schtasks - A newer version of the AT command. This allows an administrator to schedule and manage scheduled tasks on a local and remote machines.
  • secedit - Use this utility to manually apply computer and user policy from your windows 2000 (or newer) domain. Example to update the machine policy: secedit /refreshpolicy machine_policy /enforce
    To view help on this, just type secedit.
    NOTE: In Windows XP SP1 and news, this command is superceded by: gpupdate /force
  • sfc - The system file checker scans important system files and replaces the ones you (or your applications) hacked beyond repair with the real, official Microsoft versions.
  • shutdown - With this tool, You can shut down or restart your own computer, or an administrator can shut down or restart a remote computer.
  • sigverif - With the sigverif tool you can have all driver files analyzed to verify that they are digitally signed. Just type 'sigverif' at the command prompt.
  • systeminfo - Basic system configuration information, such as the system type, the processor type, time zone, virtual memory settings, system uptime, and much more. This program is great for creating an inventory of computers on your network.
  • sysedit - System Configuration File Editor. An old tool that was very handy for the Windows 9X days. msconfig is what you want to use now.
  • tasklist - Tasklist is the command console equivalent to the task manager in windows. It is a must have when fighting malware and viruses. Try the command:

    tasklist /svc to view the memory resources your services take up.
  • taskkill - Taskkill contains the rest of the task manager functionality. It allows you to kill those unneeded or locked up applications.
  • tree - This command will provide a 'family tree' style display of the drive/folder you specify.
  • WMIC - Windows Management Instrumentation Command tool. This allows you to pull an amazing amount of low-level system information from a command line scripting interface.

Of course this list in note exhaustive, I just wanted to focus on tools that are particularly helpful that everyone might use. For the official list, please visit Microsoft Windows XP Pro Command Reference.

Friday, July 31, 2009

How to recover missing, lost, or deleted files from Windows XP, Vista, Server 2003 and 2008 and Windows 7 as well as Apple Macs

Before reviewing the below recommendations and suggestions, verify that the files have actually been deleted; in some cases the files may have simply been moved. You can search the hard disk drive for the files you believe to be missing by running find or search on the computer.

Recover file from backup
If the file has been backed up to floppy disk or other medium it is recommended that the file be restored from that backup if the file cannot be found.

Restore from Recycling Bin or Trash
If you are running Apple MacOS, Microsoft Windows 95, NT, 98, 2000, ME, XP, Vista, or later operating system and the file has been recently deleted it is possible that the file may still be in the Trash or Recycle Bin. If present within this area it can be recovered.

Download freeware program and/or purchase a program
Below is a list of freeware file recovery programs that can be used freely to recover lost data.
PC Inspector File Recover
Restoration
Recuva
Undelete Plus
FreeUndelete
Photorec

In addition to the above freeware programs there are also several companies who have created programs designed to recover your lost data. For example, PowerQuest makes the utility Drive Image that in some cases can be used to recover data from a hard drive.

Utilize a service from a company that specializes in recovering lost data
Utilize the service of a local data recovery company or an out of state data recovery company. One word of caution is that these services can sometimes be very expensive. It is only recommended they be used if the data is extremely important. Below is a listing of a few major data recovery companies.
Action Front Data Recovery
CBL Data Recovery Technologies Inc.
Doctor Byte
DriveSavers Data Recovery
Lazarus Data Recovery
Ontrack
Virtual Data Recovery
Stellar Data Recovery
DataCent Professional Data Recovery

There are also several companies that specialize in the service of recovering files or documents that are password protected. Below is a listing of some of the companies that provide this service.

Passwordcrackers
Passwordservices.com
Password Recovery software

Monday, July 27, 2009

Mac connect to Windows File Share

By default, Windows 2003 Server domain controllers have "Microsoft network server: Digitally sign communications (always)" set to "Enabled" by default. This is likely causing the Macs to fail to authenticate with the "error = -5000" when trying to connect via CIFS or SMB (samba)

To change this on a given domain controller, go to "Start" ->"Administrative Tools" -> "Domain Controller Security Policy" (not Domain Policy) and look for "Security Settings" -> "Local Policies" -> "Security Options" -> "Microsoft network server: Digitally sign communications (always)". It should show "Enabled" by default. Double-click on it and set to "Disabled".

Then close the app and click on start | Run - enter the command 'gpudate' to refresh group policy and hit enter.

You should now be able to use the "Go" > "Connect to Server" command in Finder to map to a share as shown below:

cifs://SERVER/SHARE

MySQL Backup Shell Script

***TO CREATE BACKUP SCRIPT ON LOCAL SERVER
mkdir /root/bin
vi /root/bin/mysqlbak.sh (then copy script into this file)
change parameters in script to match database
chmod 755 /root/bin/mysqlback.sh

***TO VERIFY SCRIPT WORKS
1. run this command
/root/bin/mysqlbak.sh
2. when script is done, check subdirs of /var/backup/db/daily for tarred & gzipped backups

***TO SCHEDULE THIS TO RUN DAILY, CREATE SYMBOLIC LINK
ln -s /root/bin/mysqlbak.sh /etc/cron.daily/mysqlbak.sh

***TO RESTORE
mysql -uUSER -pPASSWORD DBNAME_RESTORE < DBNAME_BACKUPFILE.sql

#!/bin/bash
#
# MySQL Backup Script
# VER. 2.5 - http://sourceforge.net/projects/automysqlbackup/
# Copyright (c) 2002-2003 wipe_out@lycos.co.uk
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
#=====================================================================
#=====================================================================
# Set the following variables to your system needs
# (Detailed instructions below variables)
#=====================================================================

# crontab entry that will work for this script
# 57 5 * * 2,3,4,5,6 /root/bin/mysqlbackup.sh


# Username to access the MySQL server e.g. dbuser
USERNAME=

# Username to access the MySQL server e.g. password
PASSWORD=


# Host name (or IP address) of MySQL server e.g localhost
DBHOST=localhost

# List of DBNAMES for Daily/Weekly Backup e.g. "DB1 DB2 DB3" - you can put "all" as the value to backup all

DBNAMES=" mysql phpMyAdmin"
# Backup directory location e.g /var/www/backup/db
BACKUPDIR="/var/backup/db"

# Mail setup
# What would you like to be mailed to you?
# - log : send only log file
# - files : send log file and sql files as attachments (see docs)
# - stdout : will simply output the log to the screen if run manually.
# - quiet : Only send logs if an error occurs to the MAILADDR.
MAILCONTENT="log"

# Set the maximum allowed email size in k. (4000 = approx 5MB email [see docs])
MAXATTSIZE="4000"

# Email Address to send mail to? (user@domain.com)
MAILADDR="backups@soundenterprises.com"


# ============================================================
# === ADVANCED OPTIONS ( Read the doc's below for details )===
#=============================================================

# List of DBBNAMES for Monthly Backups.
MDBNAMES="mysql $DBNAMES"

# List of DBNAMES to EXCLUDE if DBNAMES are set to all (must be in " quotes)
DBEXCLUDE=""

# Include CREATE DATABASE in backup?
CREATE_DATABASE=yes

# Separate backup directory and file for each DB? (yes or no)
SEPDIR=yes

# Which day do you want weekly backups? (1 to 7 where 1 is Monday)
DOWEEKLY=7

# Choose Compression type. (gzip or bzip2)
COMP=gzip

# Compress communications between backup server and MySQL server?
COMMCOMP=no

# Additionally keep a copy of the most recent backup in a seperate directory.
LATEST=no

# The maximum size of the buffer for client/server communication. e.g. 16MB (maximum is 1GB)
MAX_ALLOWED_PACKET=

# For connections to localhost. Sometimes the Unix socket file must be specified.
SOCKET=

# Command to run before backups (uncomment to use)
#PREBACKUP="/etc/mysql-backup-pre"

# Command run after backups (uncomment to use)
#POSTBACKUP="/etc/mysql-backup-post"

#=====================================================================
# Options documantation
#=====================================================================
# Set USERNAME and PASSWORD of a user that has at least SELECT permission
# to ALL databases.
#
# Set the DBHOST option to the server you wish to backup, leave the
# default to backup "this server".(to backup multiple servers make
# copies of this file and set the options for that server)
#
# Put in the list of DBNAMES(Databases)to be backed up. If you would like
# to backup ALL DBs on the server set DBNAMES="all".(if set to "all" then
# any new DBs will automatically be backed up without needing to modify
# this backup script when a new DB is created).
#
# If the DB you want to backup has a space in the name replace the space
# with a % e.g. "data base" will become "data%base"
# NOTE: Spaces in DB names may not work correctly when SEPDIR=no.
#
# You can change the backup storage location from /backups to anything
# you like by using the BACKUPDIR setting..
#
# The MAILCONTENT and MAILADDR options and pretty self explanitory, use
# these to have the backup log mailed to you at any email address or multiple
# email addresses in a space seperated list.
# (If you set mail content to "log" you will require access to the "mail" program
# on your server. If you set this to "files" you will have to have mutt installed
# on your server. If you set it to "stdout" it will log to the screen if run from
# the console or to the cron job owner if run through cron. If you set it to "quiet"
# logs will only be mailed if there are errors reported. )
#
# MAXATTSIZE sets the largest allowed email attachments total (all backup files) you
# want the script to send. This is the size before it is encoded to be sent as an email
# so if your mail server will allow a maximum mail size of 5MB I would suggest setting
# MAXATTSIZE to be 25% smaller than that so a setting of 4000 would probably be fine.
#
# Finally copy automysqlbackup.sh to anywhere on your server and make sure
# to set executable permission. You can also copy the script to
# /etc/cron.daily to have it execute automatically every night or simply
# place a symlink in /etc/cron.daily to the file if you wish to keep it
# somwhere else.
# NOTE:On Debian copy the file with no extention for it to be run
# by cron e.g just name the file "automysqlbackup"
#
# Thats it..
#
#
# === Advanced options doc's ===
#
# The list of MDBNAMES is the DB's to be backed up only monthly. You should
# always include "mysql" in this list to backup your user/password
# information along with any other DBs that you only feel need to
# be backed up monthly. (if using a hosted server then you should
# probably remove "mysql" as your provider will be backing this up)
# NOTE: If DBNAMES="all" then MDBNAMES has no effect as all DBs will be backed
# up anyway.
#
# If you set DBNAMES="all" you can configure the option DBEXCLUDE. Other
# wise this option will not be used.
# This option can be used if you want to backup all dbs, but you want
# exclude some of them. (eg. a db is to big).
#
# Set CREATE_DATABASE to "yes" (the default) if you want your SQL-Dump to create
# a database with the same name as the original database when restoring.
# Saying "no" here will allow your to specify the database name you want to
# restore your dump into, making a copy of the database by using the dump
# created with automysqlbackup.
# NOTE: Not used if SEPDIR=no
#
# The SEPDIR option allows you to choose to have all DBs backed up to
# a single file (fast restore of entire server in case of crash) or to
# seperate directories for each DB (each DB can be restored seperately
# in case of single DB corruption or loss).
#
# To set the day of the week that you would like the weekly backup to happen
# set the DOWEEKLY setting, this can be a value from 1 to 7 where 1 is Monday,
# The default is 6 which means that weekly backups are done on a Saturday.
#
# COMP is used to choose the copmression used, options are gzip or bzip2.
# bzip2 will produce slightly smaller files but is more processor intensive so
# may take longer to complete.
#
# COMMCOMP is used to enable or diable mysql client to server compression, so
# it is useful to save bandwidth when backing up a remote MySQL server over
# the network.
#
# LATEST is to store an additional copy of the latest backup to a standard
# location so it can be downloaded bt thrid party scripts.
#
# If the DB's being backed up make use of large BLOB fields then you may need
# to increase the MAX_ALLOWED_PACKET setting, for example 16MB..
#
# When connecting to localhost as the DB server (DBHOST=localhost) sometimes
# the system can have issues locating the socket file.. This can now be set
# using the SOCKET parameter.. An example may be SOCKET=/private/tmp/mysql.sock
#
# Use PREBACKUP and POSTBACKUP to specify Per and Post backup commands
# or scripts to perform tasks either before or after the backup process.
#
#
#=====================================================================
# Backup Rotation..
#=====================================================================
#
# Daily Backups are rotated weekly..
# Weekly Backups are run by default on Saturday Morning when
# cron.daily scripts are run...Can be changed with DOWEEKLY setting..
# Weekly Backups are rotated on a 5 week cycle..
# Monthly Backups are run on the 1st of the month..
# Monthly Backups are NOT rotated automatically...
# It may be a good idea to copy Monthly backups offline or to another
# server..
#
#=====================================================================
# Please Note!!
#=====================================================================
#
# I take no resposibility for any data loss or corruption when using
# this script..
# This script will not help in the event of a hard drive crash. If a
# copy of the backup has not be stored offline or on another PC..
# You should copy your backups offline regularly for best protection.
#
# Happy backing up...
#
#=====================================================================
# Restoring
#=====================================================================
# Firstly you will need to uncompress the backup file.
# eg.
# gunzip file.gz (or bunzip2 file.bz2)
#
# Next you will need to use the mysql client to restore the DB from the
# sql file.
# eg.
# mysql --user=username --pass=password --host=dbserver database < /path/file.sql
# or
# mysql --user=username --pass=password --host=dbserver -e "source /path/file.sql" database
#
# NOTE: Make sure you use "<" and not ">" in the above command because
# you are piping the file.sql to mysql and not the other way around.
#
# Lets hope you never have to use this.. :)
#

#
#=====================================================================
#=====================================================================
#=====================================================================
#
# Should not need to be modified from here down!!
#
#=====================================================================
#=====================================================================
#=====================================================================
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/mysql/bin
DATE=`date +%Y-%m-%d_%Hh%Mm` # Datestamp e.g 2002-09-21
DOW=`date +%A` # Day of the week e.g. Monday
DNOW=`date +%u` # Day number of the week 1 to 7 where 1 represents Monday
DOM=`date +%d` # Date of the Month e.g. 27
M=`date +%B` # Month e.g January
W=`date +%V` # Week Number e.g 37
VER=2.5 # Version Number
LOGFILE=$BACKUPDIR/$DBHOST-`date +%N`.log # Logfile Name
LOGERR=$BACKUPDIR/ERRORS_$DBHOST-`date +%N`.log # Logfile Name
BACKUPFILES=""
OPT="--quote-names --opt" # OPT string for use with mysqldump ( see man mysqldump )

# Add --compress mysqldump option to $OPT
if [ "$COMMCOMP" = "yes" ];
then
OPT="$OPT --compress"
fi

# Add --compress mysqldump option to $OPT
if [ "$MAX_ALLOWED_PACKET" ];
then
OPT="$OPT --max_allowed_packet=$MAX_ALLOWED_PACKET"
fi

# Create required directories
if [ ! -e "$BACKUPDIR" ] # Check Backup Directory exists.
then
mkdir -p "$BACKUPDIR"
fi

if [ ! -e "$BACKUPDIR/daily" ] # Check Daily Directory exists.
then
mkdir -p "$BACKUPDIR/daily"
fi

if [ ! -e "$BACKUPDIR/weekly" ] # Check Weekly Directory exists.
then
mkdir -p "$BACKUPDIR/weekly"
fi

if [ ! -e "$BACKUPDIR/monthly" ] # Check Monthly Directory exists.
then
mkdir -p "$BACKUPDIR/monthly"
fi

if [ "$LATEST" = "yes" ]
then
if [ ! -e "$BACKUPDIR/latest" ] # Check Latest Directory exists.
then
mkdir -p "$BACKUPDIR/latest"
fi
eval rm -fv "$BACKUPDIR/latest/*"
fi

# IO redirection for logging.
touch $LOGFILE
exec 6>&1 # Link file descriptor #6 with stdout.
# Saves stdout.
exec > $LOGFILE # stdout replaced with file $LOGFILE.
touch $LOGERR
exec 7>&2 # Link file descriptor #7 with stderr.
# Saves stderr.
exec 2> $LOGERR # stderr replaced with file $LOGERR.


# Functions

# Database dump function
dbdump () {
mysqldump --user=$USERNAME --password=$PASSWORD --host=$DBHOST $OPT $1 > $2
return 0
}

# Compression function plus latest copy
SUFFIX=""
compression () {
if [ "$COMP" = "gzip" ]; then
gzip -f "$1"
echo
echo Backup Information for "$1"
gzip -l "$1.gz"
SUFFIX=".gz"
elif [ "$COMP" = "bzip2" ]; then
echo Compression information for "$1.bz2"
bzip2 -f -v $1 2>&1
SUFFIX=".bz2"
else
echo "No compression option set, check advanced settings"
fi
if [ "$LATEST" = "yes" ]; then
cp $1$SUFFIX "$BACKUPDIR/latest/"
fi
return 0
}


# Run command before we begin
if [ "$PREBACKUP" ]
then
echo ======================================================================
echo "Prebackup command output."
echo
eval $PREBACKUP
echo
echo ======================================================================
echo
fi


if [ "$SEPDIR" = "yes" ]; then # Check if CREATE DATABSE should be included in Dump
if [ "$CREATE_DATABASE" = "no" ]; then
OPT="$OPT --no-create-db"
else
OPT="$OPT --databases"
fi
else
OPT="$OPT --databases"
fi

# Hostname for LOG information
if [ "$DBHOST" = "localhost" ]; then
HOST=`hostname`
if [ "$SOCKET" ]; then
OPT="$OPT --socket=$SOCKET"
fi
else
HOST=$DBHOST
fi

# If backing up all DBs on the server
if [ "$DBNAMES" = "all" ]; then
DBNAMES="`mysql --user=$USERNAME --password=$PASSWORD --host=$DBHOST --batch --skip-column-names -e "show databases"| sed 's/ /%/g'`"

# If DBs are excluded
for exclude in $DBEXCLUDE
do
DBNAMES=`echo $DBNAMES | sed "s/\b$exclude\b//g"`
done

MDBNAMES=$DBNAMES
fi

echo ======================================================================
echo AutoMySQLBackup VER $VER
echo http://sourceforge.net/projects/automysqlbackup/
echo
echo Backup of Database Server - $HOST
echo ======================================================================

# Test is seperate DB backups are required
if [ "$SEPDIR" = "yes" ]; then
echo Backup Start Time `date`
echo ======================================================================
# Monthly Full Backup of all Databases
if [ $DOM = "01" ]; then
for MDB in $MDBNAMES
do

# Prepare $DB for using
MDB="`echo $MDB | sed 's/%/ /g'`"

if [ ! -e "$BACKUPDIR/monthly/$MDB" ] # Check Monthly DB Directory exists.
then
mkdir -p "$BACKUPDIR/monthly/$MDB"
fi
echo Monthly Backup of $MDB...
dbdump "$MDB" "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql"
compression "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql$SUFFIX"
echo ----------------------------------------------------------------------
done
fi

for DB in $DBNAMES
do
# Prepare $DB for using
DB="`echo $DB | sed 's/%/ /g'`"

# Create Seperate directory for each DB
if [ ! -e "$BACKUPDIR/daily/$DB" ] # Check Daily DB Directory exists.
then
mkdir -p "$BACKUPDIR/daily/$DB"
fi

if [ ! -e "$BACKUPDIR/weekly/$DB" ] # Check Weekly DB Directory exists.
then
mkdir -p "$BACKUPDIR/weekly/$DB"
fi

# Weekly Backup
if [ $DNOW = $DOWEEKLY ]; then
echo Weekly Backup of Database \( $DB \)
echo Rotating 5 weeks Backups...
if [ "$W" -le 05 ];then
REMW=`expr 48 + $W`
elif [ "$W" -lt 15 ];then
REMW=0`expr $W - 5`
else
REMW=`expr $W - 5`
fi
eval rm -fv "$BACKUPDIR/weekly/$DB_week.$REMW.*"
echo
dbdump "$DB" "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql"
compression "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql$SUFFIX"
echo ----------------------------------------------------------------------

# Daily Backup
else
echo Daily Backup of Database \( $DB \)
echo Rotating last weeks Backup...
eval rm -fv "$BACKUPDIR/daily/$DB/*.$DOW.sql.*"
echo
dbdump "$DB" "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql"
compression "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
done
echo Backup End `date`
echo ======================================================================


else # One backup file for all DBs
echo Backup Start `date`
echo ======================================================================
# Monthly Full Backup of all Databases
if [ $DOM = "01" ]; then
echo Monthly full Backup of \( $MDBNAMES \)...
dbdump "$MDBNAMES" "$BACKUPDIR/monthly/$DATE.$M.all-databases.sql"
compression "$BACKUPDIR/monthly/$DATE.$M.all-databases.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$DATE.$M.all-databases.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi

# Weekly Backup
if [ $DNOW = $DOWEEKLY ]; then
echo Weekly Backup of Databases \( $DBNAMES \)
echo
echo Rotating 5 weeks Backups...
if [ "$W" -le 05 ];then
REMW=`expr 48 + $W`
elif [ "$W" -lt 15 ];then
REMW=0`expr $W - 5`
else
REMW=`expr $W - 5`
fi
eval rm -fv "$BACKUPDIR/weekly/week.$REMW.*"
echo
dbdump "$DBNAMES" "$BACKUPDIR/weekly/week.$W.$DATE.sql"
compression "$BACKUPDIR/weekly/week.$W.$DATE.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/week.$W.$DATE.sql$SUFFIX"
echo ----------------------------------------------------------------------

# Daily Backup
else
echo Daily Backup of Databases \( $DBNAMES \)
echo
echo Rotating last weeks Backup...
eval rm -fv "$BACKUPDIR/daily/*.$DOW.sql.*"
echo
dbdump "$DBNAMES" "$BACKUPDIR/daily/$DATE.$DOW.sql"
compression "$BACKUPDIR/daily/$DATE.$DOW.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DATE.$DOW.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
echo Backup End Time `date`
echo ======================================================================
fi
echo Total disk space used for backup storage..
echo Size - Location
echo `du -hs "$BACKUPDIR"`
echo
echo ======================================================================
echo If you find AutoMySQLBackup valuable please make a donation at
echo http://sourceforge.net/project/project_donations.php?group_id=101066
echo ======================================================================

# Run command when we're done
if [ "$POSTBACKUP" ]
then
echo ======================================================================
echo "Postbackup command output."
echo
eval $POSTBACKUP
echo
echo ======================================================================
fi

#Clean up IO redirection
exec 1>&6 6>&- # Restore stdout and close file descriptor #6.
exec 1>&7 7>&- # Restore stdout and close file descriptor #7.

if [ "$MAILCONTENT" = "files" ]
then
if [ -s "$LOGERR" ]
then
# Include error log if is larger than zero.
BACKUPFILES="$BACKUPFILES $LOGERR"
ERRORNOTE="WARNING: Error Reported - "
fi
#Get backup size
ATTSIZE=`du -c $BACKUPFILES | grep "[[:digit:][:space:]]total$" |sed s/\s*total//`
if [ $MAXATTSIZE -ge $ATTSIZE ]
then
BACKUPFILES=`echo "$BACKUPFILES" | sed -e "s# # -a #g"` #enable multiple attachments
mutt -s "$ERRORNOTE MySQL Backup Log and SQL Files for $HOST - $DATE" $BACKUPFILES $MAILADDR < $LOGFILE #send via mutt
else
cat "$LOGFILE" | mail -s "WARNING! - MySQL Backup exceeds set maximum attachment size on $HOST - $DATE" $MAILADDR
fi
elif [ "$MAILCONTENT" = "log" ]
then
cat "$LOGFILE" | mail -s "MySQL Backup Log for $HOST - $DATE" $MAILADDR
if [ -s "$LOGERR" ]
then
cat "$LOGERR" | mail -s "ERRORS REPORTED: MySQL Backup error Log for $HOST - $DATE" $MAILADDR
fi
elif [ "$MAILCONTENT" = "quiet" ]
then
if [ -s "$LOGERR" ]
then
cat "$LOGERR" | mail -s "ERRORS REPORTED: MySQL Backup error Log for $HOST - $DATE" $MAILADDR
cat "$LOGFILE" | mail -s "MySQL Backup Log for $HOST - $DATE" $MAILADDR
fi
else
if [ -s "$LOGERR" ]
then
cat "$LOGFILE"
echo
echo "###### WARNING ######"
echo "Errors reported during AutoMySQLBackup execution.. Backup failed"
echo "Error log below.."
cat "$LOGERR"
else
cat "$LOGFILE"
fi
fi

if [ -s "$LOGERR" ]
then
STATUS=1
else
STATUS=0
fi

# Clean up Logfile
eval rm -f "$LOGFILE"
eval rm -f "$LOGERR"

exit $STATUS

Thursday, July 23, 2009

Host-based routes Windows Server 2000 2003 XP

To display the entire contents of the IP routing table, type:

route print

To display the routes in the IP routing table that begin with 10., type:

route print 10.*

To add a default route with the default gateway address of 192.168.12.1, type:

route add 0.0.0.0 mask 0.0.0.0 192.168.12.1

To add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0 and the next hop address of 10.27.0.1, type:

route add 10.41.0.0 mask 255.255.0.0 10.27.0.1

To add a persistent route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0 and the next hop address of 10.27.0.1, type:

route -p add 10.41.0.0 mask 255.255.0.0 10.27.0.1

To add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, the next hop address of 10.27.0.1, and the cost metric of 7, type:

route add 10.41.0.0 mask 255.255.0.0 10.27.0.1 metric 7

To add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, the next hop address of 10.27.0.1, and using the interface index 0x3, type:

route add 10.41.0.0 mask 255.255.0.0 10.27.0.1 if 0x3

To delete the route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, type:

route delete 10.41.0.0 mask 255.255.0.0

To delete all routes in the IP routing table that begin with 10., type:

route delete 10.*

To change the next hop address of the route with the destination of 10.41.0.0 and the subnet mask of 255.255.0.0 from 10.27.0.1 to 10.27.0.25, type:

route change 10.41.0.0 mask 255.255.0.0 10.27.0.25

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/route.mspx?mfr=true

Sunday, July 19, 2009

TCP Optimization for Windows

I have recently been creating nasty batch files to alter default and non-existing networking settings to improve performance on file transfers for replication and came across this awesome tool that is free and does a great job.

We set our MTU to 1350 to take in to account firewall overhead in the vpn mesh. TCP Optimizer is the only tool you need, no installation necessary you just get the .exe to run and it can show you all the settings it is going to change. Highly recommended.

Find your optimum MTU by trying different non-fragmentable pings with specific sizes e.g. ping -f -l 1322 may work where ping -f -l -1323 may not. The highest value you get without an error is what you can use. Don't rely on Wireshark results as it can't tell if your firewall breaks up the packet into small chunks or not when looking at your server's packet trace.

There is a related hotfix for local file copy issues: http://support.microsoft.com/default.aspx?scid=kb;EN-US;920739 for large file (500MB) and greater. This problem occurs when you copy large files locally from a fast disk to a slow disk. For example, this problem can occur when you copy large files from a cluster disk to local system disk.

PSSQL team blog has a nice performance implication of the scalable networking pack that shows it can hinder SQL server performance. http://blogs.msdn.com/psssql/archive/2008/10/01/windows-scalable-networking-pack-possible-performance-and-concurrency-impacts-to-sql-server-workloads.aspx
They mention you will need to disable SNP also which in in this Windows Server 2003 patch http://support.microsoft.com/default.aspx?scid=kb;EN-US;948496 or you can disable EnableTCPChimney, EnableRSS and EnableTCPA.

I found a good article on disabling TCP offloading at a NIC card manufacturer: http://www.alacritech.com/Support/FAQs/DisableOffload.aspx Test to see if helps for large file transfers and you need Windows 2003 SP2 or higher OS. Reboot is not required for this change.  I have attached a vb script that will update the interfaces window size and MTU (1350).  Just for your reference, you could manually find correct NIC interface use this command line to get value from command line:
reg query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces /f AddressType /s
It creates:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{Some Random GUID Value Here to Identify your NIC}]"MTU"=dword:00000546
My .reg file I use (Descriptions of options are found in this KB: http://support.microsoft.com/kb/314053):
Windows Registry Editor Version 5.00
REM Run this from command line: netsh int ip set chimney disabled
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]"Tcp1323Opts"=dword:00000001"GlobalMaxTcpWindowSize"=dword:3fffffff"TcpWindowSize"=dword:0000ffff"EnablePMTUDiscovery"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]"SizReqBuf"=dword:0000ffff
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbt\Parameters]"NodeType"=dword:8
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbt\Parameters]"UseDnsOnlyForNameResolutions"=dword:1
Download: Interfaces.vbs.txt (1.29 KB)

Monday, June 1, 2009

Cygwin SSHd on a Windows 2003 AMI Within Amazon EC2

Recently, I needed to configure a Windows 2003 AMI in EC2 to run a ssh server. I would have expected this to be a simple job, with a variety of choices for making this work, but in the end it was far more time consuming, complicated, and frustrating than I would have guessed. Here is a quick road map of what I did.

My initial thought was that there must be a free, native port of openssh for Windows that installs as a service and otherwise conforms to the Windows environment…wrong! I can’t tell you why this is the case — maybe ssh is just not a microsofty way of doing remote terminals and file transfers — but I couldn’t find anything resembling a free, functional port of openssh for Windows. I found a few blog posts that mentioned that people had tried this, but ultimately they gave up when faced with the integration between openssh’s user/group namespace functions and Windows’ user/group concepts (to say nothing of the differences between the Windows command prompt and the UNIX shells). And these blog posts ultimately suggested that it was easier to run sshd via cygwin than it would be to port sshd to run natively. So….cygwin time!

UNIX is my OS of choice, and I’ve had cygwin on every Windows box I have ever had, so it was a quick jump to download the cygwin installer and install the packages I needed on a freshly started Windows 2003 instance in EC2 (incidentally, I am running the 64-bit, large EC2 instance AMI of Windows 2003 Server with SQL Server Express and no Authentication Services). The openssh package comes with a simple script — ssh-host-config — to generate the server host keys and create the users needed for privilege separation, so it was a nice, simple, relatively painless install. There are a few things that the config script misses, however, which requires you to run it several times before it ultimately succeeds (although it is nice enough to point out the problem each time and prompt you to fix it). After playing with it, I came up with the following actions to perform before running ssh-host-config in order to make it succeed the first time without errors:

0) Add the following line to /cygwin.bat:
set CYGWIN=binmode tty ntsec


1) Run a new cygwin bash shell (after the edit of cygwin.bat) and enter:
mount -s --change-cygdrive-prefix /
chmod +r /etc/passwd /etc/group
chmod 755 /var



2) Run a new cygwin bash shell (to pick up the cygdrive prefix change) and enter:
ssh-host-config
-- yes for privilege separation
-- "binmode tty ntsec" for CYGWIN environment variable setting for the service
-- enter your password of choice for the cyg_server account



3) Enter the following to start sshd:
net start sshd


4) Open the Windows Firewall editor, and add an exception for TCP traffic on port 22 for sshd.

5) If you haven’t already done so, open up port 22 for your EC2 instance group (assuming you are running your instance in the default group):
ec2-authorize -p 22 default


If everything went well, sshd is running and available on port 22, and you can login normally via ssh from other machines. All that is left to do is bundle up a new AMI to capture the cygwin installation…and that should be a piece of cake, right? The updated EC2 API has a new method — ec2-bundle-instance — that kicks off an AMI bundling job for an EC2 instance running Windows, so it should be as simple as calling this method and then grabbing a beer to wait for it to complete. If only it were that simple…

Unlike the AMI bundling scripts for Linux-based EC2 instances, which are ultimately just packaging up the existing file system, the Windows AMI bundling mechanism needs to perform several Windows-specific functions that are ultimately a real pain in the neck. First and foremost is sysprep. Sysprep is Microsoft’s answer to the problem of Windows virtualization; apparently the simple cloning of a Windows installation is not acceptable, and a new Windows SID should be generated for each new instantiation of a Windows virtual image. Sysprep does some other things, too (search for sysprep on Microsoft’s support web site for a more complete description — I am certainly not an expert on it), but ultimately the SID generation is the one that causes problems for a lot of installed software…like cygwin. After bundling a new AMI and starting a new instance with it, I found that sshd is hosed for no apparent reason. Attempts to start sshd via “net start sshd” produce the following cryptic error message:

The CYGWIN sshd service is starting.
The CYGWIN sshd service could not be started.
The service did not report an error.More help is available by typing NET HELPMSG 3534.



WTF?
After several time-consuming iterations of start new instance -> install cygwin -> bundle new AMI -> start new AMI instance -> wonder why sshd is hosed, I found something in the HKEY_USERS tree of the Windows registry that changes after the bundling step. Prior to bundling, with a functioning cygwin/sshd, I see the following in the registry:

[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-1013\Software\Cygnus Solutions]
[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-1013\Software\Cygnus Solutions\Cygwin]
[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-1013\Software\Cygnus Solutions\Cygwin\mounts v2]
[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-1013\Software\Cygnus Solutions\Cygwin\Program Options]
[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-500\Software\Cygnus Solutions]
[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-500\Software\Cygnus Solutions\Cygwin]
[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-500\Software\Cygnus Solutions\Cygwin\mounts v2]
[HKEY_USERS\S-1-5-21-2574196159-1727499900-3384088469-500\Software\Cygnus Solutions\Cygwin\Program Options]

After bundling, in a new instance in which sshd is hosed, I see the following in the registry:

[HKEY_USERS\S-1-5-21-4261372910-2505678249-1238160980-500\Software\Cygnus Solutions][HKEY_USERS\S-1-5-21-4261372910-2505678249-1238160980-500\Software\Cygnus Solutions\Cygwin]
[HKEY_USERS\S-1-5-21-4261372910-2505678249-1238160980-500\Software\Cygnus Solutions\Cygwin\mounts v2]
[HKEY_USERS\S-1-5-21-4261372910-2505678249-1238160980-500\Software\Cygnus Solutions\Cygwin\Program Options]

All of the other registry entries related to cygwin remain the same before and after the bundling step, so my guess is that the loss of entries in the bundled instance is the source of the trouble. But what exactly are those entries?

Again, I’m no windows expert, but the entries in question appear to have the windows SID followed by a user identifier (e.g. in S-1-5-21-4261372910-2505678249-1238160980-500, S-1-5-21-4261372910-2505678249-1238160980 is the SID, and 500 is the user id). Looking at the /etc/passwd file for cygwin, the user id 500 corresponds to the Administrator account, and user id 1013 corresponds to the cyg_server account, used by sshd as a privileged account for switching effective user ids during login. So, my hypothesis is that the privileges for the cyg_server account are somehow lost by sysprep during the bundling step, and sshd is hosed without them in the new bundled AMI instance.To test my hypothesis, I decided to configure the AMI bundling step to skip sysprep. The base Windows EC2 AMIs come with an application in the start menu called “ec2Service Setting” that has a check box to enable/disable sysprep during AMI bundling, so it is easy enough to test this. However, I have no idea what happens to Windows if I disable sysprep during bundling, and I was not able to find a satisfactory answer via internet searches. The closest I got to an answer was to see several of the Amazon admins on the EC2 forum comment that it was not a good idea to disable sysprep if you were going to instantate multiple instances. I also found several documents online that discussed how sysprep was used to sanitize a Windows installation, generate a new SID, and make it generic for installation on any type of hardware. Since the virtual hardware of EC2 is, roughly speaking, identical (given that it is using Xen underneath the hood), I’m not too worried about the hardware issue. I have no idea about “sanitizing” the Windows instance or SID generation, though, so bundling without sysprep might mortally wound Windows (again…I’m no Windows expert). And I do want to run multiple instances from the bundled AMI, so that might be a non-starter as well. So I guess I will try the ready-shoot-aim approach of seeing what happens when I turn it off…

Compressing time, I started with a fresh Windows instance, installed cygwin and configured sshd like before, turned off sysprep and bundled it, started a new instance from the new bundled AMI, and…sshd still works. The new instance retains the SID that it had prior to bundling, and the registry entries are still there for the cyg_server account. Windows also appears to be working in all respects, but I’m not sure I could detect problems that might result internally from the omission of sysprep in the bundling. I guess I can run one more test, starting a bunch of instances at once, to see if having the same SID causes them to interfere with one another. I started four instances, running concurrently, and they each seem to be working fine. Or at least I can’t detect any problems.

So, in closing, it looks like I may have a solution: turn off sysprep if you want to use cygwin sshd in a bundled Windows AMI. Someone with more Microsoft kung-fu might be able to figure out how to make sysprep retain the registry entries for the cyg_server account, or maybe they would write a script to insert them directly into the registry at restart if they are missing…who knows. But for me, disabling sysprep seems to be the way to go. I found lots of other complaints on the internet about sysprep and what it does to installed software when the SID changes, so I’m guessing that there will be a lot of bundled AMIs in EC2 that are created with sysprep disabled. If there are, in fact, issues with multiple instances using the same SID, then I expect we will be reading about it in the EC2 forums, since everyone who creates a new AMI from the base Windows AMIs without sysprep will have the same base SID in their AMIs, and so on….