RHEL4 Servers Configuration Complete

RHEL4 Servers Configuration

"A Contribution by ALI"

Samba Server Configuration

For samba server we have Linux on one side and other side WINDOWS.

Server Side

Ø First of all we copy the “smb.conf” file as “smb.conf.org”.

cp /etc/samba/smb. conf /etc/samba/smb.conf.org

Ø Open file in vi editor and write some statements in it.

vi /etc/samba/smb. conf

[Global Section]

· workgroup = saints (Domain Name)

· netbios name = bscs5 ( File server name. it gives in client side in run command. e.g \\bscs5)

· server string = saints server (optional)

· hosts allow = 192.168.0. 127.0.0.1 or 127.

· hosts deny = 0.0.0.0 / 0

· log file = /var/log/samba/ %m.log (% m means it replace by pc name)

· encrypt passwords = yes

· smb passwd file = /etc/samba/smbpassw d (All samba users r in it)

· unix password sync = yes

· interfaces = eth * lo

· bind interfaces only = yes

· local master = yes

· os level = 64

· domain master = yes

· preferred master = yes

· domain logons = yes

· logon script = netlogon.bat

· add user script = /usr/sbin/useradd –d /dev/null –g machines –s /bin/false –M %U

· logon drive = Z:

· logon path =\\%L\profiles\ %U

· wins support = yes

[Shared Section]

[Homes]

· path = /home/samba/ profiles/ %U

· browsable = no

· writeable = yes

· create mode = 0750 (Files permissions)

· directory mode = 0775 (Directories permissions)

[netlogon]

· path = /home/netlogon

· browsable =no

· write list = @admins (it’s a group name)

[Profiles]

· path = /home/samba/ profiles

· browsable = no

· writeable = yes

· create mask =0600

· directory mask = 0700

· guest ok = yes

Now we make one folder that can access all users.

[Shared]

· path = /home/shared

· writeable = yes

· browsable = yes

· force create mode = 0775

· force directory mode = 3770

· guest ok = yes

· create mask = 0765

First press Esc button then write :wq.

Ø Now restart service

service smb restart

Ø Create groups and directories.

· groupadd –g 600 admins

· groupadd –g 601 machines

· mkdir /home/samba

· mkdir /home/netlogon

· mkdir /home/samba/ profiles

· chmod 1757 /home/samba/ profiles

· chmod 0775 /home/netlogon

· chown root.admins /home/netlogon

Ø Create user in linux.

· adduser muneeb

· passwd muneeb (press enter then its asked to enter passwd)

Ø Now add user in samba.

· smbpasswd –a muneeb (-a means if user not exist in samba then it add otherwise create and give password).

· smbpasswd muneeb (press enter then its asked to enter passwd).

Ø Now we create home directory for samba user in profiles.

· mkdir /home/samba/ profiles/ muneeb

· chown muneeb /home/samba/ profiles/ muneeb (Here 1^st Muneeb is samba user and 2^nd Muneeb is directory).

· chgrp muneeb /home/samba/ profiles/ muneeb (Here 1^st muneeb is group name and 2^nd Muneeb is directory).

Note:-

When we create user then its group with the same name is also created.

Ø Now we apply some commands on sheel.

· Useradd –d /dev/null –g machines –s /bin/false –M meebe (Here meebe is a client pc name).

· vi /etc/passwd (File open in vi editor and search meebe and write $ at the end of the meebe. Like this (meebe$)

· smbpasswd –am meebe (meebe is added into samba).

Ø Now check the samba configuration on server side.

· smbclient //bscs5/profiles –U muneeb (when we press enter then it will asked to enter password. We enter the Muneeb user’s password).

Ø Write this command to check the “etho” in the firewall settings.

· system-config- securitylevel

Client Side

My Computer èProperties è Computer NameèChange

Enter Domain name is “saints”.

Then a small window is open and its will required user name and password. We will enter the privileged user and its password. (user name = Root and its password).

“Welcome to the saints domain” message shown and restart pc and login with samba user. If some error comes then we also have some changes.

StartèrunèregeditèHKEY_LOCAL_MACHINEèSYSTEMèCurrentConsoleSet èServicesèNetlogonèParameters

Double click on “requiresignorseal” and write 0 at the place on 1. And restart pc and again loin with samba user.

NIS SERVER Configuration

NIS stands for “Network Information System”. NIS servers are typically used to synchronize account information. They can share the contents of /etc/passwd, /etc/shadow and /etc/group files. For NIS server both pc have Linux.

Server Side

Ø Start NIS services

· service ypserv restart

· service portmap restart

Ø Open file in vi editor and add one line.

· vi /etc/sysconfig/ network

· NISDOMAIN = saint

Ø Restart the service

· service ypserv restart

Ø Now create one file and write some lines.

· vi /var/yp/securenets

· 255.255.255. 255 127.0.0.1

· 255.255.255. 0 192.168.0.0

Ø Restart the services

· service portmap restart

· service ypserv restart

· service ypxfrd restart

Ø Simple open file search “all” word. For search first press Esc then write /all: and press enter.

· vi /var/yp/Makefile

Ø write command for master server. It generate NIS maps show output in shell then press ctrl+d to move next then press y.

· /usr/lib/yp/ ypinit –m

Ø Restart the services and also permanent on.

· service portmap restart

· service ypserv restart

· service yppasswdd restart

· service ypxfrd restart

· chkconfig portmap on

· chkconfig ypserv on

· chkconfig yppasswdd on

· chkconfig ypxfrd on

Ø Now we create an NIS user

· adduser –u 1000 nisuser

· passwd nisuser nisuser

Ø Now move into /var/yp directory and write “make”. After the creation of every user.

· cd /var/vp

· make (It generates token of nisuser).

Ø Test to check services. [Optional]

· ps –auxf | grep yp

Ø Start the sshd service and also permanent on.

· service sshd restart

· chkconfig sshd on

Ø Write this command to check the “etho” in the firewall settings.

· system-config- securitylevel

Client Side

Ø First of all we check some RPMS that should be available on client side.

· rpm –qa | grep portmap

· rpm –qa | grep ypbind

· rpm –qa | grep yp-tools

· rpm –qa | grep authconfig

Ø To give NIS domain name and IP write this line.

· system-config- authentication –gui (One window is open check the “enable NIS Support” and click on “Configure NIS” button).

· NIS domain name = saint

· IP Address = IP Address of Server

Ø Start the ypbind service.

· service ypbind start

if OK then successful if error then check the log file.

· tail f /var/log/messages

Ø Restart the services

· service sshd restart

· service portmap restart

· service ypxfrd restart

· service ypbind restart

Ø Write some commands on shell.

· ypwhich (Display the IP address of server)

· ypcat passwd (It should display the password file of server machine).

· getent passwd (Display local password file & maps should be displayed).

Ø Create home directory of nisuser and also change its permissions.

· mkdir /home/nisuser

· chmod 700 /home/nisuser/

Ø Copy files into nisuser directory and also change its owner.

· cp /etc/skel/.* /home/nisuser/

· chown –R nisuser:nisuser /home/nisuser/ (Here 1st nisuser is user name, 2^nd nisuser is group name and 3^rd nisuser is directory name).

Ø Restart the ypbind service and also write ypmatch statement.

· srvice ypbind restart

· ypmatch nisuser passwd

Ø Restart and permanent on all services.

· srvice ypbind restart

· service portmap restart

· service ypxfrd restart

· service sshd restart

· chkconfig ypbind on

· chkconfig portmap on

· chkconfig ypxfrd on

· chkconfig sshd on

Ø Write this command to check the “etho” in the firewall settings.

· system-config- securitylevel

NFS Server Configuration

NFS stands for “Network File System”. It is use for sharing of files on network. For sharing of files we have Linux on both sides.

Server Side

Ø First of all open the “exports” file and give shares line by line. One share in one line.

· vi /etc/exports

· /mnt/share *(ro or rw,async,no_ root_squash or root_squash)

· Press Esc then write :wq.

· exportfs -ra

Here * shows all IP Address

“ro” means read only and “rw” means read write.

Ø Make Directory and also change its permissions.

· mkdir /mnt/share

· cd /mnt/share

· mkdir a b c

· cd ..

· chmod –R 1777 share/

Ø Restart and permanent on the service.

· service nfs restart

· chkconfig nfs on

Client Side

Ø Restart and permanent on the service.

· service nfs restart

· chkconfig nfs on

Ø Make Directory

· mkdir /mnt/myshare

Ø Mount and Umount the share directory.

· mount 192.168.0.2: /mnt/share /mnt/myshare

· umount 192.168.0.2: /mnt/mysahre

Here 192.168.0.2 it’s a server ip address.

/mnt/share it’s a source.

/mnt/myshare it’s a destination.

Ø Restart and permanent on the service.

· service nfs restart

· chkconfig nfs on

SQUID Server Configuration

It’s a caching server that is use to provide the internet facility of clients.

Server Side

Ø For SQUID server SAMBA server should be configured. And check the SQUID package.

· rpm –qa |grep squid

Ø After install the SQUID package then apply this command for creating the subdirectories for the caching purpose.

· squid –Z

Ø Now open the squid config file in vi editor.

· vi /etc/squid/squid. conf

Ø Now changes in file.

· acl clients src=192.168.0.0/ 24 (Here we declare a variable with the name clients and we store IP range in it).

· http-access allow clients

· http-access deny all

Client Side

Click on Internet ExplorerèToolsèInternet OptionsèConnectionsèLAN Settings

In proxy server give IP Address of server in Address Field and in Port field give port number is “3128”. It’s a by default port number we can’t change it. And restart the computer.

Apache Server Configuration

It is a web server.

Web Hosting

The World Wide Web is a massive collection of web sites, all hosted on computers (called web servers) all over the world. The web server (computer) where your web site's html files, graphics, etc. reside is known as the web host. Web hosting clients simply upload their web sites to a shared (or dedicated) webserver, which the ISP maintains to ensure a constant, fast connection to the Internet.

Ø First of all open the configuration file of apache.

· vi /etc/httpd/conf/ httpd.conf

Ø Simply we make some changes in it

· Search the word “UserDir disable” and remark it by # sign. By default it is unmark.

· Search the word “UserDir public_html” and unmark it by removing the # sign. By default it is mark.

· We can write “MyWeb” at the place of “public_html” because it’s a optional.

· In a “directory” tag we write “/home/*/MyWeb “.

· Save the file.

Ø Now create a new user and change its permissions.

· useradd apache1.

· chmod 711 /home/apache1

Ø Make a Directory and also change its permissions.

· mkdir /home/apache1/ MyWeb

· chmod 755 /home/apache1/ MyWeb/

Ø Restart the service.

· service httpd restart

Ø Simply make a HTML or PHP file and save it into /home/apache1/ MyWeb path.

Ø To Access the file write on the browser.

· http://localhost/ ~apache1/ filename of html

Password Protected Folders

It means when we want to access the files through browser then is asked for user authentication.

Ø Make a Directory.

· mkdir /var/www/html/ web

Ø Open the configuration file of apache.

· vi /etc/httpd/conf/ httpd.conf

Ø Simply we add some lines in it

· Make a directory.

· (Here /var/www/html its document root we must write it)

· AuthType basic

· AuthName “Please Login to Access the Files”

· AuthUserFile /home/apache1/ .mypasswd

· Require valid-user

·

· Save the file

Ø Now we add user in “.mypasswd” file for this we write some commands on shell.

· htpasswd –c /home/apache1/ .mypasswd apacheuser1 (Only first time we write –c by adding user next time we don’t write –c. “apacheuaer1” it’s a user name that we want to add in a file.)

· give password of apacheuser

· htpasswd /home/apache1/ .mypasswd apacheuser2

Ø Now restart the service.

· service httpd restart

Ø For removing user we manually remove it from file.

Ø To view the .mypasswd file write “vi /home/apache1/ .mypasswd” .

Ø .mypasswd file users and their encrypted passwords are in it.

FTP SERVER Configuration

Server Side

Ø How To Get VSFTPD Started

You can start, stop, or restart VSFTPD after booting by using these commands:

[root@bigboy tmp]# service vsftpd start

[root@bigboy tmp]# service vsftpd stop

[root@bigboy tmp]# service vsftpd restart

To configure VSFTPD to start at boot you can use the chkconfig command.

[root@bigboy tmp]# chkconfig vsftpd on

Ø Testing the Status of VSFTPD
You can always test whether the VSFTPD process is running by using the netstat -a command which lists all the TCP and UDP ports on which the server is listening for traffic. This example shows the expected output.

[root@bigboy root]# netstat -a | grep ftp

tcp        0        0        *:ftp         *:*        LISTEN

[root@bigboy root]#

If VSFTPD wasn't running, there would be no output at all. 

Ø Now open the FTP configuration file. Simply read it.

· vi /etc/vsftpd/ vsftpd.conf

Ø The /etc/vsftpd. ftpusers File

For added security, you may restrict FTP access to certain users by adding them to the list of users in the /etc/vsftpd. ftpusers file. The VSFTPD package creates this file with a number of entries for privileged users that normally shouldn't have FTP access. As FTP doesn't encrypt passwords, thereby increasing the risk of data or passwords being compromised, it is a good idea to let these entries remain and add new entries for additional security.

Ø Anonymous Upload

If you want remote users to write data to your FTP server, then you should create a write-only directory within /var/ftp/pub. This will allow your users to upload but not access other files uploaded by other users. The commands you need are:

[root@bigboy tmp]# mkdir /var/ftp/pub/ upload

[root@bigboy tmp]# chmod 722 /var/ftp/pub/ upload

Ø FTP Greeting Banner

Change the default greeting banner in the vsftpd.conf file to make it harder for malicious users to determine the type of system you have. The directive in this file is.

ftpd_banner= Welcome to the Saints FTP Server

Ø FTP Users with Only Read Access to a Shared Directory

In this example, anonymous FTP is not desired, but a group of trusted users need to have read only access to a directory for downloading files. Here are the steps:

1) Disable anonymous FTP. Comment out the anonymous_enable line in the vsftpd.conf file like this:

# Allow anonymous FTP?

anonymous_enable= NO

2) Enable individual logins by making sure you have the local_enable line uncommented in the vsftpd.conf file like this:

# Uncomment this to allow local users to log in.

local_enable= YES

3) Start VSFTP.

[root@bigboy tmp]# service vsftpd start

4) Create a user group and shared directory. In this case, use /home/ftp-users and a user group name of ftp-users for the remote users

[root@bigboy tmp]# groupadd ftp-users

[root@bigboy tmp]# mkdir /home/ftp-docs

5) Make the directory accessible to the ftp-users group.

[root@bigboy tmp]# chmod 750 /home/ftp-docs

[root@bigboy tmp]# chown root:ftp-users /home/ftp-docs

6) Add users, and make their default directory /home/ftp-docs

[root@bigboy tmp]# useradd -g ftp-users -d /home/ftp-docs ftpuser1

[root@bigboy tmp]# useradd -g ftp-users -d /home/ftp-docs ftpuser2

[root@bigboy tmp]# passwd ftpuser1

[root@bigboy tmp]# passwd ftpuser2

7) Copy files which u want to share b/w users into the /home/ftp-docs directory

8) Change the permissions of the files in the /home/ftp-docs directory for read only access by the group

[root@bigboy tmp]# chown root:ftp-users /home/ftp-docs/ *

[root@bigboy tmp]# chmod 740 /home/ftp-docs/ *

Users should now be able to log in via FTP to the server using their new usernames and passwords. If you absolutely don't want any FTP users to be able to write to any directory, then you should set the write_enable line in your vsftpd.conf file to no:

write_enable = NO

Remember, you must restart VSFTPD for the configuration file changes to take effect.

Client Side

Ø Here is a simple test procedure you can use to make sure everything is working correctly:

1) Connect to ftpuser1 via FTP 

[root@smallfry tmp]# ftp 192.168.1.100 (Here 192.168.1.100 is a server IP address)

Connected to 192.168.1.100 (192.168.1.100)

220 ready, dude (vsFTPd 1.1.0: beat me, break me)

Name (192.168.1.100: root): user1

331 Please specify the password.

Password:

230 Login successful. Have fun.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

As expected, we can't do an upload transfer of testfile to ftpuser1

ftp> put testfile

local: testfile remote: testfile

227 Entering Passive Mode (192,168,1,100, 181,210)

553 Could not create file.

ftp>

But we can view and download a copy of the VSFTPD RPM located on the FTP server ftpuser1

ftp> ls

227 Entering Passive Mode (192,168,1,100, 35,173)

150 Here comes the directory listing.

-rwxr----- 1 0 502 76288 Jan 04 17:06 vsftpd-1.1.0- 1.i386.rpm

226 Directory send OK.

ftp> get file name file name (e.g. index.html index.html.tmp)

local: index.html.tmp remote: index.html

227 Entering Passive Mode (192,168,1,100, 44,156)

150 Opening BINARY mode data connection for index.html (76288 bytes).

226 File send OK.

76288 bytes received in 0.499 secs (1.5e+02 Kbytes/sec)

ftp> exit

221 Goodbye.

[root@smallfry tmp]#

As expected, anonymous FTP fails.

[root@smallfry tmp]# ftp 192.168.1.100

Connected to 192.168.1.100 (192.168.1.100)

220 ready, dude (vsFTPd 1.1.0: beat me, break me)

Name (192.168.1.100: root): anonymous

331 Please specify the password.

Password:

530 Login incorrect.

Login failed.

ftp> quit

Ø      File is save on root’s path.

Change Root’s Password without knowing the root password

Ø When grub boot select REDHAT LINUX and press ‘p’.

Ø Then enter the grub password.

Ø Now select require line and press ‘e’.

Ø At the end of the line press space and write ‘1’.

Ø Then press ‘b’.

Ø Now system boot and single mode display.

Ø Write passwd root

Ø Enter new password.

Ø Write Init 6. (It means restart computer).

Rebuild RPMS Database

Ø When our RPMS are damage then we rebuild these.

· rpm --rebuilddb -vvv

Check User Group

Ø When we want to know the user groups then write this command.

· groups username

SEND MAIL (LINUX ENTERPRISE MAIL SERVER) Contribution by ALI

SEND MAIL (LINUX ENTERPRISE MAIL SERVER)

Mail Server:
MTA (Mail Transfer Agent). It has some certain duties to do.

i) Send mail on behalf of a designated domain.
ii) Receive mails by verifying proper account database.
iii) Relay/Allow all mails of trusted/authorized source.
iv) Discard/Block irrelevant emails and across.
v) Any MTA using two protocols SMTP (simple mail transfer protocol) for sending emails and POP (post office protocol) receiving emails. For receiving emails IMAP is also getting used.

Note:

1) In case of pop3 once the email has been fetched it will be flushed out from server
2) In case of IMAP one copy will always be on server and not removed but for this purpose we need heavy storage on server.

Linux/Unix Email Server:

There are several email servers used in Linux/Unix families. Some of those are

i) Sendmail (Freeware) http://sendmail. org
ii) Qmail (Freeware) http://lifewithqmai l.org
iii) Postfix

Sendmail Configuration:

Following packages must be installed

Packages: sendmail sendmail-cf
Configuration File: /etc/mail/sendmail.cf
/etc/mail/sendmail.mc
Other Config Files: /etc/mail/local- host-names
/etc/mail/access
/etc/aliases
/var/spool/mail
/var/spool/mqueue

Following services takes part in this process so should be up

Services: sendmail

Download and install required packages and lets move for further configuration.

Configuration:
In configuration file find the following parameters and change those to your own ones.

# vi /etc/mail/sendmail.mc

Find the following line in this file and comment it out. For commenting out any line in sendmail.mc put “dnl” in start of that.

# dnl # DAEMON_OPTIONS( `Port=smtp, Addr=127. 0.0.1, Name=MTA')dnl

Now save and exit

# :wq!

To update this change in configuration file we use m4 utility.

# m4 /etc/mail/sendmail.mc /etc/mail/sendmail.cf

Now edit local-host-names file and put your default domain name for which you setting up sendmail to receive emails.

# vi /etc/mail/loca- host-names

Put your domain address there then save and exit
Now edit your access file to relay trusted domains and your networks.

# vi /etc/mail/access

Here is just an example of this file

redhat.com RELAY (for relaying a domain)
192.168.0 RELAY (for relaying a network)
10.0.0 REJECT (for rejecting a network)
yahoo.com REJECT (for rejecting a domain emails)

Ok now check your dns server that its pointing mx records towards this email server.

Installing POP3 Service:

Package imap-2001a

After installing this package enable IPOP3 service in xinetd. It’s a xinetd service after installing go to the xinetd folder located in /etc/exinet. d and edit ipop3 file change the parameter from

disable=yes to disable=no

Now start sendmail service and you are ready to go.

# service sendmail start

Test Mail:

Send a test mail to verify.

# mail recipient address –v
Subject: now press ctrl+d
Enter text here now press ctrl+d twice and your email is gone

Note:
You should be taking care of following things.

i) your hostname should be same as per you entered in local-host-names file
ii) your dns mx records should be point towards your newly configured mail server
iii) change hostnames in following files as per you entered in local-host-names

# /etc/sysconfig/ network
#/etc/hosts

Enlish New Movie 2012

2012 2009 Hollywood Movie Watch Online : DivXDen Link :

2012 2009 Hollywood Movie Watch Online


2012 2009 Hollywood Movie Watch Online : Zshare Link :

2012 2009 Hollywood Movie Watch Online


2012 2009 Hollywood Movie Watch Online : Stagevu Link :


2012 2009 Hollywood Movie Watch Online

2012 2009 Hollywood Movie Watch Online : WiseVid Link :

2012 2009 Hollywood Movie Watch Online

Configuring DHCP on a Cisco Router

When would you need this: When using the router as a DHCP server to provide IP addresses and related information to DHCP clients.

Specials Requirements: DHCP server software is supported for these series; 800, 1000, 1400, 1600, 1700 series (support for the Cisco 1700 series was added in Cisco IOS Release 12.0[2]T), 2500, 2600, 3600, 3800, MC3810, 4000, AS5100, AS5200, AS5300, 7000, 7100, 7200, MGX 8800 with an installed Route Processor Module, 12000, uBR900, uBR7200, Catalyst 5000 family switches with an installed Route Switch Module, Catalyst 6000 family switches with an installed MultiLayer Switch Feature Card, and Catalyst 8500.

STEPS:

1. Define the DHCP address pool,

Router(config) #ip dhcp pool POOLNAME

Router(dhcp- config)#network XXX.XXX.XXX. XXX YYY.YYY.YYY. YYY

where,

XXX.XXX.XXX. XXX is the network address to be used by the DHCP pool

YYY.YYY.YYY. YYY is the subnet mask for the network.

You can replace the subnet mask by a (/PREFIX) to provide the subnet mask.

2. Configure the parameters to be sent to the client,

Router(dhcp- config)#dns-server XXX.XXX.XXX. XXX

To provide the DNS server IP address

Router(dhcp- config)#default-router XXX.XXX.XXX. XXX

To provide the IP address of the default gateway

Router(dhcp- config)#domain-name NAME

To provide the name of the domain of the network (if in a domain environment)

Router(dhcp- config)#netbios-name- server XXX.XXX.XXX. XXX

To provide the IP address of the NetBIOS name server

Router(dhcp- config)#lease DAYS HOURS MINUTES

To define the lease time of the addresses given to the client. You can make it infinite by using this command instead; lease infinite

There is a large group of settings that you can configure to be sent to the clients, and I have only mentioned the most frequently used.

3. Configure the IP addresses to be excluded from the pool. This is usually done to avoid the conflicts caused by the DHCP with servers and printers. Remember to give ALL servers and network printers static IP addresses in the same range of the DHCP pool. And then exclude these addresses from the pool to avoid conflicts.

Router(config) #ip dhcp excluded-address XXX.XXX.XXX. XXX

Use the command in the previous form to excluded a single address. You can repeat it as much as you see fit for the IP addresses you want to exclude. Or,

Router(config) #ip dhcp excluded-address YYY.YYY.YYY. YYY ZZZ.ZZZ.ZZZ. ZZZ

where,

YYY.YYY.YYY. YYY is the start of the range to be excluded from the pool

ZZZ.ZZZ.ZZZ. ZZZ is the end of the range

This way you can exclude a range or ranges of IP addresses and reserve them for static addresses use.

4. Enable the DHCP service in the router

Router(config) #service dhcp

To disable it use

Router(config) #no service dhcp

Usually the DHCP service is enabled by default on your router.

5. Use the following commands to check the DHCP operation on the router:

Router#show ip dhcp binding

This command shows the current bindings of addresses given to clients

Router#show ip dhcp server statistics

This command show the DHCP server statistics.

Router#debug ip dhcp server

This debug command is used to troubleshoot DHCP issues.

Implementation notes:

1. If you have a DHCP server other than the router, and you would like to let the router to forward the DHCP requests from a certain LAN to the DHCP server laying outside that LAN, go to the Ethernet interface that does not have the DHCP server and type the following command:

Router(config- if)#ip helper-address XXX.XXX.XXX. XXX

where XXX.XXX.XXX. XXX is the IP address of the server laying outside this LAN.

2. You can create a DHCP database agent that stores the DHCP binding database. A DHCP database agent is any host, for example, an FTP, TFTP, or RCP server that stores the DHCP bindings database. You can configure multiple DHCP database agents and you can configure the interval between database updates and transfers for each agent. To configure a database agent and database agent parameters, use the following command in global configuration mode:

Router(config) #ip dhcp database url [timeout seconds | write-delay seconds]

An example url is this

ftp://user:password @ 192.168.0.3/ router-dhcp (remove the spaces before implementing)

If you choose not to configure a DHCP database agent, disable the recording of DHCP address conflicts on the DHCP server. To disable DHCP address conflict logging, use the following command in global configuration mode:

Router(config) #no ip dhcp conflict logging

3. DHCP service uses port 67 and 68. So, if you are using a firewall, remember to open these ports.

4. To clear DHCP server variables, use the following commands as needed:

Router#clear ip dhcp binding *

If you want to clear a certain binding not all of them, replace the * in the previous command with the IP address to be cleared.

Router#clear ip dhcp server statistics

Migration of DC from Windows Server 2000 to Windows Server 2003

Scenario

A Windows 2000 server domain controller running on old hardware has to be replaced with a new hardware running Windows 2003 Server as the Domain Controller. This tutorial will explain how to migrate win server 2000 to win server 2003 includes Domain Controller, DNS, DHCP, File server, Rename new win server 2003 same as your old win server 2000.

In this tutorial we are assuming that you are using same domain name as on your new win server 2003

Make sure to have the latest backup of the existing server.

1. Make Sure SP4 on the existing Windows 2000 domain controller

2. Run ADPREP to prepare the forest and domain for windows 2003

• Put the Windows 2003 Server installation CD, into the CD drive of the windows 2000 server.

• Go to Start -> Run and type cmd and click on OK button.

• At the command prompt type x:\i386\adprep /forestprep where x is the drive letter of the CD drive. Make sure the command exits with a success message. Reboot is not necessary.

• From the command prompt type x:\i386\adprep /domainprep where x is the drive letter of the CD drive on the server. Make sure the command exits with a success message. Reboot is not necessary.

Note: In case of any errors, you may look at the log files residing under %systemroot% \system32\ debug\adprep\ log\ folder.

Important Note :- If you want to upgrade win server 2000 to win server 2003 R2 insert the Windows Server 2003 R2 installation disk 2 to run the forestprep and domainprep otherwise you see the following error

The Active Directory Installation Wizard cannot continue because the forest is not prepared for installing Windows Server 2003. Use the Adprep command-line tool to prepare both the forest and the domain. For more information about using the Adprep, see Active Directory Help.

The version of the Active Directory schema of the source forest is not compatible with the version of Active Directory on this computer.

3. On the new server hardware, install Windows 2003 Server and join it to the existing domain (i.e win 2000 domain). Also, install the DNS server (need not configure). Make sure you also install all the available service packs.

Install DNS Server on win 2003 Server

Open Windows Components Wizard from the following

Click Start, click Control Panel, and then click Add or Remove Programs.

Click Add/Remove Windows Components.

In Components, select the Networking Services check box, and then click Details.

InSubcomponents of Networking Services, select the Domain Name System (DNS) check box, click OK, and then click Next.

If Windows asks for a CD-ROM, do as it requests. When it is done, click Finish and you'll have your very own DNS server.

4. On win 2003 server Run DC Promo and make this server as the additional domain controller to the existing domain:

• Go to Start -> Run and type dcpromo and click on OK button.

• On the Active Directory Installation Wizard screen, follow the wizard and make this server as an additional domain controller for the existing domain.

• Reboot the Server.

5. Wait for replication to happen. This may take around 30 minutes or longer, depending on the amount of data that has to be replicated from the SYSVOL folder of Win2000 server. You can use REPLMON.EXE, to monitor the replication status, which is available from the support tools package in your win 2003 server CD, or you can even check the event log on the Win server 2003 for the file replication service (FRS) status.

6. Check the DNS on the new Win server 2003.

• Check if all the details have been replicated

• Check if the forwarders are setup correctly

• Check if the event log is clear of errors

Transfer FSMO roles and GC from win server 2000 to win server 2003

a) Transfer the FSMO Roles to the new Server.

There are 5 FSMO roles: Domain naming Master, Schema Master, RID Master, PDC Emulator and Infrastructure Master. There must be a domain controller that owns each one of those roles. These roles can be transferred to another Domain Controller either by using the MMC GUI tool or by using the ntdsutil.exe command line utility. Here are the steps to transfer FSMO roles by using the MMC tool:

Transferring RID, PDC, and Infrastructure Master roles:

• Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
• Right-click the icon next to Active Directory Users and Computers, and then click Connect to Domain Controller.

Note: If you are not on the domain controller where you want to transfer the role, you need to take this step. It is not necessary if you are connected to the domain controller whose role you want to transfer.

• Click the domain controller, which will be the new role holder, and then click OK.

• Right-click Active Directory Users and Computers icon and then click Operation Masters.

• In the Change Operations Master dialog box, click the appropriate tab (RID, PDC, or Infrastructure) for the role you want to transfer. You need to transfer all the 3 roles.

• Click Change in the Change Operations Master dialog box.

• Click OK to confirm that you want to transfer the role.

• Click OK.

• Click Cancel to close the dialog box.

Transferring the Domain Naming Master role:

• Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Domains and Trusts.

• Right-click the Active Directory Domains and Trusts icon, and then click Connect to Domain Controller.

Note: If you are not on the domain controller where you want to transfer the role, you need to take this step. It is not necessary if you are connected to the domain controller whose role you want to transfer.

• Click the domain controller that will be the new role holder, and then click OK.

• Right-click Active Directory Domains and Trusts, and then click Operation Masters.

• In the Change Operations Master dialog box: click Change.

• Click OK to confirm that you want to transfer the role.

• Click OK.

• Click Cancel to close the dialog box.

Transferring the Schema Master Role:

You can use the Schema Master tool to transfer the role. However, the Schmmgmt.dll dynamic-link library must be registered in order to make the Schema tool available as an MMC snap-in.

Registering the Schema Tool:

• Click Start, and then click Run.

• Type regsvr32 schmmgmt.dll, and then click OK. A message should be displayed stating that the registration was successful.

Transferring the Schema Master Role:

• Click Start, click run, type mmc, and then click OK.

• On the Console menu click Add/Remove Snap-in.

• Click Add.

• Click Active Directory Schema.

• Click Add.

• Click Close to close the Add Standalone Snap-in dialog box.

• Click OK to add the snap-in to the console.

• Right-click the Active Directory Schema icon, and then click Change Domain Controller.

Note: If you are not on the domain controller where you want to transfer the role, you need to take this step. It is not necessary if you are connected to the domain controller whose role you want to transfer.

• Click Specify Domain Controller, type the name of the domain controller that will be the new role holder, and then click OK.

• Right-click Active Directory Schema and then click Operation Masters.

• In the Change Schema Master dialog box: click Change.

• Click OK.

• Click OK.

• Click Cancel to close the dialog box.

Transfer the Global Catalogue role:

• Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services.

• Under sites, expand your site name, then Servers and then your server name so that you can see NTDS Settings. Now right click on the NTDS Settings under the server that you want to demote (Win2K) and choose properties, in the window that appears, un-check Global Catalog and click OK.

• Now right click on the NTDS Settings under the server that you want to promote (Win2K3) and choose properties, in the window that appears, check Global Catalog and click OK.

• After making these changes wait about fifteen minutes till the Global Catalog replicates between domain controllers, after it you can continue with further configurations.

Transfer files/permissions over win server 2003

If you are using this server as file server you need to copy all your data in to the new win server 2003 with the following procedure

For this purpose you can use FSMT tool on Win2K3 server (FSMT cannot be run on Win2K), which can be downloaded from the Microsoft Website. Using FSMT all the shared files and folders can be transferred from the old Win2K server to the new Win2K3 server without losing the permissions on the shared folders.

If you want complete detailed Instructions how to use FSMT Check here

Take backup of win 2000 DHCP Server database.

• Run DHCPEXIM.EXE utility from MS Resource Kit (download from here)and export the required DHCP Scope(s) and configurations to a text file and copy this file on to the new win server 2003.

• Now, you can either disconnect the network cable or shutdown the win server 2000 completely. This server will again be used in the event of this migration failure.

Authorize DHCP Server on win server 2003

• Click Start, point to All Programs, point to Administrative Tools, and then click DHCP

Note:- You must be logged on to the server by using an account that is a member of the Administrators group. In an Active Directory domain, you must be logged on to the server by using an account that is a member of the Enterprise Administrators group.

• In the console tree of the DHCP snap-in, expand the new DHCP server. If there is a red arrow in the lower-right corner of the server object, the server has not yet been authorized.

• Right-click the server object, and then click Authorize.

After several moments, right-click the server again, and then click Refresh. A green arrow indicates that the DHCP server is authorized.

Running domain controller (on win server 2003) diagnostics tools

From the command prompt, run DCDIAGS and make sure the command is completed successfully, without displaying any errors.If you want DCdiag GUI tool check here

Run adcheck (freeware tool from netiq) run through all the checks and make sure that the domain is healthy. Fix errors if any.You can download from here

Disconnect the old server (win server 2000)

• Go to Start -> Run and type dcpromo and click on OK button.

• On the Active Directory Installation Wizard screen, follow the wizard and demote it from the domain controller to a standalone server.

• Reboot the Server.

• Change the server membership to a Workgroup.

• Reboot the Server.

• Shutdown and disconnect the server from the network.

Raise the domain level functionality to native Windows 2003 in win server 2003.

For this follow this procedure

• Log on the win server 2003 of the domain with domain administrator credentials.

• Click Start, point to Administrative Tools, and then click Active Directory Domains and Trust.

• In the console tree, right-click the domain for which you want to raise functionality, and then click Raise Domain Functional Level.

• Under Select an available domain functional level, do the following

• Click Windows Server 2003, and then click Raise to raise the domain functional level to Windows Server 2003.

Note:- You can also raise the domain functional level by right-clicking a domain that appears in the Active Directory Users and Computers MMC snap-in, and then clicking Raise Domain Functional Level. To raise the domain functional level, you must be a member of the Domain Administrators group.

The current domain functional level appears under Current domain functional level in the Raise Domain Functional Level dialog box. The level increase is performed on the PDC FSMO and requires the domain administrator

Test with a client that you can logon, check the event log for any errors.

Changing the new DC's (Win2K3) IP Address and Hostname to the same Hostname and IP Address as the old DC (Win2K)

• Make sure the Old Domain Controller (Win2K) is disconnected from the network.

• Make sure all the references of the old (Win2K) server name does not exist anymore In Active directory (Sites, Domain Controllers Container and DNS).

• Make sure the domain functional level is raised to Windows 2003 native mode.

• Change the IP Address of the new domain controller (Win2K3)

• Change the Domain Controller hostname using Netdom tool.

Netdom tool comes with the support tools package, which is available on the Server installation CD, under \support\tools folder.

• Install support tools and go to Command Prompt.

• Type the following command to add the new domain controller name, and then press ENTER:

netdom computername CurrentComputerName /add:NewComputerNam e

Note: The NewComputerName must be a fully qualified domain name (FQDN). Currentcomputername can be the existing FQDN or the IP Address of the computer.

c) Type the following command to designate the new name as the primary computer name, and then press ENTER:

netdom computername CurrentComputerName /makeprimary: NewComputerName

d) Restart the computer.

e) After the computer restarts, go to Command Prompt.

f) Type the following command to remove the old domain controller name, and then press ENTER:

netdom computername NewComputerName /remove:OldComputer Name

Finally if you are using any logon scripts using kix program,Network Printers you need to make sure everything is working fine

10 MOST COMMON "SHOW" COMMANDS FOR CISCO ROUTERS

Some commands in the Cisco router configuration are just irreplaceable. The `show' commands are the most widely used in Cisco routers. Here is a list of the 10 mostly used of these `show' commands.

1. show running-config

This command is your true best friend. It shows the complete configuration that is running currently. Using it you can troubleshoot almost all issues regarding routing, filtering, secure access, and many other issues. Using it before you start configuring the router would give you a clear idea of what services and protocols are operating by default and which are turned off by default.

2. show startup-config

This command shows the configuration that is saved on the NVRAM. It is helpful in knowing the configuration that will be applied the next time the routers is reloaded. And also this command is useful in knowing the configuration that was loaded at the start-up of the router before making changes to it.

3. show interface

This command shows status and statistics regarding interfaces. This command is almost always needed in troubleshooting routing and link issues. Things that are shown using this command include, interface IP address and subnet mask, interface status, encapsulation type, bandwidth, and many other important indicator about the interface operation.

4. show ip route

This command shows the routing table. This table helps you in finding out the next hop for each and every routable packet. It is the first indicator to point a problem in routing.

5. show ip protocols

This command shows the routing protocols used in the router and what networks are these protocols advertising. It also shows the sources of routing updates received at this router. It is very useful in routing issues troubleshooting.

6. show access-list

This command shows the contents of each access-list. It is very useful in troubleshooting filtering issues. Note that this command does not show you where each access-list is applied.

7. show ip interface

This command displays information about IP protocol and the interface. You might be wondering why would you need this command. I will answer that. This command shows which access-lists are applied at the interfaces and in which direction. This kind of information is not shown by the `show access-list' command. However, you can find out which access-list is applied where using `show run'.

8. show cdp neighbor detail

This command displays detailed information about the neighboring devices like IP addresses, platforms, and host names. This command can be useful in troubleshooting connectivity issues, and also can be used in finding out how devices are connected to each other when you have no clear drawn network map.

9. show version

This command shows detailed information about the IOS. It shows the file name of the IOS along with the version of the IOS and value of the configuration register. The configuration register is a set of bits that controls the boot sequence of the router. This command is the only command used to show this register's value.

10. show flash or show slot0:

This command is used to view the contents of the flash and the size of the IOS file(s) and the size of the flash and how much of it is free. It is necessary in upgrading or installing the IOS file.

How to Configure Site-to-Site VPN in Cisco Routers

How to Configure Site-to-Site VPN in Cisco Routers

When would you need this: When you want to create a secure tunnel to transfer data between two sites without the use of VPN concentrator or other security devices.

Special Requirements: The routers used must support IPSec. Most of Cisco routers do. Another need is that both sides use a static public IP address to connect to the Internet.

We will go through the steps to be done on one side and the same steps must be repeated on the other side too. The encryption of data will depend on a shared-key. This way, we will not need specialized CAs or RSA methodologies.

1. Create Internet Key Exchange (IKE) key policy. The policy used for our case is policy number 9, because this policy requires a pre-shared key.

Router(config) #crypto isakmp policy 9

Router(config- isakmp)#hash md5

Router(config- isakmp)#authentication pre-share

2. Setup the shared key that would be used in the VPN,

Router(config) #crypto isakmp key VPNKEY address XXX.XXX.XXX. XXX

where,

VPNKEY is the shared key that you will use for the VPN, and remember to set the same key on the other end.

XXX.XXX.XXX. XXX the static public IP address of the other end.

3. Now we set lifetime for the IPSec security associations,

Router(config) #crypto ipsec security-associatio n lifetime seconds YYYYY

where YYYYY is the associations lifetime in seconds. It is usually used as 86400, which is one day.

4. Configure an extended access-list to define the traffic that is allowed to be directed through the VPN link,

Router(config) #access-list AAA permit ip SSS.SSS.SSS. SSS WIL.DCA.RDM. ASK DDD.DDD.DDD. DDD WIL.DCA.RDM. ASK

where,

AAA is the access-list number

SSS.SSS.SSS. SSS WIL.DCA.RDM. ASK is the source of the data allowed to use the VPN link.

DDD.DDD.DDD. DDD WIL.DCA.RDM. ASK is the destination of the data that need to pass though the VPN link.

5. Define the transformations set that will be used for this VPN connection,

Router(config) #crypto ipsec transform-set SETNAME BBBB CCCCC

where,

"SETNAME" is the name of the transformations set. You can choose any name you like.

BBBB and CCCCC is the transformation set. I recommend the use of "esp-3des esp-md5-hmac". You can also use "esp-3des esp-sha-hmac". Any one of these two will do the job.

6. After defining all the previous things, we need to create a cypto-map that associates the access-list to the other site and the transform set.

Router(config) #crypto map MAPNAME PRIORITY ipsec-isakmp

Router(config- crypto-map) #set peer XXX.XXX.XXX. XXX

Router(config- crypto-map) #set transform-set SETNAME

Router(config- crypto-map) #match address AAA

where,

MAPNAME is a name of your choice to the crypto-map

PRIORITY is the priority of this map over other maps to the same destination. If this is your only crypto-map give it any number, for example 10.

XXX.XXX.XXX. XXX the static public IP address of the other end

SETNAME is the name of the transformations set that we configured in step 5

AAA is the number of the access-list that we created to define the traffic in step 4

7. The last step is to bind the crypto-map to the interface that connects the router to the other end.

Router(config- if)#crypto map MAPNAME

where MAPNAME is the name of the crypto-map that we defined in step 6.

Now, repeat these steps on the other end, and remember to use the same key along with the same authentication and transform set.

Note: If you want to implement multiple VPN connections to multiple sites, you can do this by repeating the steps 2 to 7 (except step 3) for each VPN connection. The different crypto-maps and their assignments differentiate between the different VPN connections.

For troubleshooting purposes, you can use the following commands,

show crypto isakmp sa

show crypto ipsec sa

show crypto engine connections active

and show crypto map