Apoyar Wiki - User contributions [en-gb]

Connecting RDP servers, if license expired and extending grace period via regedit

2026-05-26T11:22:25Z

Admin:

Extension of RDP Server License Using regedit:

1. First, we need to connect to RDP server via V sphere/Hyper-V.

2. Mstsc.exe /admin Switch (This will allow rdp connection as the client recognizes it and allows connection without asking for License)

3. Once connected RUN > regedit

4. Follow this path “Computer/Hkey Local machine/system/current control set/control/terminal server/RCM/grace period”.

5. Delete the entry (key) below default one ,in the Right pane (If its not allowing to delete the key, right click on grace period folder, go to permissions/advanced and get the owner permission there) Shows there owner: network service [ CHANGE ] --> ok

6. At last, reboot the VM

7. This will enable the License for 120 days.

Note: This extension procedure is possible only for windows 2016 and above servers.

LetsEncrypt SSL for Bleckmann Custom URL - Updated

2026-02-06T12:46:36Z

Admin: Created page with "Enable the custom_initiate_certbot.conf file in sites-available on BOTH fe servers, make sure to replace the server_name (and server_root if needed): DONE cd /etc/nginx/sites-enabled ln -s ../sites-available/custom_initiate_certbot.conf ./custom_initiate_certbot.conf -- DONE vi ./custom_initiate_certbot.conf Then check: nginx -t If ok, reload: systemctl reload nginx --> DONE Do your certbot command: certbot certonly --webroot -w /var/www/halivephp84/bleckmannci..."

Enable the custom_initiate_certbot.conf file in sites-available on BOTH fe servers, make sure to replace the server_name (and server_root if needed): DONE

cd /etc/nginx/sites-enabled

ln -s ../sites-available/custom_initiate_certbot.conf ./custom_initiate_certbot.conf -- DONE

vi ./custom_initiate_certbot.conf

Then check: nginx -t

If ok, reload: systemctl reload nginx --> DONE

Do your certbot command: certbot certonly --webroot -w /var/www/halivephp84/bleckmannci4/ -d returns.killstar.com

Make sure to provide correct root and domain (same ones as in the nginx configuration file)

If certificate is granted, disable the temp config again:

rm /etc/nginx/sites-enabled/custom_initiate_certbot.conf -- DONE on both servers

Prepare final configuration file from template:

cp -pv /etc/nginx/sites-available/custom_template.conf /etc/nginx/sites-available/custom_<DOMAIN NAME HERE>.conf

Replace the domain names in the config file:

sed -i 's|REPLACEME|<DOMAIN NAME HERE>|g' /etc/nginx/sites-available/custom_<DOMAIN NAME HERE>.conf

Enable the config:

cd /etc/nginx/sites-enabled

ln -s ../sites-available/custom_<DOMAIN NAME HERE>.conf ./custom_<DOMAIN NAME HERE>.conf

Then check: nginx -t

If ok, reload: systemctl reload nginx

Note: replace <DOMAIN_NAME_HERE> in the previous commands by, for example, returns.killstar.com

Main Page

2026-02-06T12:45:49Z

Admin:

Apoyar Wiki main page.

* [[Infrastructure|Apoyar Infrastructure]]
* [[Complete step-by-step guides]]
* [[Developer guides]]
* [[Tips & Tricks]]
* [[Miscellaneous Information]]
* [[Installing Updates on Hyper V servers]]
* [[Connecting RDP servers, if license expired and extending grace period via regedit]]
* [[Website Hosting & SSL certificate installation]]
* [[Email Configuration and Issues (Windows)]]
* [[Providing SSL Certificates to Web Sites ]]
* [[Generating a LetsEncrypt certificate - both Linux and Windows]]
* [[Low Free Disk Space Issues (Windows, Linux, UNIX) & Resolution]]
* [[Zeb Live DB Restore Task]]
* [[Creating an SFTP user for www server]]
* [[Adding hosts and services to Nagios - Windows hosts]]
* [[Adding hosts and services to Nagios - Linux/BSD hosts]]
* [[Adding hosts and services to Nagios - Redhat hosts]]
* [[Upgrading from Windows 2008 R2 to 2016 - migrating MS SQL]]
* [[Upgrading major versions of Nginx,Mysql]]
* [[How to fix server authentication if it is broken( unable to login server)]]
* [[Snapshot restoration of VM's]]
* [[AWS CloudFront distributions Creation]]
* [[VPN configuration on organization level]]
* [[Fixing VM Issue from vcenter console with admin access in Clavister]]
* [[OS level checks on Nagios]]
* [[Certificate checks on Nagios]]
* [[SSL certificate CSR generation]]
* [[Applying a generated certificate on web server]]
* [[What if Office 365 doesn't respond to Magento test emails]]
* [[Killing CPU 'hungry' processes on Zeb/PCR servers]]
* [[Auto Deployment from UAT to LIVE (dashboardsupportpod)]]
* [[Checking Failed Mails in Trend Micro]]
* [[Renewing Letsencrypt Certificate for Free BSD (nagios.apoyar)]]
* [[Upgrading Major Versions of PHP]]
* [[How to Make Dead RMG Back to Live (Scorpion)]]
* [[Disabling Expired Certificate on demo.apoyar]]
* [[How to Block 80 and 443 traffic for server]]
* [[AWS S3 Sync]]
* [[Checking System logs]]
* [[Root partition alerts]]
* [[SSL Certification Installation on Linux]]
* [[Renewing SSL Certificate on OpenVPN Server]]
* [[Updating the Demo server (has the outbound http/https traffic blocked)]]
* [[Performing restores from AWS using the N2WS backup software]]
* [[Renewing Commercial certificate on Exchange 2016-19]]
* [[Seizing the DC roles in the case the main DC fails]]
* [[Backend fetch failed 503 error & Webp,Webm conversion little bit understandable]]
* [[Addidional steps to perform when moving services from one DC to another]]
* [[Check_defrag probe not working on Nagios]]
* [[JIRA File Upload issue]]
* [[Zeb_video sftp permissions check and fix]]
* [[Wise Geary Backups]]
* [[Extending Linux File System After Resizing the Volume – EC2]]
* [[Adding the missing host from HyperV console]]
* [[Setting Updates to Manual on HyperV]]
* [[awsbackup.apoyar.eu SSL Renew]]
* [[Renewing LetsEncrypt SSL - files.apoyar.net]]
* [[Generating LetsEncrypt SSL - Bleckmann New Custom URL]]
* [[Instance Refresh - ZEB]]
* [[Instance Refresh - PCR]]
* [[Commercial SSL Certificate Chain Checks]]
* [[Image color coding conversion]]
* [[SSL renewal for Apoyar 3cx sip.apoyar.net]]
* [[SSL renewal for login.ubanvpn.com]]
* [[Lambda Function Version Upgrade (16.x to 20.x)]]
* [[Create clone of CloudFront distribution using AWS CLI]]
* [[Gitlab version upgrade]]
* [[Adding a New Bleckmann Host to Nagios Monitoring]]
* [[Bleckmann Custom URL's Autorenewal Checks]]
* [[Renewing LetsEncrypt SSL - nagios.apoyar.eu]]
* [[LetsEncrypt SSL for Bleckmann Custom URL - Updated]]

Bleckmann Custom URL's Autorenewal Checks

2025-09-22T11:47:52Z

Admin: Created page with "- The directory where the certbot config is located is /etc/letsencrypt/renewal - To change the webroot I did: sed -i 's|bleckmannci4|halivephp84/bleckmannci4|' * - To test the config you can: certbot renew --dry-run -v - To remove a config you can: certbot delete --cert-name eureturns.blakelyclothing.com - To check the renewal hook you can: nano /etc/letsencrypt/renewal-hooks/deploy/postrenewal.sh - Custom domain auto renewal changes when we change root path like..."

- The directory where the certbot config is located is /etc/letsencrypt/renewal

- To change the webroot I did: sed -i 's|bleckmannci4|halivephp84/bleckmannci4|' *

- To test the config you can: certbot renew --dry-run -v

- To remove a config you can: certbot delete --cert-name eureturns.blakelyclothing.com

- To check the renewal hook you can: nano /etc/letsencrypt/renewal-hooks/deploy/postrenewal.sh

- Custom domain auto renewal changes when we change root path like /var/www/bleckmannci4 to /var/www/halivephp84/bleckmannci4 then we have to follow above steps

Main Page

2025-09-22T11:46:59Z

Admin:

Renewing Letsencrypt Certificate for Free BSD (nagios.apoyar)

2024-08-31T13:58:44Z

Admin:

Renewing Letsencrypt Certificate for Free BSD (nagios.apoyar)
------------------------------------------------------------

Login to nagios.apoyar

• cd /usr/local/etc/apache24

• vi httpd.conf

go to end of the file (Shift+G)

Here will get one line “To renew certbot comment out the above and enable the below”

So, enable the certbot and disable the nagios

Then restart apache

• apachectl restart

Open port 80 on firewall
--------------------------

Login to juniper - http://juniper.apoyar/login

- Username – root

- Password - ap0yar

Go to

- Security

- Policy

- Apply policy

Look for nagios here and then edit

Under application

Search for http

Select junos_http and click on add

And then commit the changes from top menu

Go back to nagios.apoyar

Run dry run command

• certbot renew --dry-run

NOTE: if you get an error related to apache certbot plugin then install it with below command

" pkg install py311-certbot-apache " ( this command version is python3.11 )

if all Ok, then remove dry run and run again

• certbot renew

After renewal, go back and edit httpd.conf

• cd /usr/local/etc/apache24

• vi httpd.conf

go to end of the file (Shift+G)

now, disable the certbot and enable the nagios

Then restart apache

• apachectl restart

check apache port
• socket -14

Lambda Function Version Upgrade (16.x to 20.x)

2024-06-17T06:14:40Z

Admin:

Go to AWS console ---> Lambda ---> Functions

Select the function here, for which we want to upgrade the version ---> Actions ---> View details

In details page, go down.. will get "Runtime Settings"

Under "Runtime Settings".. click on "Edit".. It will open new page

On this page.. will get option to select the version from dropdown list

So, change runtime version from 16.x to 20.x and click on "Save"

Once we click save, it will save and get back us on details page

Now on details page.. click "Action" ---> select "Publish new version" ---> click "Publish"

It will again get back us to details page.. here then click "Update code"

Then we can check under "Runtime settings" newly upgraded version.

Create clone of CloudFront distribution using AWS CLI

2024-06-17T06:14:08Z

Admin:

Connect to ZEB LB (lb.zeb.apoyar) or any ZEB server where we have CLI access to AWS

Run below two commands one by one at /home/neal/

---> aws cloudfront get-distribution-config --id E2KCQM43EXPGWB --output json > sourceCFconfig.json (In this, we have to edit the ID, from which we need to create clone)

---> cp sourceCFconfig.json newCFconfig.json

Then we need to open & edit the newCFconfig.json file

---> vi newCFconfig.json

edit out the first parent element (2nd and 3rd line) and don't forget to delete the 2nd last curly bracket

Edit the Aliases (new info)

Change the origin (if you are using a different one), example - cdn.zeb.be

Change the comment (CloudFront Distribution Name)

Change Caller Reference to something else (timestamp is OK) --> its nothing but the unique ID, we can put timestamp, example - 201406131130

At last run below command

---> aws cloudfront create-distribution --distribution-config file://newCFconfig.json

once done, go to AWS console ---> CloudFront , we can see here new distribution is created and status as deploying.

Create clone of CloudFront distribution using AWS CLI

2024-06-17T06:13:34Z

Admin:

Connect to ZEB LB (lb.zeb.apoyar) or any ZEB server where we have CLI access to AWS

And below two commands one by one at /home/neal/

---> aws cloudfront get-distribution-config --id E2KCQM43EXPGWB --output json > sourceCFconfig.json (In this, we have to edit the ID, from which we need to create clone)

---> cp sourceCFconfig.json newCFconfig.json

Then we need to open & edit the newCFconfig.json file

---> vi newCFconfig.json

edit out the first parent element (2nd and 3rd line) and don't forget to delete the 2nd last curly bracket

Edit the Aliases (new info)

Change the origin (if you are using a different one), example - cdn.zeb.be

Change the comment (CloudFront Distribution Name)

Change Caller Reference to something else (timestamp is OK) --> its nothing but the unique ID, we can put timestamp, example - 201406131130

At last run below command

---> aws cloudfront create-distribution --distribution-config file://newCFconfig.json

once done, go to AWS console ---> CloudFront , we can see here new distribution is created and status as deploying.

Create clone of CloudFront distribution using AWS CLI

2024-06-17T06:13:14Z

Admin: Created page with "Connect to ZEB LB (lb.zeb.apoyar) or any ZEB server where we have CLI access to AWS And below two commands one by one at /home/neal/ ---> aws cloudfront get-distribution-config --id E2KCQM43EXPGWB --output json > sourceCFconfig.json (In this, we have to edit the ID, from which we need to create clone) ---> cp sourceCFconfig.json newCFconfig.json Then we need to open & edit the newCFconfig.json file ---> vi newCFconfig.json edit out the first parent element (2nd..."

Lambda Function Version Upgrade (16.x to 20.x)

2024-06-17T06:12:08Z

Admin: Created page with "Go to AWS console ---> Lambda ---> Functions Select the function here, for which we want to upgrade the version ---> Actions ---> View details In details page, go down.. will get "Runtime Settings" Under "Runtime Settings".. click on "Edit".. It will open new page On this page.. will get option to select the version from dropdown list So, change runtime version from 16.x to 20.x and click on "Save" Once we click save, it will save and get back us on details page N..."

Main Page

2024-06-17T06:11:35Z

Admin:

SSL renewal for Apoyar 3cx sip.apoyar.net

2024-06-10T10:56:59Z

Admin:

SSL renewal for sip.apoyar.net
-------------------------------

Login to 3cx.apoyar with neal user and apoyar keyfile

go to below path

---> cd /etc/nginx/sites-enabled/

make sure we have 3cxpbx file there

then run below command to renew ssl

---> sudo certbot certonly --manual --rsa-key-size 2048 --preferred-challenges dns --debug-challenges -d sip.apoyar.net

it will ask to continue.. press Y and hit enter to continue

now it will give us value to update in TXT record in go daddy, so update there given value..

URL - https://dcc.godaddy.com/control/dnsmanagement?domainName=apoyar.net

---> TXT _acme-challenge.sip rUV6G9yk5_MmK9tNbDkxrIHT9UCcJY9tTMmMHeUwHk0 1 Hour

wait for 10 mins and then press enter to continue

it will give us new certificate and keyfile.. same we have to update in 3cxpbx as below

ssl_certificate /etc/letsencrypt/live/sip.apoyar.net/fullchain.pem;^M

ssl_certificate_key /etc/letsencrypt/live/sip.apoyar.net/privkey.pem;^M

then for checking syntax run below command

---> nginx -t

if all OK, then reload nginx

---> service nginx reload

now browse and check website ssl date.

SSL renewal for login.ubanvpn.com

2024-06-10T10:56:09Z

Admin:

SSL renewal for login.ubanvpn.com

Login to ubanvpn.apoyar with root user and apoyar keyfile

go to below path

---> cd /etc/apache2/sites-enabled/

make sure we have ubanvpn.conf file there

then run below command to renew ssl

---> sudo certbot -d login.ubanvpn.com --manual --preferred-challenges dns certonly

it will ask to continue.. press Y and hit enter to continue

now it will give us value to update in TXT record in go daddy, so update there given value..

URL - https://dcc.godaddy.com/control/dnsmanagement?domainName=ubanvpn.com

---> TXT _acme-challenge.login nwjBd3BC9-pijtmhfbydvhI1etaWAyKpKASLsq1G11g 1 Hour

wait for 10 mins and then press enter to continue

it will give us new certificate and keyfile.. same we have to update in 3cxpbx as below

SSLCertificateFile /etc/letsencrypt/live/login.ubanvpn.com/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/live/login.ubanvpn.com/privkey.pem

then for checking syntax run below command

---> sudo apache2ctl configtest

if all OK, then reload nginx

---> service apache2 reload

now browse and check website ssl date.

SSL renewal for login.ubanvpn.com

2024-06-10T10:50:57Z

Admin:

SSL renewal for login.ubanvpn.com

Login to ubanvpn.apoyar with root user and apoyar keyfile

go to below path

---> cd /etc/apache2/sites-enabled/

make sure we have ubanvpn.conf file there

then run below command to renew ssl

---> sudo certbot -d login.ubanvpn.com --manual --preferred-challenges dns certonly

it will ask to continue.. press Y and hit enter to continue

now it will give us value to update in TXT record in go daddy, so update there given value..

---> TXT _acme-challenge.login nwjBd3BC9-pijtmhfbydvhI1etaWAyKpKASLsq1G11g 1 Hour

wait for 10 mins and then press enter to continue

it will give us new certificate and keyfile.. same we have to update in 3cxpbx as below

SSLCertificateFile /etc/letsencrypt/live/login.ubanvpn.com/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/live/login.ubanvpn.com/privkey.pem

then for checking syntax run below command

---> sudo apache2ctl configtest

if all OK, then reload nginx

---> service apache2 reload

now browse and check website ssl date.

SSL renewal for login.ubanvpn.com

2024-06-10T10:50:31Z

Admin: Created page with "SSL renewal for login.ubanvpn.com Login to ubanvpn.apoyar with root user and apoyar keyfile go to below path ---> cd /etc/apache2/sites-enabled/ make sure we have ubanvpn.conf file there then run below command to renew ssl ---> sudo certbot -d login.ubanvpn.com --manual --preferred-challenges dns certonly it will ask to continue.. press Y and hit enter to continue now it will give us value to update in TXT record in go daddy, so update there given value.. -..."

SSL renewal for login.ubanvpn.com

Login to ubanvpn.apoyar with root user and apoyar keyfile

go to below path

---> cd /etc/apache2/sites-enabled/

make sure we have ubanvpn.conf file there

then run below command to renew ssl

---> sudo certbot -d login.ubanvpn.com --manual --preferred-challenges dns certonly

it will ask to continue.. press Y and hit enter to continue

now it will give us value to update in TXT record in go daddy, so update there given value..

---> TXT _acme-challenge.login nwjBd3BC9-pijtmhfbydvhI1etaWAyKpKASLsq1G11g 1 Hour

wait for 10 mins and then press enter to continue

it will give us new certificate and keyfile.. same we have to update in 3cxpbx as below

SSLCertificateFile /etc/letsencrypt/live/login.ubanvpn.com/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/live/login.ubanvpn.com/privkey.pem

then for checking syntax run below command

---> sudo apache2ctl configtest

if all OK, then reload nginx

---> service apache2 reload

now browse and check website ssl date.

Main Page

2024-06-10T10:46:28Z

Admin:

SSL renewal for Apoyar 3cx sip.apoyar.net

2024-06-10T07:02:05Z

2023-09-07T10:29:27Z

Admin:

Login to openvpn server from jupiter (10.0.1.55 using neal user and apoyar key)

systemctl stop openvpnas

systemctl status openvpnas

certbot certonly --force-renewal --standalone --non-interactive --agree-tos --email support@apoyar.eu --domains sslvpn.apoyar.net --pre-hook 'sudo service openvpnas stop' --post-hook 'sudo service openvpnas start'

(If getting error about port 80 while running above command, we have to kill the process running on that port)

to check services running on ports, run below command

netstat -anpt | grep LISTEN

check here and kill process and then try again running certbot command, once command executed get the certificate and key details, edit in below commands and execute below 2 commands

ln -s -f /certificate path /usr/local/openvpn_as/etc/web-ssl/server.crt

ln -s -f /keyfile path /usr/local/openvpn_as/etc/web-ssl/server.key

cd /usr/local/openvpn_as/scripts

./sacli stop

./sacli --key "cs.priv_key" --value_file "/etc/letsencrypt/live/sslvpn.apoyar.net/privkey.pem" ConfigPut

./sacli --key "cs.cert" --value_file "/etc/letsencrypt/live/sslvpn.apoyar.net/fullchain.pem" ConfigPut

./sacli start

reboot

Upgrading major versions of Nginx,Mysql

2023-09-07T06:46:15Z

Admin:

Upgrading Version of Nginx
------------------------------

Login to Server (on which need to update Nginx version)

• Cd /home/neal/root/

Download the nginx source

• wget http://nginx.org/download/nginx-1.18.0.tar.gz

Unzip the downloaded file

• tar xzvf filename

• Nginx –V

Copy the configuration modules in text

Open the server with latest SSL version (demo.apoyar)

• Nginx –V

Copy the last configuration command with SSL and paste it in text document at last

Download the open SSL source

• Go to cd /usr/local/src/

• wget https://www.openssl.org/source/openssl-1.1.1i.tar.gz

• tar xzvf filename

• go to cd root/

• go to nginx folder

Paste here that configuration module which we have in text document and hit enter

NOTE: - If getting any errors, troubleshoot with the below steps as per errors coming across.

If the ./configure gives you any errors, take the following steps:

apt-get install uuid-dev

If ./configure gives you an error about psol not found

apt-get install libgd-dev in case of this error:

./configure: error: the HTTP image filter module requires the GD library.

apt-get install libgeoip-dev in case of:
./configure: error: the GeoIP module requires the GeoIP library.

install libssl-dev in case of:
./configure: error: SSL modules require the OpenSSL library.

install libpcre++-dev in case of:
./configure: error: the HTTP rewrite module requires the PCRE library.

apt-get install libxslt1-dev in case of:
./configure: error: the HTTP XSLT module requires the libxml2/libxslt

apt-get install zlib1g-dev
./configure: error: the HTTP gzip module requires the zlib library

apt-get install libpam0g-dev in case of:
make gives you an error:

fatal error: security/pam_appl.h: No such file or directory

Then run below command

• make

Uninstall OLD Nginx

• Cd etc/

• tar czvf nginx

• mv nginx /root/

• dpkg -l | grep nginx

• apt-get purge nginx

After removing old nginx reboot the server

Installing NEW Nginx

• Cd /root/nginx 1.18.0

• make install

• Go to cd etc/

• unzip the older zipped nginx folder here

• Nginx –V

If the nginx command doesn't work, create a symlink:

• ln -s /usr/share/nginx/sbin/nginx /usr/sbin/Ln

• Nginx –V

Go to Cd /nginx/sites-enabled

Check syntax and potential errors:

• sudo nginx –t

# Will throw this error nginx: [emerg] mkdir() "/var/lib/nginx/body" failed (2: No such file or directory)

# Just create directory

• mkdir -p /var/lib/nginx && sudo nginx –t

Create systemd unit file for NGINX:

• sudo vim /etc/systemd/system/nginx.service

Copy/paste the following content:

NOTE: The location of the PID file and the NGINX binary may be different depending on how NGINX was compiled.

[Unit]

Description=A high performance web server and a reverse proxy server
After=network.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
ExecStop=-/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid
TimeoutStopSec=5
KillMode=mixed

[Install]
WantedBy=multi-user.target

Start and enable NGINX service:

• sudo systemctl start nginx.service && sudo systemctl enable nginx.service

Create UFW NGINX application profile:

• sudo vim /etc/ufw/applications.d/nginx

Copy/paste the following content:

[Nginx HTTP]
title=Web Server (Nginx, HTTP)
description=Small, but very powerful and efficient web server
ports=80/tcp

[Nginx HTTPS]
title=Web Server (Nginx, HTTPS)
description=Small, but very powerful and efficient web server
ports=443/tcp

[Nginx Full]
title=Web Server (Nginx, HTTP + HTTPS)
description=Small, but very powerful and efficient web server
ports=80,443/tcp

Now, verify that UFW app profiles are created and recognized:

• sudo ufw app list

# Available applications:

# Nginx Full
# Nginx HTTP
# Nginx HTTPS
# OpenSSH

Commercial SSL Certificate Chain Checks

2023-06-29T12:28:52Z

Admin: Created page with "SSL Certificate chain checks ---------------------------- - Once we got certificate from the client, if multiple .crt files.. combine them into a single certificate and if its single certificate just keep as it is - then we can check the certificate content with following command openssl x509 -in certificate.crt -text -noout - then depending on certificate authority we need to downlaod and add intermediate certificates - downloaded intermediate certificates should..."

SSL Certificate chain checks
----------------------------

- Once we got certificate from the client, if multiple .crt files.. combine them into a single certificate and if its single certificate just keep as it is

- then we can check the certificate content with following command

openssl x509 -in certificate.crt -text -noout

- then depending on certificate authority we need to downlaod and add intermediate certificates
- downloaded intermediate certificates should be valid more than year, as of our generated certificate

- to combine our generated certificate and intermediate_bundle certificate into a single cerrtificate use below command (with appropriate names)

cat generated.crt intermediate_bundle.crt > resulting.crt

- Once its ready we can check details of certificate with below command (with resulting certificate name)

cat apoyar_2024.crt | awk -v cmd="openssl x509 -subject -issuer -noout" '/-----BEGIN/ { c = $0; next } c { c = c "\n" $0 } /-----END/ { print c|cmd; close(cmd); c = 0 }'

- Then, once we apply it on website, we can check the chain of certificate authorities at below site weather its broken or not.

https://www.sslshopper.com/ssl-checker.html

Instance Refresh - PCR

2023-06-29T12:27:45Z

Admin: Created page with "Instance Refresh PCR --------------------- - Login to lb.pcr.apoyar - Go to /usr/local/bin - Run below script ----> ./1-create***.sh (press ENTER until its ask's for) - Then, Go to aws console - EC2 instances - AMI’S console - Check here latest AMI is creating - Wait for 5-8 mins to create new AMI - Then copy the ami name, with todays it creates - Now again go to server same location (/usr/local/bin) - Run below script ---> ./2-revert-template.sh - Now..."

Instance Refresh PCR
---------------------

- Login to lb.pcr.apoyar

- Go to /usr/local/bin

- Run below script

----> ./1-create***.sh (press ENTER until its ask's for)

- Then, Go to aws console

- EC2 instances - AMI’S console

- Check here latest AMI is creating

- Wait for 5-8 mins to create new AMI

- Then copy the ami name, with todays it creates

- Now again go to server same location (/usr/local/bin)

- Run below script

---> ./2-revert-template.sh

- Now go to aws EC2 console

- Select "Launch Templates" from left side menu

- Select "PCR_LB", then click on "Actions" and select "Modify template (create new version)"

- Here search in my AMI's —> we have copied ami name earlier, so need to search it and select that and create template version

- Then go to EC2 console, click on left side menu last option "autoscaling group"

- select pcr_lb2 --> --> instance refresh tab ---> skip matching (untick) and then start instsance refresh

NOTE ---> When instance refresh initiate we will receive email from aws cloudwatch and once its finished we will receive second email termination of old autoscale instance (this way we can get to know that instance refresh done and new autoscale intance will launch)

Instance Refresh - ZEB

2023-06-29T12:27:16Z

Admin: Created page with "Instance Refresh PCR --------------------- - Login to lb.zeb.apoyar - Go to /usr/local/bin - Run below script ----> ./1-create***.sh (press ENTER until its ask's for) - Then, Go to aws console - EC2 instances - AMI’S console - Check here latest AMI is creating - Wait for 5-8 mins to create new AMI - Then copy the ami name, with todays it creates - Now again go to server same location (/usr/local/bin) - Run below script ---> ./2-revert-template.sh - Now..."

Instance Refresh PCR
---------------------

- Login to lb.zeb.apoyar

- Go to /usr/local/bin

- Run below script

----> ./1-create***.sh (press ENTER until its ask's for)

- Then, Go to aws console

- EC2 instances - AMI’S console

- Check here latest AMI is creating

- Wait for 5-8 mins to create new AMI

- Then copy the ami name, with todays it creates

- Now again go to server same location (/usr/local/bin)

- Run below script

---> ./2-revert-template.sh

- Now go to aws EC2 console

- Select "Launch Templates" from left side menu

- Select "ZEB_LB", then click on "Actions" and select "Modify template (create new version)"

- Here search in my AMI's —> we have copied ami name earlier, so need to search it and select that and create template version

- Then go to EC2 console, click on left side menu last option "autoscaling group"

- select zeb_lb --> --> instance refresh tab ---> skip matching (untick) and then start instsance refresh

NOTE ---> When instance refresh initiate we will receive email from aws cloudwatch and once its finished we will receive second email termination of old autoscale instance (this way we can get to know that instance refresh done and new autoscale intance will launch)

Main Page

2023-06-29T12:26:45Z

Admin:

Renewing LetsEncrypt SSL - files.apoyar.net

2023-04-10T13:52:21Z

Admin: Created page with "Login to ftp.apoyar Open services and stop “Windows Update” service. Then, open IIS manager Expand FTP/ expand/expand Sites/ Select “Default Web Site” and on rightmost menu click on “Stop” Then, select “WSUS Administration” and on rightmost menu click on “Stop” Then, login to crushftp site - https://files.apoyar.net/WebInterface/login.html Username – admin Password - 5tarry.Night Once logged in, click on “Admin” option, it will get you..."

Login to ftp.apoyar

Open services and stop “Windows Update” service.

Then, open IIS manager

Expand FTP/ expand/expand Sites/

Select “Default Web Site” and on rightmost menu click on “Stop”

Then, select “WSUS Administration” and on rightmost menu click on “Stop”

Then, login to crushftp site - https://files.apoyar.net/WebInterface/login.html

Username – admin

Password - 5tarry.Night

Once logged in, click on “Admin” option, it will get you to the crushftp admin console

Once in admin console, click on “Preferences”

Then click on “IP/Servers” tab

Here will get entry HTTP://lookup:80

Highlight that entry, right click, and click on “Start Server”

Once it becomes green, it means it’s started (port 80 got enabled)

Then from the left menu, click on last option “Plugins”

Here on Plugins page. from that drop down option select “LetsEncrypt”

It will give us, Letsencrypt SSL autorenewal setup page

On this page, at “Execute CrushTask/Job after cert renew” select “Crush Task” option and click on “Submit”

(wait until we got SUCCESS message popup).. once we got SUCCESS message, browse and check files.apoyar.net

If its renewed then, again select “-“ option at “Execute CrushTask/Job after cert renew” and click on submit.

Then again go back to “IP/Servers” tab

Here will get entry HTTP://lookup:80

Highlight that entry, right click, and click on “Stop Server”

Login back to ftp.apoyar

open IIS manager

Expand FTP/ expand/expand Sites/

Select “Default Web Site” and on rightmost menu click on “Start”

Then, select “WSUS Administration” and on rightmost menu click on “Start”

At last, open services and Start “Windows Update” service.

2022-06-01T07:04:44Z

Admin: Created page with "WiseGeary – Steps to Follow while shifting from one DomainController to Other ---------------------------------------------------------------------------- When a DC1 is Switched Off or Not Running because we have to restart, we have to move everything to DC2. Now We will move back everything to DC1 There are 3 steps to follow . Whenever there I a update on DC1 we need to follow these steps pnly then we will shoutdown and install the Updates. We can view the Runni..."

WiseGeary – Steps to Follow while shifting from one DomainController to Other
----------------------------------------------------------------------------

When a DC1 is Switched Off or Not Running because we have to restart, we have to move everything to DC2.

Now We will move back everything to DC1

There are 3 steps to follow .

Whenever there I a update on DC1 we need to follow these steps pnly then we will shoutdown and install the Updates.

We can view the Running Status of VM’s on the Host in Hyper V Manager

Hyperv1:

VM’s : DC1, Disaster Recovery, Exchange. File Server, Management. PBX, RDP.

Hyperv2 :

DC2, Exchange, File Server, Management, PBX, RDP, Storage Server.

Step 1 : Transfer FSMO(Flexible Single Master Operations) Roles

Check the Domain :

Open Power Shell Editor , Copy the Below Commands and Press Enter

Get ADForest wg.local | ft DomainNamingMaster, SchemaMaster

Get ADDomain wg.local | InfrastructureMaster, PDCEmulator, RIDMaster

And to Transfer the Domain from DC2 to DC1

Move ADDirectoryServerOperationMasterRole-Identity “DC1” – OperationMasterRole

DomainNamingMaster, PDCEmulator, RIDMaster, InfraStructureMaster

Give [A] Yes to all it will transfer the role

NOTE : We need to wait upto 15 to 20 Mins for the roles to tranfer, Do not shut down immediately.

These transfer will work even the other server is down, even we can run the commands.

2. Move DHCP Server :

NOTE : we should not have 2 or more DHCP Server running on the same subnet at the same time.

We Open DHCP Server on Both the Servers DC1 & DC2

Check the Server which is Authorised by right Clicking on DHCP Server. If you find the Authorise option.

Open bash shell as Admin on DC2 server Use the Command to Export the files from DC2 to DC1.

Export-dhcp- ComputerName “DC2” – File \\DC2\C$\DHCP\01dHCPConf.xml - verbose

Verbose : Exporting Configuration from Server DC2 to File \\DC2\C$\DHCP\01dHCPConf.xml

Now we return to DC1

Check the C drive for DHCP Folder Moved .

Now we Import the File.

Open Bash Shell on DC1

Copy the below command and run

Import – DhcpServer – Lease – File “C:\DHCP\01dHCPConf.xml” – BackupPath “C:\DHCP\Backup” – Vverbose

Press Y to run the command.

Now we have to Unauthorise the DHCP on DC2 , Right Click and select unauthorise and press Yes.

After that we have to authorise DHCP on DC1.

3. Change the Value on Clavister.

LDAP Client doesn’t allow more than one LDAP Servers.

Login to https:\\pfa.wise-geary.co.uk.444

Login with credentials

Click on Objects

We DC (we need to see the IP Address if it is of DC2 , change the IP to DC1.)

192.168.1.250 to 192.168.1.245

No Interruptions against the client unless we do configuration it still tries to connect to DC2.,

DC2 still has the ActiveDirectory Uprunning.

Click on Configuration.

Save & Activate Setting.

We Have Disaster Recovery System Running on Windows for the Back Up for the Domains.

Check defrag probe not working on Nagios

2022-06-01T07:01:38Z

Admin: Created page with "Checking Defrag Probe not working on Nagios ------------------------------------------ We have a problem with WG-DC1 -Defragmentation. Lets look on nagios machine /usr/local/etc/nagios/objects $ vi service.cfg /defrag Command is : check_defrag ! “C1” Lets go to command $ vi command.cfg Defrag command $USER1$|Check_nrpe3 -H $HOSTADDRESS$ -n -t 7200 -c check-defrag -a $ARG1$ (its not always easy to get the metrics from a windows machine and lets execute the..."

Checking Defrag Probe not working on Nagios
------------------------------------------

We have a problem with WG-DC1 -Defragmentation.

Lets look on nagios machine

/usr/local/etc/nagios/objects $ vi service.cfg

/defrag

Command is : check_defrag ! “C1”

Lets go to command

$ vi command.cfg

Defrag command

$USER1$|Check_nrpe3 -H $HOSTADDRESS$ -n -t 7200 -c check-defrag -a $ARG1$

(its not always easy to get the metrics from a windows machine and lets execute the command on nagios machine

$ /usr/local/libexec/nagios/check-nrpe3 -H dc1.wise.apoyar -n -t 7200 -c check_defrag -a c:

It is easy with NRPE.

Go to DC1 Server.

Start

Services

Stop the NSClient++ Monitoring agent

Now we try running it manually

Start

CMD(Admin)

We find the NSClient++ in the local disk this is the windows server which takes all the commands and requests from nrpe, browses them and keeps all the information about.

Local Disk --- Program Files – NSClient++--NSCP.

In Command Prompt

C:”\program Files”\NSClient++”

Nscp

Go to command prompt admin

C:\program files\NSClient++ > cd Scripts

C: \program files\NSClient++\scripts > check_defrag( this command is missing )

We need to get the contents from other any other server

Go to folders

Search : \\dc\\

Network>dc>c$>programfiles>NSClient++>Scripts

(this script folder contains pre installed scripts and custom scripts , Copy them)

Go back to previous folder

Local disk>program files> NSClieent++>scripts folder

Paste it

(skip files which are same now we can see check defrag script in the folder)

Now we try running the command

C:\ program files\NSClient++\scripts > check_defrag.exe C:

a dialogue box displays with some message(the following feature couldn’t be installed
.NET Framework 3.5(includes >NET 2.0 and 3.0)

We need to install .NET Framework

Start> server manager(need to wait until it finish the loading)>manage>add roles and features>server selection(next)>server roles>features (.NET Framework3.5)>confirmation.

Note : if you try to install .NET Framework 3.5 it would throw an error for windows) Specify an alternate source path

Go to folder

This PC > DVD Drivers> sources>sxs

Copy the path and paste as alternate path

Click Install

Close after completes the installation

Now if we try to run the command

C:\ program files\NSClient++\scripts > check_defrag.exe C:

It will run without any error –

We need to restart the services of NSClient++ after defrag completes without fail.

Let go back to Nagios machine and run the command.

$ /usr/local/libexec/nagios/check-nrpe3 -H dc1.wise.apoyar -n -t 7200 -c check_defrag -a c:

(Now we can see the services run for defragmentation)

Now we go to nagios

WG DC2 > Defragmentation > Reschedule the next check (Manually) > it will take some time and the issue get resolved.