Thursday, April 18, 2024

Give your docker host a dedicated hostname

 Docker by default has different containers running on different ports.  So you can have multiple hostnames all go to the same machine, but they won't automatically go the same ports if you're just using DNS.  

Solution is to have a webserver (we'll be using apache), which does an automatic forward to the port depending on the hostname being used.  

1) Have the multiple hostnames all refer to the docker host via IP address (if this is a home network dnsmasq or unbound will usually allow multiple hostnames to one IP if you do it manually).  

2) In your apache config file directory (mine is /etc/apache2/sites-enabled) create a config file 

-we'll call ours "docker-redirects.conf", but you can name it anything that makes sense to you.

 <VirtualHost *:80>

ServerName docker1.locadomain

Redirect 301 / http://host.localdomain:3001

</VirtualHost>

 

 <VirtualHost *:80>

ServerName docker2.locadomain

Redirect 301 / http://host.localdomain:3002

</VirtualHost>

 

etc...  


The above will allow anyone on your local network to type in docker1 (or whatever name you use instead), and then apache will automatically forward them to the right docker container based on the domain name they typed in.  

Thursday, May 30, 2019

WSUS cleaning wizard fails 'Database Error'

If while running the WSUS cleaning wizard you get a Database error that looks like this:


You could reboot the server that WSUS is running on, but if it's used for other things also (e-mail, dhcp, dns, file, printing, etc...), you'll have to wait till there's downtime, before trying again.

Another option though is to restart the database service.
If you go to administrative tools -> services (or runbox services.msc), look for 'Windows Internal Database" and right click on it, and select restart

or from an admin command prompt:
sc stop mssql$microsoft##wid
sc start mssql$microsoft##wid

Then go back to the wsus management console, click on reset server node, and you should now be able to run the cleaning wizard (it'll probably take a couple hours or more, but it shouldn't give you an error),

And you were able to do this without interrupting whatever else may be running on it.



Monday, September 21, 2015

Firefox freezing on linux (x2go)

Not scripting related however:
I am using x2go to access my linux (ubuntu) system remotely, using the kdeWM.  If I use firefox though, the moment I right click anywhere on a web page (say to open a link in a new tab or window), firefox freezes.

Turns out it's an issue with the pulse audio daemon, and at least if you're using x2go like me, it's easy to fix once you know what the problem is.

When disconnected from your linux server, in the x2go client, go into the session preferences, click on the Media tab -> and uncheck "Enable sound support".   Selecting esd might also fix it, but I haven't tried that.

Many thanks to the comment by oms-ubun at: https://bugs.launchpad.net/ubuntu/+source/firefox-3.0/+bug/528798  for directing me to the issue.




Tuesday, March 24, 2015

linux (fedora) how to change your screen resolution

The following are intended for when you're using a virtual machine (proxmox host in my case), and the resolution is too high for your 1080p laptop screen that you're using to manage the VMs remotely.
However these methods will probably work with a physical linux installation also (not just a virtual one).


As of 2015 the following method worked for me on Fedora 21 (server version):
Edit the following file with your favorite text editor (mine is VIM): /etc/default/grub
find the line starting with: GRUB_CMDLINE_LINUX=
and put at the end: video=800x600"
when you're done the line should look something like:
GRUB_CMDLINE_LINUX="rd.lvm.lv=fedora-server/root rd.lvm.lv=fedora-server/swap rhgb quiet video=800x600"

note: instead of 800x600 you can use, 640x480 or 1024x768 also

sources:
https://fedoraproject.org/wiki/Display_resolution_of_Fedora_18_virtual_machines
https://fedoraproject.org/wiki/GRUB_2?rd=Grub2


To change the resolution off X-windows (xorg),
xrandr --output VGA-0 --mode 800x600
-if you have any errors type xrandr by itself, (and hit enter), and you will see a list of available outputs and the list of modes for each one:
source: https://wiki.archlinux.org/index.php/xrandr


edit: below is my original method, which newer versions of fedora (as of 2015/ fedora 21) doesn't appear to work very well.

If you're running fedora in a virtual machine (proxmox, vmware, virtualbox), and the screen resolution of fedora in console mode (not X), is so high that it takes up your entire screen you can change it using fbset.

If you don't have fbset, first you'll have to install it "sudo yum install fbset"

Then you can change the resolution with the following:
sudo fbset -xres 800 -yres 600
(can use 1024 768, or other resolutions also).


Wednesday, November 5, 2014

chrome for enterprise auto download

In a work environment normally you want to download one copy of an update to one computer, and then copy it to the rest of the computers.  This way you don't clog up your office's internet connection.  While proxys can work, they are often tricky to configure.

Google has a version of chrome that will install for all users on a computer, that you can manage (like disable group updates, and configure some other settings).  Details are at: http://wpkg.org/Google_Chrome.  They also have a script that will download proper version of chrome and rename it so you can deploy it using a tool to the computers in your enterprise (which is designed to work with their deployment tool but I made it work with some slight modifications).

Chrome has an rss feed at http://googlechromereleases.blogspot.com/ which will notify you when there's an update.  While you could check it every day, how likely are you going to miss the day it came out, and then end up either downloading it during the day (clogging people's bandwidth), or waiting another day to schedule the download?
Below is my batch script for checking the rss feed, and if it sees there's an updated chrome, will call a script that download it automatically.

Now when you see there's a new version of chrome, it's already downloaded (if you scheduled the checking script to run every night).  I then create a package using local update publisher or wsus package publisher.


rem -----------------------------------------------------------------------------------------------
@echo off
set updatesloc=\\server\share\folder\google-chrome
rem set debug=1 if you have any problems.
set debug=0
if %debug%==1 echo grabbing the feed at %time%
wget http://googlechromereleases.blogspot.com/ -O %temp%\chrome-updates-feed.html
rem searching the feed for the current chrome version, and breaking out as soon as we
rem find the first one (that's not for chrome OS).

if %debug%==1 echo searching the downloaded feed for the current version at %time%
for /f "tokens=8" %%v in ('find /i "The stable channel has been updated to " %temp%\Chrome-updates-feed.html ^|find /v "Chrome OS"') do (
set curver=%%v
goto endverfind
)
:endverfind

if %debug%==1 echo searching the directory of downloaded updates to see if we already have the current version %time%
rem if the curver string length is less then three characters it's probably not valid.
rem google uses very long version numbers like: 38.0.2125.111
if "%curver:~3,1%"=="" goto end

for /f "tokens=1" %%d in ('dir /s /b %updatesloc% ^|find /c "%curver%"') do set curverdownloaded=%%d
if %debug%==1 echo search complete now to figure out what to do %time%
if %curverdownloaded%==0 goto downloadnewver
if %curverdownloaded%==0 goto gotcurver

:gotcurver
echo got the current version, %curver% nothing to do
goto end

:downloadnewver
echo need to download the newest version %curver%, at %time%
c:\windows\syswow64\cscript.exe %updatesloc%\update-chrome.vbs
goto end

:end
echo %time%
rem -------------------------------------------------------------------


my modified download vbscript (based heavily on the script at http://wpkg.org/Google_Chrome)
make sure you've downloaded dsofile
www.microsoft.com/downloads/details.aspx?FamilyID=9ba6fac6-520b-4a0a-878a-53ec8300c4c2&DisplayLang=en
and that you have wget in your path, wget is needed for the batch file above also.
http://gnuwin32.sourceforge.net/packages/wget.htm


'------------------------------------------------------------------------
' update-chrome.vbs -- stored in %updatesloc%\google-chrome
'from http://wpkg.org/Google_Chrome
Option Explicit
Dim objFSO, objFile, strFileProperties, objShell, strChromePath, strChromeURL
Dim strVersion, objResult, strChromeFilename, objOleFile, arrComments
Dim strTemplateFilename, ForReading, ForWriting, strText
Dim strNewText

strChromePath = "j:\patches\google-chrome\"
'strChromePath = "c:\downloads\"
strChromeFilename = "GoogleChromeStandaloneEnterprise.msi"
strTemplateFilename = "google-chrome-template.xml"
strChromeURL = "https://dl.google.com/edgedl/chrome/install/" & _
strChromeFilename

Set objShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objOleFile = CreateObject("DSOFile.OleDocumentProperties")

objShell.CurrentDirectory = strChromePath
' wget downloaded from http://users.ugent.be/~bpuype/wget/
objResult = objShell.Run("wget --limit-rate=200k --no-check-certificate " & strChromeURL, 1, True)
If objFSO.FileExists(strChromePath & strChromeFilename) Then
' Grab version number. Requires Office installation, or DSOFile.dll
' from http://support.microsoft.com/kb/224351
objOleFile.Open(strChromePath & strChromeFilename)
arrComments = Split(objOleFile.SummaryProperties.Comments, " ", 2)
strVersion = arrComments(0)
objOleFile.Close

' Make a copy of the file
Set objFile = objFSO.GetFile(strChromePath & strChromeFilename)
objFile.Copy strChromePath & "GoogleChromeStandaloneEnterprise-" & _
strVersion & ".msi", True
' Delete the original file
objFile.Delete True
' Update package definitions
' updateXML strTemplateFilename, _
' "..\..\packages\google-chrome.xml" ' legacy tree
' updateXML strTemplateFilename, _
' "..\..\dev\packages\google-chrome.xml" ' dev tree
' updateXML strTemplateFilename, _
' "..\..\stable\packages\google-chrome.xml" ' stable tree
Else
MsgBox "Selected file does not exist!"
End If

'Sub updateXML(strTemplateFilename, strPackageFilename)
' Update package definition
' ForReading = 1
' ForWriting = 2
' Set objFile = objFSO.OpenTextFile(strTemplateFilename, ForReading)
' strText = objFile.ReadAll
' objFile.Close
' strNewText = Replace(strText, "__VERSION__", strVersion)
 '
' Set objFile = objFSO.OpenTextFile(strPackageFilename, ForWriting)
' objFile.WriteLine strNewText
' objFile.Close
'End Sub
'-----------------------------------------------------------------------------

Thursday, August 7, 2014

finding your interface name for netsh

How to find the name of your interface for netsh.

In a previous post I had a ip changing script that used netsh to change the ip addresses.
The main syntax being: "netsh interface ip set address "Local Area Connection" static 192.168.1.53 255.255.255.0 192.168.1.1 1

However in windows 8, there are two issues:
1) you now have to use ipv4 instead of ip,
2) my previous method of using ipconfig to find the name of the network connection to use, doesn't work.

For the second issue I would get the error: "The filename, directory name, or volume label syntax is incorrect."

To find the correct name for your connection (where it says "Local Area Connection" above), type in:
netsh interface show interface
This will list the currently enabled interfaces, which hopefully will include the one you're trying to mess with.  If the one you want isn't listed, make sure it's associated with a wireless network (if it's the Wi-Fi interface),  or the network cable is plugged in if it's a wired interface.


Thursday, January 23, 2014

windows ip switcher

Where I work, I support multiple offices.  Most of the offices do not have DHCP, they use static ip addresses (not my decision).  So here is a script I made for changing the ip address settings on a windows laptop, this does have to be ran with full admin privileges.  You will have to change parts of this script for your usage (where ever you see an ip address, and probably want to change the labels for the networks also).

echo ip-switch ver 20081119

set baseoffice=hq

rem now we figure out what subnet we're on
for /f "tokens=2 delims=:" %%i in ('ipconfig ^|find "IP Address"') do set ipaddr=%%i
for /f "tokens=2,3 delims=." %%o in ('echo %ipaddr%') do set subnet=%%o.%%p


rem based on the sub-net we determine what our location is
if /i "%subnet%" == "10.10" set loc=hq
if /i "%subnet%" == "10.11" set loc=sub
if /i "%subnet%" == "11.11" set loc=b1
if /i "%subnet%" == "11.12"  set loc=b2
if "%loc%" == "hq" set comploc=acompanyoffice
if "%loc%" == "substation" set comploc=acompanyoffice
if "%loc%" == "branch1" set comploc=acompanyoffice
if "%loc%" == "branch2" set comploc=acompanyoffice
if "%comploc%" == "acompanyoffice" goto comploc
set comploc=remote
:comploc


echo off

:complocmenu
cls
if "%comploc%" == "acompanyoffiice" echo this computer is currently setup for %comploc% (%loc%) use
if "%comploc%" == "remote" echo this computer is currently setup for %comploc% use
echo where is this laptop now (so it can communicate with the internet)?
echo 1) your base office (%baseoffice%)
echo 2) remote, home/other office
echo x) exit (leave everything as it is)
echo if another office enter the two-three letter abbreviation for it,
echo (hq,sub,b1,b2,etc...), and press enter, otherwise,
set /p comploc=press 1,2 or x and then enter:
rem if we entered a correct choice go to the next menu
if "%comploc%" == "1" goto methodmenu
if "%comploc%" == "2" goto methodmenu
if "%comploc%" == "x" echo no changes will be made
if /i "%comploc%" == "x" goto endprog
if /i "%comploc%" == "hq" goto otheroffice
if /i "%comploc%" == "sub" goto otheroffice
if /i "%comploc%" == "b1" goto otheroffice
if /i "%comploc%" == "b2" goto otheroffice


cls
rem if we entered a wrong chose clear screen of distraction
rem and ask for correct input
echo "you must press 1 or 2, or just press enter"
goto complocmenu

:otheroffice
set baseoffice=%comploc%
goto methodmenu

:methodmenu
echo is the laptop plugged in or using wireless?
echo 1) plugged in
echo 2) wireless
echo x) endprog
set /p netmethod=press 1 or 2 and then press enter

if "%netmethod%" == "1" set conmethod="Local Area Connection"
if "%netmethod%" == "2" set conmethod="Wireless Network Connection"
if "%netmethod%" == "1" goto methodselected
if "%netmethod%" == "2" goto methodselected
if "%netmethod%" == "x" goto endprog
echo "incorrect method selected"
goto methodmenu
:methodselected


if "%comploc%" == "1" goto staticip
if "%comploc%" == "2" goto dhcpip

:staticip
echo we will configure the computer for jcc office use
rem goto endprog
rem remove the goto endprog when we fix these settings
rem set static ip address (needs to be edited)

for /f "tokens=1 delims=-" %%I in ('echo %baseoffice%') do set loc=%%I
for /f "tokens=2 delims=-" %%C in ('hostname') do set compip=%%C
echo computer ip is %compip%

if /i "%baseoffice%" == "h1" set netaddr=10.10.10
if /i "%baseoffice%" == "sub" set netaddr=10.10.11
if /i "%baseoffice%" == "b1" set netaddr=10.11.11
if /i "%baseoffice%" == "b2" set netaddr=10.11.12




echo network address is %netaddr%

rem netsh interface ip set address "Local Area Connection" static %netaddr%.%compip% 255.255.255.0 %netaddr%.1 1
rem netsh interface ip set dns "Local Area Connection" static 10.91.1.21
rem netsh interface ip set wins "Local Area Connection" static 204.130.253.130
netsh interface ip set address %conmethod% static %netaddr%.%compip% 255.255.255.0 %netaddr%.1 1
netsh interface ip set dns %conmethod% static 10.91.1.21
netsh interface ip set wins %conmethod% static 10.254.2.130
rem start /wait sysdm.cpl

goto endprog


:dhcpip
rem some netsh commands to set dhcp on the interface
netsh interface ip set address name=%conmethod% source=dhcp
netsh interface ip set dns name=%conmethod% source=dhcp
netsh interface ip set wins name=%conmethod% source=dhcp
goto endprog

:endprog
hostname
for /f "tokens=2 delims=:" %%i in ('ipconfig ^|find "Default Gateway"') do set gateway=%%i
ipconfig |find "Address"
ping %gateway%
echo if you got back replys your good, if any of the requests timed out that's not good.
pause

Thursday, December 12, 2013

change system SQL database connection

In windows you can create a database connection for your front end program to use.  Well as with all things in life things change, you decide to get a new database server, you messed up on the initial imaging of the workstations, you decided to expand or consolidate your database servers.  Instead of having to go around to each desktop and dig through control panel on each one to edit the database connection, here's a script to change the server.

This does not create a new database connection on each computer, for that you'll probably want to do configuration through control panel on one of the computers and then export it out the HKLM\SOFTWARE\Wow6432Node\ODBC\ODBC.INI or HKLM\SOFTWARE\ODBC\ODBC.INI keys to a file.

If your database is something other then CMS you'll need to change the key path referenced below.




@echo off
if "%1" == "" goto needarguments
for /f "tokens=2" %%W in ('date /t') do set dater=%%W
for /f "tokens=1-3 delims=/" %%d in ('echo %dater%') do set curdate=%%f%%d%%e
rem what we're changing the CMS database server to.
set dsnserver=newprod



:nextcomp
set remotecomp=%1
rem need to do some ping checks and stuff
echo updating %1 at %time%


for /f "tokens=2 skip=1 delims==" %%q in ('ping -n 1 %1') do set pingtimer=%%q
for /f "tokens=1 delims=m" %%s in ('echo %pingtimer%') do set pingtime1=%%s


if "%pingtime1%" == "1 Received " set pingtime1=down
if "%pingtime1%" == "down" echo %1 down at %date% %time% >> pc-down-dsn-%curdate%.lst
if "%pingtime1%" == "down" goto thiscompfinished



rem this works only if changing the server, if no dsn/odbc connection is
rem yet set up, you'll need to add more registry keys then just this one.
rem echo on
if exist \\%1\c$\windows\syswow64 reg add "\\%1\HKLM\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\CMS" /v Server /t reg_sz /d %dsnserver% /f
if not exist \\%1\c$\windows\syswow64 reg add "\\%1\HKLM\SOFTWARE\ODBC\ODBC.INI\CMS" /v Server /t reg_sz /d %dsnserver% /f
if errorlevel 1 echo %1 had error updating dsn on %date% %time% >> pc-error-dsn-%curdate%.lst
if errorlevel 0 echo %1 updated dsn to %dsnserver% on %date% %time% >> pc-fixed-dsn-%curdate%.lst
echo off


:thiscompfinished
shift
if not "%1" == "" goto nextcomp
echo finished at %date% %time%
goto end


:needarguments
echo usage: %0 comp1 comp2 comp3 etc...
echo make sure to not use any \\







:end

Monday, December 9, 2013

IE Tracking protection lists

Where I'm at we have a web filtering device that will display a full pdf with the employer's terms of service if you go to a website we have blocked.  Problem is one of those is facebook, and if you go to say a news site and it has a facebook like button, the news site isn't blocked, but you still get a huge pdf file come up on your screen.

Thankfully if you're running a newer version of Internet Explorer, there is a feature called "Tracking Protection Lists", while meant to improve your privacy, they can also disable the facebook "like" button that you find on many websites. Problem is digging through all of IE's settings can be a pain.  So here is a simple internal web page for users to go to load the page (just have to click a button on the page).

note: If you're using IIS to serve this you will need to go into the server's "MIME Types" and add
the .tpl extension.  I labeled it as "application/ie", IIS apparently won't serve unknown MIME types.

First file is the tracking protection list file that we want IE to load.
#------------------don't include this line in facebook-block.tpl ---------------------------
msFilterList
: Expires = 5
# blocked strings
- like.php
# domain rules
-d facebook.com
-d facebook.net
# from http://anglachelg.blogspot.com/2011/04/create-your-own-tpl-for-ie9.html
#------------------don't include this line in facebook-block.tpl ---------------------------

------index.html --- don't include this line ---------------------
<!DOCTYPE html />
<html >
<head>
<!--- from http://msdn.microsoft.com/en-us/library/hh273399%28v=vs.85%29.aspx -->
    <title>Internet Explorer 9 Tracking Protection list loader</title>
    <script type="text/javascript">
 
    function checkTP() {
    //checks whether Tracking Protection has been enabled (any list is on)
        if (window.external.msTrackingProtectionEnabled())
      {
            document.getElementById("results").innerHTML = "Tracking protection is: ON";
        } else {
            document.getElementById("results").innerHTML = "Tracking protection is: OFF";
        }
    }

    //loads a list specified by input field
    function loadTPFile() {
        var URL = document.getElementById("tplfile").value;      
        var description = 'Facebook blocking Tracking Protection List';      
        window.external.msAddTrackingProtectionList(URL, description);
    }
</script>

</head>
<body>
<!---- First check that you have tracking protection enabled by click the
"check tracking protection" button
<div>
  <button onclick="checkTP();">Check tracking protection</button>
  <span id="results">Tracking protection is: </span>
</div>
<p />
Remember that you need to have tracking protection "on" for this to work
if tracking protection is off, go to: <br>
tools, tracking protection, select "Your Personalized List" and click enable, close, <br>
then click on the "check tracking protection" button again.

--->
<p />
This is for blocking the facebook like button (and facebook's other tracking mechanisims),
that are on many websites nowdays, which cause the company's usage policy to pop up.  To stop this: <br>
click on "load TPL file"
and click on the "add list" button
<p />
<div>
  <button onclick="loadTPFile();">Load TPL file</button>
  <input id= "tplfile" type="text" value="facebook-block.tpl" size="60" />
</div>

<p />
Remember if you go to the facebook.com website itself you will still get a copy of the company's
Internet usage policy poping up.
</body>
</html>


Monday, September 23, 2013

enable basic games in windows

To enable/disable features in windows 7 you use dism (deployment image servicing and management).

The following batch file will enable the basic games (chess, minesweeper, solitaire, etc...), but not any of the internet games.
This will have to be ran with full admin privileges.

rem --------------games-enable-w7.bat--------------
rem to get a list of whats available and enabled/disabled
rem dism /online /Get-Features
echo make sure you're running this with admin privleges
dism /online /enable-feature /featurename:"InboxGames"
dism /online /disable-feature /featurename:"Internet Games"
dism /online /disable-feature /featurename:"More Games"
rem ---------end of batch script----------------


Wednesday, July 31, 2013

setting windows permissions from the command line using icacls

Why set permissions from the command line when you can just right click and check or uncheck a few boxes?

Well checking boxes is great, if you only have one computer or two, and never have to re-do it.  Once you have a few, well it's probably time to script it :)

Here are some basic ones I've used

To lock down a folder so that no one can delete what they created, a write only folder, (two liner):
icacls d:\writeonlyfolder /deny Everyone:(CI)(OI)(DE)
icacls d:\writeonlyfolder /deny Everyone:(CI)(OI)(DC)


So that people can't put any files in a folder (just subfolders)
icacls d:\parentfolder /deny "Domain Users":(WD)

This is a locked down structure, where only the creator of a folder on a share
has access to the contents, no one else can even get into the folder created, other then administrators.

rem we do want administrators and the creator of the folder though to have access
icacls d:\secured /grant:r "Domain Administrators":(OI)(CI)F
icacls d:\secured /grant:r "Creator Owner":(OI)(CI)F
allow users to create folders in the parent folder.
icacls d:\secured /grant:r users:WRXM
remove any inheritance which could cause issues.
icacls d:\secured /inheritance:r 

Background on how windows file permissions work:

Tuesday, July 9, 2013

Git revision control on windows via cygwin

With all this scripting one needs to be able to track the changes to their larger scripts.  You can do the crude append -## to the file-name where ## is some revision number, but if you have a large script that you change a lot over a long period of time, relying on this, or file system backups, just doesn't work very well.  Fortunately the programming field has revision control, and I've decided to use GIT.   Unfortunately tortoise git while it is easy to use and install, caused some issues where browsing via network neighborhood to a remote site was slowed down tremendously.

So I decide to use cygwin and the git it has, unfortunately the git gui interface (which I'm use to from tortoise git), is a little tricky to set up.

When in the cygwin setup go into the "Devel" section and select all the items that start with git, including gitk, then go to the "X11" section and select, X-Start-menu-icons, and xinit.  Once the cygwin setup program finished up, click on the start button, all programs, cygwin-x, X win server.  You should see a white terminal box pop up.  Use normal unix/linux commands to go the directory where your scripts are, and run your git commands.  The reason for using the white terminal window from the X-win-server is so that you can run gitk.  For some reason git gui gives me an error, but gitk works just fine.

The git gui that is in cygwin is just for browsing the history of your code, to actually commit changes, and do anything other then view, you will still need to use the command line:

For those new to git at the command line this is my cheetsheet
for more commands and details of the commands check http://www.vogella.com/articles/Git/article.html

first create the repository
git init

add files to the repository
git add filename

see the changes since the last commit:
git diff

commit the changes:
git commit -m "some comments"

commit a particular file:
git commit script.bat

git status

git add script.bat

git log

see the commits for a file
git log filename

see the diffs of each commit for a file
git log -p filename

see the entire history
git log --follow -p file

Thursday, May 23, 2013

Monitor Inventory script

Inventory time.  That time of the year where property control (or whatever they call it in your business), wants to know where everything is, usually for tax or insurance purposes.

There's a good chance you already have a means for easily finding a computer if you have its serial number, several products will make it so that it's at least not too hard, and you may even have your own records for the computers.  If you don't already, I have a script for that, that I'll post latter.  However property control wants to know about everything, not just the tower unit, but furniture, metal detectors, TV's, monitors, etc...

I can't help you for most of those things, but if you got property control asking you where are your different monitors, because they're hooked into the computer, or maybe you did some moving or replacing of the monitors, I have something that may help, if they have the serial numbers for the monitors.

I've only ran this on dell computers with dell monitors with admin rights to all the computers, but if you have a different setup, you can still try this script, no guarantees though.... If you still can't find your monitor, make sure the computer is on, and that it's not in a store room somewhere unplugged.


The resulting csv file looks like:
machine, monitor model, serial, mfg, date of mfg

comp1,DELL 1702FP,8G1522CGxxx1,DEL,12/2002
comp2,DELL 1907FP,DC32364Hxxx2,DEL,4/2006
comp3,DEL 1908FPBLK,D325J958xxx3,DEL,5/2009
comp4,DELL 1702FP,8G1522CGxxx4,DEL,12/2002

remember, on dell monitors at least, it only pulls approximately the last half of the monitor's serial number.

this is the batch file that has all the computers you want to check for monitors on, and runs a vbscript on each one, which saves the monitor information into a csv file.


rem monitor-inventory.bat
rem you'll probably want to change the location of the csv file
set csvfile=\\fileserver\staff\it-docs\monitors.csv
rem the first line of the csv file so you know what's in each column.
echo machine, monitor model, serial, mfg, date of mfg >> %csvfile%
rem the list of the computers are in the parenthesies for the following lines, if you have
rem a lot of computers you can add more lines, or have multiple copies of this bat file
rem with different names, and different computers listed in each
for %%C in (server reception secretary manager boss comp1 comp2 comp3 comp4 ) do cscript %progpath%mon-serial-num-v2.vbs %%C >> %csvfile% //nologo
for %%C in (comp5 comp6 video guard) do cscript %progpath%mon-serial-num.vbs %%C >> %csvfile% //nologo
rem --------------------------------------------------


The following is the core vb script that is based in large part on a script from: http://social.technet.microsoft.com/Forums/da-DK/ITCG/thread/18f72e8d-d3ee-4e51-a55d-aa5fd26db974
Some modifications were made to make it work with my batch file above.


'--------------------------------------------------------------

Option Explicit
Dim WshShell
Set WshShell = WScript.CreateObject("WScript.Shell")
Dim strComputer, message


Dim intMonitorCount
Dim oRegistry, sBaseKey, sBaseKey2, sBaseKey3, skey, skey2, skey3
Dim sValue
dim i, iRC, iRC2, iRC3
Dim arSubKeys, arSubKeys2, arSubKeys3, arrintEDID
Dim strRawEDID
Dim ByteValue, strSerFind, strMdlFind
Dim intSerFoundAt, intMdlFoundAt, findit
Dim tmp, tmpser, tmpmdl, tmpctr
Dim batch, bHeader
batch = True
'most of this script is stolen from: http://social.technet.microsoft.com/Forums/da-DK/ITCG/thread/18f72e8d-d3ee-4e51-a55d-aa5fd26db974


If WScript.Arguments.Count = 1 Then
strComputer = WScript.Arguments(0)
'batch = True
Else
strComputer = wshShell.ExpandEnvironmentStrings("")
strComputer = InputBox("Check Monitor info for what PC","PC Name?",strComputer)
End If


If strcomputer = "" Then WScript.Quit
strComputer = UCase(strComputer)


If batch Then
Dim fso,logfile, appendout
logfile = wshShell.ExpandEnvironmentStrings("%userprofile%") & "\desktop\MonitorInfo.csv"


'setup Log
Const ForAppend = 8
Set fso = CreateObject("Scripting.FileSystemObject")
If Not fso.FileExists(logfile) Then bHeader = True
set appendout = fso.OpenTextFile(logfile, ForAppend, True)


If bHeader Then
appendout.writeline "Computer,Model,Serial #,Vendor ID,Manufacture Date,Messages"
End If
End If


Dim strarrRawEDID()
intMonitorCount=0
Const HKLM = &H80000002 'HKEY_LOCAL_MACHINE
'get a handle to the WMI registry object
On Error Resume Next
Set oRegistry = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "/root/default:StdRegProv")


If Err <> 0 Then
If batch Then
EchoAndLog strComputer & ",,,,," & Err.Description
Else
MsgBox "Failed. " & Err.Description,vbCritical + vbOKOnly,strComputer
WScript.Quit
End If
End If




sBaseKey = "SYSTEM\CurrentControlSet\Enum\DISPLAY\"
'enumerate all the keys HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY\
iRC = oRegistry.EnumKey(HKLM, sBaseKey, arSubKeys)
For Each sKey In arSubKeys
'we are now in the registry at the level of:
'HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY\<VESA_Monitor_ID\
'we need to dive in one more level and check the data of the "HardwareID" value
sBaseKey2 = sBaseKey & sKey & "\"
iRC2 = oRegistry.EnumKey(HKLM, sBaseKey2, arSubKeys2)
For Each sKey2 In arSubKeys2
'now we are at the level of:
'HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY\<VESA_Monitor_ID\<PNP_ID>\
'so we can check the "HardwareID" value
oRegistry.GetMultiStringValue HKLM, sBaseKey2 & sKey2 & "\", "HardwareID", sValue
for tmpctr=0 to ubound(svalue)
If lcase(left(svalue(tmpctr),8))="monitor\" then
'If it is a monitor we will check for the existance of a control subkey
'that way we know it is an active monitor
sBaseKey3 = sBaseKey2 & sKey2 & "\"
iRC3 = oRegistry.EnumKey(HKLM, sBaseKey3, arSubKeys3)
For Each sKey3 In arSubKeys3
'Kaplan edit
strRawEDID = ""
If skey3="Control" Then
'If the Control sub-key exists then we should read the edid info
oRegistry.GetBinaryValue HKLM, sbasekey3 & "Device Parameters\", "EDID", arrintEDID
If vartype(arrintedid) <> 8204 then 'and If we don't find it...
strRawEDID="EDID Not Available" 'store an "unavailable message
else
for each bytevalue in arrintedid 'otherwise conver the byte array from the registry into a string (for easier processing later)
strRawEDID=strRawEDID & chr(bytevalue)
Next
End If
'now take the string and store it in an array, that way we can support multiple monitors
redim preserve strarrRawEDID(intMonitorCount)
strarrRawEDID(intMonitorCount)=strRawEDID
intMonitorCount=intMonitorCount+1
End If
Next
End If
Next
Next
Next
'*****************************************************************************************
'now the EDID info for each active monitor is stored in an array of strings called strarrRawEDID
'so we can process it to get the good stuff out of it which we will store in a 5 dimensional array
'called arrMonitorInfo, the dimensions are as follows:
'0=VESA Mfg ID, 1=VESA Device ID, 2=MFG Date (M/YYYY),3=Serial Num (If available),4=Model Descriptor
'5=EDID Version
'*****************************************************************************************
On Error Resume Next
dim arrMonitorInfo()
redim arrMonitorInfo(intMonitorCount-1,5)
dim location(3)
for tmpctr=0 to intMonitorCount-1
If strarrRawEDID(tmpctr) <> "EDID Not Available" then
'*********************************************************************
'first get the model and serial numbers from the vesa descriptor
'blocks in the edid. the model number is required to be present
'according to the spec. (v1.2 and beyond)but serial number is not
'required. There are 4 descriptor blocks in edid at offset locations
'&H36 &H48 &H5a and &H6c each block is 18 bytes long
'*********************************************************************
location(0)=mid(strarrRawEDID(tmpctr),&H36+1,18)
location(1)=mid(strarrRawEDID(tmpctr),&H48+1,18)
location(2)=mid(strarrRawEDID(tmpctr),&H5a+1,18)
location(3)=mid(strarrRawEDID(tmpctr),&H6c+1,18)


'you can tell If the location contains a serial number If it starts with &H00 00 00 ff
strSerFind=chr(&H00) & chr(&H00) & chr(&H00) & chr(&Hff)
'or a model description If it starts with &H00 00 00 fc
strMdlFind=chr(&H00) & chr(&H00) & chr(&H00) & chr(&Hfc)


intSerFoundAt=-1
intMdlFoundAt=-1
for findit = 0 to 3
If instr(location(findit),strSerFind)>0 then
intSerFoundAt=findit
End If
If instr(location(findit),strMdlFind)>0 then
intMdlFoundAt=findit
End If
Next


'If a location containing a serial number block was found then store it
If intSerFoundAt<>-1 then
tmp=right(location(intSerFoundAt),14)
If instr(tmp,chr(&H0a))>0 then
tmpser=trim(left(tmp,instr(tmp,chr(&H0a))-1))
Else
tmpser=trim(tmp)
End If
'although it is not part of the edid spec it seems as though the
'serial number will frequently be preceeded by &H00, this
'compensates for that
If left(tmpser,1)=chr(0) then tmpser=right(tmpser,len(tmpser)-1)
else
tmpser="Not Found"
End If


'If a location containing a model number block was found then store it
If intMdlFoundAt<>-1 then
tmp=right(location(intMdlFoundAt),14)
If instr(tmp,chr(&H0a))>0 then
tmpmdl=trim(left(tmp,instr(tmp,chr(&H0a))-1))
else
tmpmdl=trim(tmp)
End If
'although it is not part of the edid spec it seems as though the
'serial number will frequently be preceeded by &H00, this
'compensates for that
If left(tmpmdl,1)=chr(0) then tmpmdl=right(tmpmdl,len(tmpmdl)-1)
else
tmpmdl="Not Found"
End If


'**************************************************************
'Next get the mfg date
'**************************************************************
Dim tmpmfgweek,tmpmfgyear,tmpmdt
'the week of manufacture is stored at EDID offset &H10
tmpmfgweek=asc(mid(strarrRawEDID(tmpctr),&H10+1,1))


'the year of manufacture is stored at EDID offset &H11
'and is the current year -1990
tmpmfgyear=(asc(mid(strarrRawEDID(tmpctr),&H11+1,1)))+1990


'store it in month/year format
tmpmdt=month(dateadd("ww",tmpmfgweek,datevalue("1/1/" & tmpmfgyear))) & "/" & tmpmfgyear


'**************************************************************
'Next get the edid version
'**************************************************************
'the version is at EDID offset &H12
Dim tmpEDIDMajorVer, tmpEDIDRev, tmpVer
tmpEDIDMajorVer=asc(mid(strarrRawEDID(tmpctr),&H12+1,1))


'the revision level is at EDID offset &H13
tmpEDIDRev=asc(mid(strarrRawEDID(tmpctr),&H13+1,1))


'store it in month/year format
tmpver=chr(48+tmpEDIDMajorVer) & "." & chr(48+tmpEDIDRev)


'**************************************************************
'Next get the mfg id
'**************************************************************
'the mfg id is 2 bytes starting at EDID offset &H08
'the id is three characters long. using 5 bits to represent
'each character. the bits are used so that 1=A 2=B etc..
'
'get the data
Dim tmpEDIDMfg, tmpMfg
dim Char1, Char2, Char3
Dim Byte1, Byte2
tmpEDIDMfg=mid(strarrRawEDID(tmpctr),&H08+1,2)
Char1=0 : Char2=0 : Char3=0
Byte1=asc(left(tmpEDIDMfg,1)) 'get the first half of the string
Byte2=asc(right(tmpEDIDMfg,1)) 'get the first half of the string
'now shift the bits
'shift the 64 bit to the 16 bit
If (Byte1 and 64) > 0 then Char1=Char1+16
'shift the 32 bit to the 8 bit
If (Byte1 and 32) > 0 then Char1=Char1+8
'etc....
If (Byte1 and 16) > 0 then Char1=Char1+4
If (Byte1 and 8) > 0 then Char1=Char1+2
If (Byte1 and 4) > 0 then Char1=Char1+1


'the 2nd character uses the 2 bit and the 1 bit of the 1st byte
If (Byte1 and 2) > 0 then Char2=Char2+16
If (Byte1 and 1) > 0 then Char2=Char2+8
'and the 128,64 and 32 bits of the 2nd byte
If (Byte2 and 128) > 0 then Char2=Char2+4
If (Byte2 and 64) > 0 then Char2=Char2+2
If (Byte2 and 32) > 0 then Char2=Char2+1


'the bits for the 3rd character don't need shifting
'we can use them as they are
Char3=Char3+(Byte2 and 16)
Char3=Char3+(Byte2 and 8)
Char3=Char3+(Byte2 and 4)
Char3=Char3+(Byte2 and 2)
Char3=Char3+(Byte2 and 1)
tmpmfg=chr(Char1+64) & chr(Char2+64) & chr(Char3+64)


'**************************************************************
'Next get the device id
'**************************************************************
'the device id is 2bytes starting at EDID offset &H0a
'the bytes are in reverse order.
'this code is not text. it is just a 2 byte code assigned
'by the manufacturer. they should be unique to a model
Dim tmpEDIDDev1, tmpEDIDDev2, tmpDev


tmpEDIDDev1=hex(asc(mid(strarrRawEDID(tmpctr),&H0a+1,1)))
tmpEDIDDev2=hex(asc(mid(strarrRawEDID(tmpctr),&H0b+1,1)))
If len(tmpEDIDDev1)=1 then tmpEDIDDev1="0" & tmpEDIDDev1
If len(tmpEDIDDev2)=1 then tmpEDIDDev2="0" & tmpEDIDDev2
tmpdev=tmpEDIDDev2 & tmpEDIDDev1


'**************************************************************
'finally store all the values into the array
'**************************************************************
'Kaplan adds code to avoid duplication...


If Not InArray(tmpser,arrMonitorInfo,3) Then
arrMonitorInfo(tmpctr,0)=tmpmfg
arrMonitorInfo(tmpctr,1)=tmpdev
arrMonitorInfo(tmpctr,2)=tmpmdt
arrMonitorInfo(tmpctr,3)=tmpser
arrMonitorInfo(tmpctr,4)=tmpmdl
arrMonitorInfo(tmpctr,5)=tmpVer
End If
End If
Next


'For now just a simple screen print will suffice for output.
'But you could take this output and write it to a database or a file
'and in that way use it for asset management.
i = 0
for tmpctr = 0 to intMonitorCount-1
If arrMonitorInfo(tmpctr,1) <> "" And arrMonitorInfo(tmpctr,0) <> "PNP" Then
If batch Then
EchoAndLog strComputer & "," & arrMonitorInfo(tmpctr,4) & "," & _
arrMonitorInfo(tmpctr,3)& "," & arrMonitorInfo(tmpctr,0) & "," & _
arrMonitorInfo(tmpctr,2)
Else
message = message & "Monitor " & chr(i+65) & ")" & VbCrLf & _
"Model Name: " & arrMonitorInfo(tmpctr,4) & VbCrLf & _
"Serial Number: " & arrMonitorInfo(tmpctr,3)& VbCrLf & _
"VESA Manufacturer ID: " & arrMonitorInfo(tmpctr,0) & VbCrLf & _
"Manufacture Date: " & arrMonitorInfo(tmpctr,2) & VbCrLf & VbCrLf
'wscript.echo ".........." & "Device ID: " & arrMonitorInfo(tmpctr,1)
'wscript.echo ".........." & "EDID Version: " & arrMonitorInfo(tmpctr,5)
i = i + 1
End If
End If
Next


If not batch Then
MsgBox message, vbInformation + vbOKOnly,strComputer & " Monitor Info"
End If


Function InArray(strValue,List,Col)
Dim i
For i = 0 to UBound(List)
If List(i,col) = cstr(strValue) Then
InArray = True
Exit Function
End If
Next
InArray = False
End Function


Sub EchoAndLog (message)
'Echo output and write to log
Wscript.Echo message
AppendOut.WriteLine message
End Sub

Saturday, April 27, 2013

dhclient and /etc/resolv.conf being overwritten.

In ubuntu 12.12 (the one I'm currently using), dhclient is used to get a dhcp lease.  For most people this works just dandy.  However if you use it for routing, and/or running your own dns server inside your network, or just want to have some dns servers used for whatever reason that the dhcp server doesn't issue you can do the following.  

If you go into the /etc/dhcp directory you will see a file called dhclient.conf
somewhere (anywhere really), in the file put the following line:
prepend domain-name-servers 8.8.8.8;

if you want just your custom dns server:
supersede domain-name-servers 8.8.8.8;


This will put the 8.8.8.8 dns server at the top of the list of dns servers in the /etc/resolv.conf file, in addition the to usual ones that the dhcp server gave to your computer. 

Of course for your network you will probably replace 8.8.8.8 with the ip address of another dns server (unless you really want to use one of google's dns servers).  


In fedora you have to go to /etc/sysconfig/network-scripts/, and find the file for your network device (something like ifcfg-ethX, where X is a number usually 0).

change the line PEERDNS=yes to =no.


Friday, April 26, 2013

installing ssh fedora

Fedora nowadays doesn't have the ssh server by default, if you want it here's how (fedora no longer uses /etc/init.d):

yum install openssh
service sshd start
service sshd enable

note: if you want to start/enable other services on fedora you can replace sshd with the name of the other service.

Wednesday, April 24, 2013

proxmox tips

To force a vm to shutdown you can't do it from the web interface so instead you'll have to ssh in and use your root username and password.  Once you're ssh'd in type:
qm shutdown <vmid> -forceStop
more details at: http://pve.proxmox.com/wiki/Manual:_qm




Proxmox is a nice setup overall, but the java vnc interface to view the desktop of the vm is just lousy.  A way around that is to ssh in and go to the /etc/pve/nodes/proxmox/qemu-server directory.  In the 1##.conf file (where 1## is the id of the VM), put the following lines:
args: -vnc 0.0.0.0:10
You can do this with each vm, just make sure the change the number after the last colon, as
each vnc connection has to be on it's own port.  Then you can vnc using your favorite vnc viewer, and use the ip address/hostname of the proxmox server followed by a : and the number that's at the end of the line you put in the VM's config file.  In this case it would be "vncviewer proxmox-machine:10"

More details on your vnc options and proxmox are at: http://pve.proxmox.com/wiki/Vnc_2.0


For tips on how to deal with the screen resolution of linux in a VM (both X and console):
http://thescriptingadmin.blogspot.com/2013/04/fedora-too-high-resolution-in-vm.html


Friday, April 5, 2013

ssh-agent in cygwin

If you do command line work like I do, and remote into a linux machine via ssh, you may or may not be aware of ssh keys.  If you use an ssh key you can log into the machine without a password.  However to keep things secure, you really should use a password on your ssh key, but if you had to type in the password every time you used the key, that would sort of defeat the purpose of the ssh key.  So they have ssh-agent for linux and cygwin (if you're using putty use pagent instead).

Normally you first run ssh-agent, then run ssh-add (or just have it loaded via kde, gnome, or .bash_profile if you don't use a gui at all on linux).  On cygwin though you might encounter the error message "Could not open a connection to your authentication agent" when you type in ssh-add.  The solution is apparently to run the following command: "exec ssh-agent bash", and once you get a new bash shell then type ssh-add.


enable remote registry service on windows 7

Windows 7 by default disables the remote registry service (probably for security reasons).  To enable it from  the command line type the following:

sc \\computername config remoteregistry start= auto
make sure you have a space between the = sign and auto
if you're doing this on your local computer you can drop the \\computername part
you can also replace "remoteregistry" with the name of another service to enable or disable it.


once you've enabled the service you can either reboot the computer, or just start it now with:

sc \\computername start remoteregistry


If you want to know why we want to enable this service, it's so that you can pull up the registry of a remote computer that's currently in use (normally hkey_local_machine) via regedit on your local machine.  This way you don't have to interrupt whoever is currently at the computer by using RDP, VNC, or kicking the user out of their chair, at most you may have to tell them to reboot their machine at some point.

Thursday, March 21, 2013

printer statistics via SNMP

At work we have some multi-function copiers that do the whole print, scan, copy, deal.  What do you do if you want to track printer usage?.  You can either enable monitoring of print jobs on the print server, if your users go through a print server, or you can track the page counts on the printers themselves, if they are network printers.

In addition to tracking page counts, this script tracks how many sheets of paper are left in each of the trays (if your network printer is advanced enough to do that), and dumps all the information to a csv file.  Right now I'm running the script every hour or so to track what happens if I adjust some default settings.

For this you will need net-snmp, which you can get at: http://sourceforge.net/projects/net-snmp/files/net-snmp%20binaries/ if you're using windows, if you're using linux do apt-get install snmp or yum install net-snmp depending on your distro so that you get snmpwalk installed.

For linux you'll probably need to create a bash script of your own, based on the nagios script I used at:  http://exchange.nagios.org/directory/Plugins/Hardware/Printers/SNMP-Printer-Check/details

Without further ado here's my batch script (for windows):



@echo off
set snmpexe=c:\usr\bin\snmpwalk.exe
rem make sure to include the .exe at the end
rem netsnmp binaries are available from:
rem http://sourceforge.net/projects/net-snmp/files/net-snmp%20binaries/
rem shouldn't need to change anything between this and ":appendfile"
set prnip=%1
echo checking on the amount of paper left in the trays for printer %prnip%
for /f "tokens=2" %%W in ('date /t') do set dater=%%W
for /f "tokens=1,2 delims=:" %%t in ('echo %time%') do set timer=%%t:%%u
for /f "tokens=1-3 delims=/" %%d in ('echo %dater%') do set curdate=%%f%%d%%e
for /f "tokens=3 delims=/" %%y in ('echo %dater%') do set curyear=%%y
rem reset variables for when we run this multiple times (usually on different printers),
rem in the same enviroment (don't want previous valuse affecting this run).
set tray0=x
set tray1=x
set tray2=x
set tray3=x
set tray4=x
set pgcount=x
if "%1" == "" goto usage
if NOT exist %snmpexe% goto usage

if exist prn-%prnip%-%curyear%.csv goto appendfile
:newfile
echo this tells you how many sheets are still in each input tray/cassette in a printer
echo date ,time ,envelope ,tray1 ,tray2 ,tray3 ,tray4 ,pagecount >> prn-%prnip%-%curyear%.csv


:appendfile
rem this is for a printer with 4 regular trays and a "multi-purpose" tray, you
rem many need to change this a bit if your printer hardware is a little different
rem this is based on code from
rem http://exchange.nagios.org/directory/Plugins/Hardware/Printers/SNMP-Printer-Check/details
for /f "tokens=4" %%c in ('%snmpexe% -v1 -c public %prnip% 1.3.6.1.2.1.43.8.2.1.10.1.1') do set tray0=%%c
for /f "tokens=4" %%c in ('%snmpexe% -v1 -c public %prnip% 1.3.6.1.2.1.43.8.2.1.10.1.2') do set tray1=%%c
for /f "tokens=4" %%c in ('%snmpexe% -v1 -c public %prnip% 1.3.6.1.2.1.43.8.2.1.10.1.3') do set tray2=%%c
for /f "tokens=4" %%c in ('%snmpexe% -v1 -c public %prnip% 1.3.6.1.2.1.43.8.2.1.10.1.4') do set tray3=%%c
for /f "tokens=4" %%c in ('%snmpexe% -v1 -c public %prnip% 1.3.6.1.2.1.43.8.2.1.10.1.5') do set tray4=%%c
for /f "tokens=4" %%c in ('%snmpexe% -v1 -c public %prnip% 1.3.6.1.2.1.43.10.2.1.4.1.1') do set pgcount=%%c

echo %date% ,%timer% ,%tray0% ,%tray1% ,%tray2% ,%tray3% ,%tray4% ,%pgcount% >> prn-%prnip%-%curyear%.csv

goto end

:usage
echo usage: input-tray-count.bat ip-of-printer
echo this requires snmpwalk in the specified location
echo this will tell you how many sheets you have left in each input tray/cassette in a printer

:end

Monday, March 18, 2013

company CA without a cert server

For those who administer a network, sometimes you need to create a root certificate.  This can be for an internal web-server, or for deploying internal software, or for other reasons.  In many places you have a server setup who's sole purpose it get generate SSL and maybe other certificates for the company.  If you don't wan't to dedicate an entire server to this task though because you don't need to be constantly generating new certificates there is an alternative.

OpenSSL is an open source program (hence the Open part), that allows you to generate SSL certificates, everything from a root certificate (for your company root CA), to a regular certificate that's signed by the root CA.

If you're on a linux machine do your usual apt-get install openssl or yum install openssl, and skip the next paragraph for windows.

If you're on windows, you'll need to go to: http://www.openssl.org/related/binaries.html, and follow the links till you can download the openssl binary (full version) for window at  http://slproweb.com/products/Win32OpenSSL.html (you may need to download and install the visual C++ redistrutable).  You'll also want to add c:\openssl-win32\bin to your system's path or have the DLL's installed to the c:\windows\system32 directory.

To create a root certificate go to the c:\openssl-win32\bin directory and type:
openssl req -nodes -new -x509 -keyout my-ca.key -out my-ca.crt -days 3650 -config openssl.cfg
-leave the e-mail address blank.
-the above root ca will be valid for 13 years.

make the following directories, demoCA, demoCA\newcerts, and demoCA\private
under c:\openssl-win32\bin?
so you should have c:\openssl-win32\bin\demoCA\newcerts as one of your paths



move the *-ca.crt file to demoCA
the *-ca.key file to demoCA\private
in the openssl.cnf file go to the CA_default section and make sure that private_key = $dir/private/my-ca.key
and change certificate = $dir/my-ca.crt
(change my-ca.key to whatever you typed in the openssl command above)


type echo 01 > \demoCA\serial
and in explorer navigate to the demoCA folder and create a new text file
and name it index.txt (don't put anything in it).



to create server certificates for wsus:
openssl req -nodes -new -keyout servername.key -out servername.csr -days 1825 -config openssl.cfg
for Common Name enter servername.company.com
leave email address blank, and hit enter for challenge password and optional company name.

then sign it using the ca (certifies for 5 yesrs)
openssl ca -out server.crt -in server.csr -days 1825 -config openssl.cfg

then export it to pfx format for iis:
openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt -certfile my-ca.crt
type in a password for the pfx
ignore message about "unable to write 'random state'