Setup Shell limits for Oracle user in Linux

Add lines to /etc/security/limits.conf
oracle soft nproc 2047
oracle hard nproc 16384
oracle soft nofile 1024
oracle hard nofile 65536

Above values depend on your environment.

Add following script to /etc/profile.local
if [ $USER = “oracle” ]; then
if [ $SHELL = “/bin/ksh” ] ; then
ulimit –p 16384
ulimit –n 65536
else
ulimit –u 16384 –n 65536
fi
fi

Have a nice day!

Transfer files between Unix/Linux with SCP

The scp command can be used in three ways: 1. to copy from your computer to a remote server 2. to copy from a remote server to your computer, and 3. to copy from a remote server to another remote server.

copy from your computer to a remote server:

# scp examplefile user_id@your_server:/home/user_id/

copy from a remote server to your computer

# scp user_id@your_server:/home/user_id/examplefile .

copy from a remote server to another remote server

# scp user_id1@server1:/home/user_id1/examplefile user_id2@server2:/home/user_id2/

Putting'' an entire directory


# scp -r dir1 user1@server1:/MyRsrch/dir2/

``Getting'' an entire directory


ucsu> scp -r user1@server1:dir1/09  /dir2/r9/



Have a nice day.

Certificate request and import with Keytool commands

These commands allow generating a new keystore file, creating a CSR, and importing certificates. Any root or intermediate certificates will need to be imported before importing the primary certificate for your domain.

• Generate a Java keystore and key pair
keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048
• Generate a certificate signing request (CSR) for an existing Java keystore
keytool -certreq -alias mydomain -keystore keystore.jks -file mydomain.csr
• Import a root or intermediate CA certificate to an existing Java keystore
keytool -import -trustcacerts -alias root -file Thawte.crt -keystore keystore.jks
• Import a signed primary certificate to an existing Java keystore
keytool -import -trustcacerts -alias mydomain -file mydomain.crt -keystore keystore.jks
• Generate a keystore and self-signed certificate
keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048

Java Keytool Commands for Checking
If you need to check the information within a certificate, or Java keystore, use these commands.

• Check a stand-alone certificate
keytool -printcert -v -file mydomain.crt
• Check which certificates are in a Java keystore
keytool -list -v -keystore keystore.jks
• Check a particular keystore entry using an alias
keytool -list -v -keystore keystore.jks -alias mydomain

Other Java Keytool Commands

• Delete a certificate from a Java Keytool keystore
keytool -delete -alias mydomain -keystore keystore.jks
• Change a Java keystore password
keytool -storepasswd -new new_storepass -keystore keystore.jks
• Export a certificate from a keystore
keytool -export -alias mydomain -file mydomain.crt -keystore keystore.jks
• List Trusted CA Certs
keytool -list -v -keystore $JAVA_HOME/jre/lib/security/cacerts
• Import New CA into Trusted Certs
keytool -import -trustcacerts -file /path/to/ca/ca.pem -alias CA_ALIAS -keystore $JAVA_HOME/jre/lib/security/cacerts

Ref: http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

Create and install new certificate using "openssl" for a Secure Apache web server

1. Assume xyz is the company and supplychain.xyz.com is website.
2. Change to the SSL directory (go for appropriate driectory for your company)
cd /etc/apache2/ssl.key
3. Create Key for the server
#openssl genrsa –out supplychain.xyz.com-server.key 2048
4. Create a certificate signing request in the following directory (go for appropriate driectory for your company)
cd /etc/Apache2/ssl.csr
#openssl req –new –x509 –days 365 –key supplychain.xyz.com.key –out supplychain.xyz.com.csr

It will ask the following parameters
Parameters: -C “supplychain.xyz.com” –c US –s Kentucky –l Louisville -o “XYZ LLC” -u “eBusiness Services” -n “supplychain.xyz.com”
5. Test the certificate contents by using “openssl x509 –text –in supplychain.xyx.com.csr –noout”

6. Send the csr file to vendor to get the new certificate
7. When CA provides certificate, rename the certificate as supplychain.crt
8. Copy this file to the following directory /etc/Apache2/ssl.crt
9. Change group memebship to Apache with “chgrp apache supplychain.crt”
10. Edit the following file :
/etc/apache2/vhosts.d/supplychain-ssl.conf

SSLEngine on

# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A test
# certificate can be generated with `make certificate' under
# built time.
SSLCertificateFile /etc/apache2/ssl.crt/supplychain.crt

# Point SSLCertificateKeyFile at the private key.
SSLCertificateKeyFile /etc/apache2/ssl.key/supplychain.xyz.com-server.key

# If your CA tells you that you need the Intermediate or Root
# certificate, install and specify it as here:
SSLCACertificateFile /etc/apache/ssl.crt/ca-bundle.crt (in our case no need to change it)

11.Restart Apache if needed
/etc/init.d/apache2 restart

Enable SSH in Soalris 10

Enable ssh root login in Solaris 10

1. Change the file /etc/ssh/sshd_config with PermitRootLogin no to replace PermitRootLogin yes
2. restart the services
#svcadm restart svc:/network/ssh:default

Configuring Telnet/FTP on Solaris

Configuring Telnet/FTP to login as root in Solaris

Make sure that you NEVER configure your production servers for this type of login because its bad security practice:

Configure Telnet for root logins
Simply edit the file /etc/default/login and comment out the following line as follows: # If CONSOLE is set, root can only login on that device.
# Comment this line out to allow remote login by root.
#
# CONSOLE=/dev/console

Configure FTP for root logins
First remove the 'root' line from /etc/ftpd/ftpusers.
Also, don't forget to edit the file /etc/ftpd/ftpaccess and comment out the 'deny-uid' and 'deny-gid' lines. If the file doesn't exist, there is no need to create it.

Have a nice day!

Smoothly transition from Exchange Server 2003 to Exchange 2010

I have found this useful article on Exchange migration on web. When migrating from Exchange Server 2003 to Exchange Server 2010, you can't perform an in-place upgrade to Exchange Server 2010. Microsoft requires that organizations perform a clean Exchange Server 2010 installation onto a separate server and then to migrate mailboxes and public folder content to the new Exchange 2010 server.

This means that you'll need Exchange Server 2003 and Exchange 2010 to coexist either short-term -- a couple of hours -- or long-term. In either case, coexistence can be difficult because Exchange Server 2003 and Exchange 2010 are very different. This tip explains some of the key differences between the two versions and some of the tasks you'll have to perform as part of the transition.

Active Directory issues

Before deploying Exchange Server 2010 in an Exchange 2003 organization, you must prepare Active Directory and existing Exchange servers. This process isn't too labor-intensive; however, it does involve making a few irreversible changes to both Exchange and Active Directory. It's good practice to backup of all your Exchange servers and at least a couple of your domain controllers before starting.

You'll have to perform some the following configuration tasks:

• Verify that any domain containing users with Exchange server mailboxes are set to Windows Server 2003 domain native mode.
• Make sure that all of your global catalog servers are running Windows Server 2003 SP1 or higher. It's also acceptable to run Windows Server 2003 R2 or Windows Server 2008.
• Ensure that your Active Directory schema master is running Windows Server 2003 SP1 or higher. Again, Windows Server 2003 R2 or Windows Server 2008 is acceptable.

Check that any domain controller that's hosting a flexible single master operations role is running at least Windows Server 2003 SP1.

• Set the Active Directory forest to Windows Server 2003 forest functional level.
• Remove any Exchange 2000 or Exchange 5.5 servers from your organization and set the existing Exchange server to native mode.

Disable link state updates

Exchange Server 2003 uses link state updates to keep track of which routes are used for to communicate between routing groups; however, Exchange Server 2010 doesn't use link-state updates. In smaller organizations, this architectural difference doesn't pose a problem; Exchange 2003 will continue to use link-state information. Exchange 2010 servers will ignore link-state updates.

In larger organizations, there are often multiple Exchange Server 2003 routing groups. You may have to create multiple routing group connectors between Exchange Server 2003 and Exchange 2010. In these situations, you must suppress minor link-state updates or routing loops may occur.

To disable minor link-state updates, modify the registry on each Exchange 2003 server. But this can be dangerous; making a mistake can often destroy Windows and Exchange Server.

To suppress link-state updates, open the Registry Editor and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RESvc\Parameters

Right-click on the Parameters container and select the New | DWORD Value command. Name the new parameter SuppressStateChanges and assign it a value of 1. To finish, close the Registry Editor and restart the SMTP service, the Microsoft Exchange MTA stacks service and the Microsoft Exchange routing engine service.

Ref: SearchExhange.com

19 May 2010 | Brien Posey, Contributor

http://searchexchange.techtarget.com/generic/0,295582,sid43_gci1512791,00.html?track=NL-359&ad=767559&asrc=EM_NLT_11650090&uid=980702

Have a nice day!