Error: importing EC2 Key Pair (ssh-key): operation error EC2: ImportKeyPair in to AWS EC2

Error: importing EC2 Key Pair (ssh-key): operation error EC2: ImportKeyPair, https response error StatusCode: 400, RequestID: 7ef58acb-c106-44ff-a96b-ea7c92c81f18, api error InvalidParameterValue: Value for parameter PublicKeyMaterial is invalid. Length exceeds maximum of 2048.

Solution:

You are trying to import a private key.  You need to extract the public key.  

Here is how you create the key:  ssh-keygen -t rsa -b 2048 -C "name@domain.com" -f ~/ssh-key.pem

Now to remove the public key run: ssh-keygen -y -f ~/ssh-key.pem > ~/ssh-key-pub.pem

It'll now import!

Source: Link

Joining CentOS/RHEL (6.x) to Active Directory (Windows Server Domain) [Updated]

***CASE MATTERS FOR EVERYTHING POSTED BELOW***

Install the following packages

yum install pam_krb5 pam_ldap nss-pam-ldapd samba ntp

*If you already have any of these installed, it'll skip them.

First make a backup of the config.
cp /etc/krb5.conf /etc/krb5.conf.bak

</etc/krb5.conf>

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = DOMAIN.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 DOMAIN.COM = {
  kdc = DC.DOMAIN.COM
  admin_server = DC.DOMAIN.COM
  kdc = x.x.x.x
 }

[domain_realm]
 .domain.com = DOMAIN.COM
 domain.com = DOMAIN.COM

Again backup the config
cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

You can also use system-config-authentication if you have a gui.

</etc/samba/smb.conf>
Note:  The workgroup is the left most part of the domain

[global]

workgroup = DOMAIN
password server = x.x.x.x
realm = DOMAIN.COM
security = ADS
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = No
winbind separator = +
idmap config * : backend = autorid
idmap config * : range = 1000000-19999999
idmap config * : rngesize = 1000000
template homedir= /home/%D/%U
template shell = /bin/bash

*Note*
If you don't want the users to have to type DOMAIN+username then remove the winbind separator line and change the winbind user default domain = yes.  Restart smb and winbind.

Again backup the config
cp /etc/nsswitch.conf /etc/nsswitch.conf.bak

</etc/nsswitch.conf>

passwd:     files winbind
group:      files winbind
shadow:     files winbind

Again backup the config
cp /etc/ntp.conf /etc/ntp.conf.bak

</etc/ntp.conf>
Note:  The 1.1.1.1 is the ip of your server

server 1.1.1.1 

Pick one of these ways:
1. authconfig-tui (select Winbind, click ok. Select Use Shadow Passwords, Use Winbind Authentication, Local authorization is sufficient)

2. Create the files manually.

Again backup the config
cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak

</etc/pam.d/system-auth>

auth        required      pam_env.so
auth        sufficient    pam_unix.so try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        sufficient    pam_winbind.so use_first_pass
auth        required      pam_deny.so

account     required      pam_access.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so difok=4 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 minlen=12 retry=3
password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so skel=/etc/skel umask=0644
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

</etc/pam.d/sshd>

auth       required     pam_sepermit.so
auth       include      password-auth
auth    sufficient      pam_winbind.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

Edit your /etc/hosts file
</etc/hosts>

1.1.1.1 dc.server.centos.com dc

Restart the following services:

service smb restart
service winbind restart
service sshd restart
service ntpd restart
chkconfig winbind on

*If any of those fail, you have something configured wrong.
Then run:  [root@node001user1]# kinit domainadmin@CENTOS.COM (THIS MUST BE IN ALL CAPS!)

Confirm the ticket was obtained: [root@node001 user1]# klist

Get the time from the server: [root@node001 user1]# net time

Sync the time from the server: [root@node001 user1]# ntpdate -u

Then run the following command to join it to the domain.

[root@node001 user1]# net ads join -U domainadmin (replace with your domain admin username)

Run some more tests:

wbinfo -t
wbinfo -u
wbinfo -g

getent passwd
getent groups

If any of those fail, something isn't configured correctly.

If you want the domain admins and admins to have privileged access, you need to add this to the bottom of your sudoers file.  You may have to over write the read only file to save it.

</etc/sudoers> ***NEED TO VERIFY IF THIS STILL WORKS****

[root@node001 user1]# cat /etc/sudoers

%BUILTIN\administrators ALL=(ALL) ALL
%"domain admins" ALL=(ALL) ALL

Some great additional trouble shooting commands can be found here -> Link

Also if you need to find your base dn to locate the group your user accounts are stored, I explain how to do that here -> Link

Another Great reference is here:  Link

If you have a Red Hat Subscription, they provide some good additional information:  Link

Integrating Red Hat Enterprise Linux 6 with Active Directory (Last updated 2014): Link

Link

Tested: RHEL 6.4+Windows 2k8 R2, RHEL 6.4+Windows 2k12 R2

How Do I Copy a File to a USB device in VMware ESXi 4.1

First thing is you need to enable SSH.

I already wrote how to do that here -> How To Enable SSH for ESXi 4.1

Next open an ssh program like PuTTY.

Once connected you need to run the following command as root.

/etc/init.d/usbarbitrator stop 

Note: This turns off the USB passthrough for your VMs.

At this point you can plug in the USB device.  4.1 auto mounts it so, type:

ls /vmfs/volumes/NO\ NAME/

This should show anything on the USB Device.

You can copy, delete whatever you want to do.

Source:  Link Link Link

This blog talks about how to use some of the utilities if you are coping a new vm over.

Source:  Link

Once you are done, you should turn back on passthrough by typing:


/etc/init.d/usbarbitrator start

UPDATE:  I found this does work find but for only FAT/FAT16 formatted drives.  I have no yet found a solution to use FAT32 or NTFS.

How to Enable SSH for ESXi 4.1 in vSphere

Open vSphere Client and login with the root username and password.  Once it opens..

Click the configuration tab.
Click Security Profile -> Properties
You should see Remote Tech Support (SSH)
Select Start automatically
Click Start if the status is Stopped
Click Ok -> Ok.

SSH is now enabled on ESXi.

Source:  Link Link

Joining Ubuntu to Active Directory (Windows Server 2008 R2 Domain)

**** CASE DOES MATTER IN ALL FILES AND COMMANDS ****

sudo apt-get install krb5-user winbind samba ntp ldap-utils

</etc/krb5.conf>

adm@mindtouch:~$ cat /etc/krb5.conf

 [logging]

default = FILE:/var/log/krb5.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log

[libdefaults]
        default_realm = TEST.UBUNTU.COM
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

[realms]
        TEST.UBUNTU.COM = {
                kdc = dc.test.ubuntu.com
                admin_server = dc.test.ubuntu.com
                default_domain = TEST.UBUNTU.COM
        }

[domain_realm]
        .test.ubuntu.com = TEST.UBUNTU.COM
        test.ubuntu.com = TEST.UBUNTU.COM
        .kerberos.server = TEST.UBUNTU.COM

[login]
        krb4_convert = true
        krb4_get_tickets = false

</etc/smb.conf>

Note: The workgroup is the left most part of the realm.

adm@mindtouch:~$ cat /etc/samba/smb.conf

 [global]
        log file = /var/log/samba/log.%m
        max log size = 1000
        security = ADS
        realm = TEST.UBUNTU.COM
        password server = 10.10.100.25
        workgroup = TEST
        use kerberos keytab = true
        idmap uid = 10000 - 20000
        idmap gid = 10000 - 20000
        winbind enum users = yes
        winbind enum groups = yes
        template homedir = /home/%D/%U
        template shell = /bin/bash
        client use spnego = yes
        client ntlmv2 auth = yes
        encrypt passwords = true
        winbind use default domain = yes
        restrict anonymous = 2

;Communal Files
[files]
        comment = Shared Files
        path = /Storage/
        writeable = yes

;Individual Files - sym link /home/%D to /Storage/

mkdir /Storage

chmod a+rwx /Storage

</etc/nsswitch.conf>

adm@mindtouch:~$ cat /etc/nsswitch.conf

# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat winbind
group:          compat winbind
shadow:         compat

hosts:          files mdns4_minimal dns mdns4 wins [NOTFOUND=return]
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

</etc/ntp.conf>

adm@mindtouch:~$ cat /etc/ntp.conf

server dc.test.ubuntu.com

</etc/pam.d/common-account>
adm@mindtouch:~$ cat /etc/pam.d/common-account

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#


account sufficient      pam_winbind.so
account required        pam_unix.so

</etc/pam.d/common-auth>
adm@mindtouch:~$ cat /etc/pam.d/common-auth

#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "nullok" option allows users to change an empty password, else
# empty passwords are treated as locked accounts.
#
# The "md5" option enables MD5 passwords.  Without this option, the
# default is Unix crypt.
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# You can also use the "min" option to enforce the length of the new
# password.
#
# See the pam_unix manpage for other options.

password required pam_unix.so nullok obscure min=4 max=50 md5
password optional pam_smbpass.so nullok use_authtok use_first_pass missingok

# Alternate strength checking for password. Note that this
# requires the libpam-cracklib package to be installed.
# You will need to comment out the password line above and
# uncomment the next two in order to use this.
# (Replaces the `OBSCURE_CHECKS_ENAB', `CRACKLIB_DICTPATH')
#
# password required       pam_cracklib.so retry=3 minlen=6 difok=3
# password required       pam_unix.so use_authtok nullok md5

</etc/pam.d/common-password>
adm@mindtouch:~$ cat /etc/pam.d/common-password

#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "nullok" option allows users to change an empty password, else
# empty passwords are treated as locked accounts.
#
# The "md5" option enables MD5 passwords.  Without this option, the
# default is Unix crypt.
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# You can also use the "min" option to enforce the length of the new
# password.
#
# See the pam_unix manpage for other options.

password required pam_unix.so nullok obscure min=4 max=50 md5
password optional pam_smbpass.so nullok use_authtok use_first_pass missingok

# Alternate strength checking for password. Note that this
# requires the libpam-cracklib package to be installed.
# You will need to comment out the password line above and
# uncomment the next two in order to use this.
# (Replaces the `OBSCURE_CHECKS_ENAB', `CRACKLIB_DICTPATH')
#
# password required       pam_cracklib.so retry=3 minlen=6 difok=3
# password required       pam_unix.so use_authtok nullok md5

</etc/pam.d/common-session>
adm@mindtouch:~$ cat /etc/pam.d/common-session

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).  The default is pam_unix.
#
session required        pam_mkhomedir.so umask=0022 skel=/etc/skel

</etc/pam.d/sshd>
adm@mindtouch:~$ cat /etc/pam.d/sshd

# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required     pam_env.so envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional     pam_motd.so # [1]

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Set up SELinux capabilities (need modified pam)
# session  required     pam_selinux.so multiple

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

# Standard Un*x password updating.
@include common-password

Restart the following services:
/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/samba start
/etc/init.d/winbind start

kinit adm@TEST.UBUNTU.COM (THE DOMAIN HAS TO BE ALL CAPS!)

Confirm the ticket was obtained: Type: 'klist'

Sync the type with the server: 'net time'

Join the box to the domain:  'net ads join -U adm'

**If it doesn't work, try  'net ads join -U adm@TEST.UBUNTU.COM'.  A lot of the pages I used to trouble shoot errors are posted as links at the bottom of the page.**

Restart the following services again:
/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/samba start
/etc/init.d/winbind start
/etc/init.d/ssh restart

ssh adm@mindtouch

To add Admins to the sudoers file:

</etc/sudoers>
mindtouch:/# cat /etc/sudoers

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults        env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL) ALL
www-data ALL=(root) NOPASSWD: /etc/init.d/dekiwiki

# Uncomment to allow members of group sudo to not need a password
# (Note that later entries override this, so you might need to move
# it further down)
# %sudo ALL=NOPASSWD: ALL
%BUILTIN\administrators ALL=(ALL) ALL
%"domain admins" ALL=(ALL) ALL

**This was a preinstalled box that was running the Mindtouch Core Wiki.  To set a static IP and to get the internet to work, I had to add a manual default route by typing 'ip route add default via 10.10.100.1'  This needed to run everytime I rebooted the box.  If I find a way to have it stick, I'll update this.  If you know of a way please post in the comments and I'll update the post. **

Sources:  Link Link Link Link Link Link Link Link Link Link

How to SCP from a remote host to a local Mac running OS X Lion

You must first allow ssh through.  By default it is turned off.  Navigate to:

System Preferences -> Sharing -> Remote Login -> check the box

Now after being ssh in or from a command prompt issue the following command

scp -v remote_file macuser@ipofmac:/Users/jsmith/Desktop

You will be prompted to enter your password at some point.

How to configure remote access for ASDM and SSH for an ASA 5505

Assumptions:

• ASDM is already installed
• You know the password to the ASA

Launch ASDM and click Configuration along the top bar. On the left side pane select Device Management (located on the bottom left).  Next click the + sign beside Management Access.  Next select ASDM/HTTPS/Telnet/SSH.  Click Add on the right hand side.  Select ASDM/HTTPS or SSH, inside or outside (depending on if this is for outside access (WAN) or inside access LAN).  The IP address can be a specific if you want to only allow one address or to allow all address you will want to enter 0.0.0.0.  The same logic goes for the Mask.  Click ok and click apply.  Test and if it works, select Save.  You will need to repeat this if you want too allow several IP address and/or connection types.

You will also have to generate the ssh key.  Type the following from ASDM or through a console connection to the ASA.

conf t
ca generate rsa key 1024
wr mem

**NOTE:  If you see error messages like below, then the key wasn't completed correctly or you skipped that step.***

ssh_exchange_identification: Connection closed by remote host
Fail to establish SSH session because RSA host key retrieval failed.

Source: Link

Now you need to configure the authentication piece of remote access for the connection.  On the left side select Users/AAA -> AAA Access.  Under the Authentication Tab, Check SSH and select Server Group: LOCAL.  This will allow you authenticate with a local user account on the ASA while connection through SSH.  I have not tested this authenticating it against Active Directory, but I would imagine you can do this by setting up a AAA group and selected it instead of the LOCAL group.

At the time of writing my ASA was running 8.2(1) and ASDM 6.2(1).

Setting up an ASA 5505

So I setup my first Cisco ASA.  This what I did...

First off this device has 8 Ports.  Ports Ethernet 0/1-7 are the switch ports on the device and the Ethernet 0/0 is the outside interface that will connect to your ISP.  This needs to be set for DHCP unless your ISP requires you to set a static IP.  That static IP would be given to you from your ISP.

Basically follow the guides that come with the ASA.  They will get you to setup everything up to get you started.

First thing is you should go to https://192.168.1.1/admin.  This will bring you to a page that allows you to download the ASDM software.

How to configure remote access: Link 

We had to add one line to configure the ASA to route to the ISP .

Open an SSH client and connect to your ASA's IP.
Login
Type enable
Type config t
Type interface vlan 2 (or whatever vlan your outside interface is in)
Type ip address dhcp setroute
Type exit
Type exit
Type wr mem

Once applying this, I was able to then get to the internet.

How to configure LDAP: Link 
How to configure VPN access on the ASA: Link (add later)
How to configure VPN access on the Cisco IPSec Client: Link (add later)

At the time of writing my ASA was running 8.2(1) and ASDM 6.2(1).