Powershell - List users belonging to VM console access groups

As part of the upgrade from vSphere 4.1 to 5 we needed a list of users who access the VI via a shortcut (mainly external Third Party's) so we could contact them and explain how they can access the console in vSphere 5 (Web Client).

Each VM that requires other staff, or Third Party's, to access the console has an AD group created with the appropriate Virtual Center permissions. Each AD group is then populated with the appropriate accounts.

The first thought was just to have a script that listed the user account plus email address but no Group listing. The drawback to this was that external accounts didn't have any email accounts listed and it didn't list which VM the user needed to access.

New approach was to identify and list the Group in the output along with Users names. This would enable us to contact the Application Support people and explain the change and how to now connect. Then they would pass this information onto their Third Party suppliers.

Script

import-module activeDirectory
$vmwareGroups = get-adGroup -filter 'name -like "VMware*Console Access"'

## output object
$output = @()

$vmwareGroups | foreach {

    $groupName = $_.name   
    $groupMembers = $_ | get-adGroupMember
    $groupMembers | foreach {
        $memberName = $_.name
        $obj = new-object System.Management.Automation.PSObject
        $obj = $obj | add-member -memberType NoteProperty -name groupName -value $groupName -passthru
        $obj = $obj | add-member -memberType NoteProperty -name userName -value $memberName -passthru
        $output += $obj
    }
}

$output | export-csv "c:\vwmareGroups.csv" -NoTypeInformation

Thanks go to Klaas Vandenberghe (powershell.org) who helped with the initial script then one of my colleagues, Damian Shiell, who created the final script.

Solaris - checking whether an account is locked or not

Recently we needed to be able to check what the account status on one of the servers was as there was an access problem.

Was it locked out? How do we check from a terminal session?

# passwd -s <account_name>

This comes back with the accounts status. In this instance it came back with:

# <account_name> LK

Status information:

PS = a normal working account.
LK = locked out account.
NP = account has no password.

Okay, so the account is locked. How do I unlock it?

# passwd -u <account_name>

Account is now unlocked - now to find the script that locked the account in the first place......

NOTE: If you want to lock the account on purpose

# passwd -l <account_name>

Solaris - Projects

Had to apply a Project to an account so that Oracle could be installed. 4Gb of memory was required:

Steps:

1. Create the user account (oracle)
2. Apply project settings


# projadd -U oracle -K "project.max-shm-memory=(privileged,4096,deny)" 'user.oracle' 

# projmod -s -K "project.max-sem-nsems=(priv,256,deny)" user.oracle

# projmod -s -K "project.max-sem-ids=(priv,100,deny)" user.oracle
# projmod -s -K "project.max-shm-ids=(priv,100,deny)" user.oracle

3. Check settings

# projects -l 
or
# cat /etc/project

I found a useful article where they applied the same settings but to a group.

Solaris - adding a Legal Warning message

Creating a Legal Warning message:

1. Create the file with appropriate text.

# vi /etc/issue

###########################################################
#                                                                                                                  #
#    Use of this computer system (including email and internet access)             #
#    is monitored and recorded. Unauthorised or improper use may result in    #
#    disciplinary action, which could lead to criminal prosecution.                     #
#                                                                                                                 #
##########################################################

2. Edit the sshd_config file.

# vi /etc/ssh/sshd_config


Remove the comment from the line:


# Banner to be printed before authentication starts
# Banner /etc/issue

3. Restart the ssh service.

# svcadm restart /network/ssh

4. Log in to test

Windows 7 - Configuring remote access

Well, had a new Windows 7 build provided the other day which is all nice and shiny - but......

Now going through the "I used to configure this via......" which occurs with every change of the MS Operating System.

In this case I wanted to log into my PC remotely to do some work and while testing the connection I got this error message:

"The connection was denied because the user account is not authorized for remote login"

Googled and came across this link which was just what I was after......

An extract of which is:

"Remote Desktop is not enabled by default. You must specifically enable it to allow remote access to the workstation. When it is enabled, any member of the Administrators group can connect to the workstation. Other users must be placed on a remote access list to gain access to the workstation.

To configure remote access, follow these steps:
1. In Control Panel, click System And Security, and then click System.
2. On the System page, click Remote Settings in the left pane. This opens the System Properties dialog box to the Remote tab.
3. To disable Remote Desktop, select Don’t Allow Connections To This Com¬puter, and then click OK.Skip the remaining steps.
4. To enable Remote Desktop, you have two options. You can:

• Select Allow Connections From Computers Running Any Version Of Remote Desktop to allow connections from any version of Windows.
• Select Allow Connections Only From Computers Running Remote Desktop With Network Level Authentication to allow connections only from Windows 7 or later computers (and computers with secure network authentication).

5. Click Select Users. This displays the Remote Desktop Users dialog box.
6. To grant Remote Desktop access to a user, click Add. This opens the Select Users dialog box. In the Select Users dialog box, click Locations to select the computer or domain in which the users you want to work with are located. Type the name of a user you want to work with in the Enter The Object Names To Select field, and then click Check Names. If matches are found, select the account you want to use and then click OK. If no matches are found, update the name you entered and try searching again. Repeat this step as necessary, and then click OK.
7. To revoke remote access permissions for a user account, select the account and then click Remove.
8. Click OK twice when you have finished"

In my case, due to the fact we are running Group Policies, I followed up to opening System Properties - then clicked the Remote tab and added my account into the "Select Users" area.

Solaris - Resetting the Root password

Someone decided to change the root password and not test it while having the original logged in terminal window open. So we no longer had a working root password, so what to do!!

Well, found a number of useful links which covered SPARC and x86 (which seemed to look the same to me) but nothing about ZFS until I found the Oracle guide which was almost what I wanted.......

What you need to do is remove the root password entry in the shadow file and below is how I did that:


1. First of all you need to get to the <ok> prompt and boot into single user mode - in my case a Jumpstart server is used and not a DVD.

<ok> boot net -s

2. Once booted become root - which is a simple su <enter> (Running a ZFS list at this point produces no response).

3. Import the root pool and specify an alternative mount point.

# zpool import -R /a rpool

4. At this point you can run a ZFS list (# zfs list) to see what is available (I was interested as we also use Live Upgrade here so there were a number of BEs - I did have a couple of lines stating some parts failed to mount, but the ZFS list showed that a number BEs were available.

5. Mount a BE (in this case u10test).

# zfs mount rpool/ROOT/u10test

 6. Change to the /etc directory.

 # cd /a/etc

7. Now you can edit the shadow file (well, not quite as you'll get an error stating that the system doesn't know what input device you are using.....).

# TERM=vt100
# export TERM

8. Now you can edit the shadow file.

# vi shadow

9. Okay! What do I remove?

 root:BZQ8dnry$$MOOj3d71FeSNOngAAqIwY/:15643::::::

10. Remove the entries between root: and :15643 like so...

root::15643::::::

11. Save the file.

:wq!

12. Restart the server

# init 6

13. Log into the server (we log in with a normal account then su)

!!You will not be prompted for a password!!

14. Change your root password.

# passwd root

Solaris - memstat

I wanted to check what the memory usage status of the server and stumbled across this:

# mdb -k

Loading modules: [ unix genunix specfs dtrace zfs sd mpt_sas px ldc dls sockfs ip hook neti sctp arp usba fcp fctl nca lofs md cpc random crypto fcip logindmux ptm ufs sppp nfs ]

> ::memstat
Page Summary                Pages                MB  %Tot
------------     ----------------  ----------------  ----
Kernel                     195420              1526   38%
ZFS File Data              115894               905   23%
Anon                        38070               297    7%
Exec and libs                5870                45    1%
Page cache                 130559              1019   25%
Free (cachelist)            12603                98    2%
Free (freelist)             14980               117    3%

Total                      513396              4010
Physical                   490083              3828

To exit:

ctrl-d