uCertify 117-101 Junior Level Linux Professional-I review

Recently, the folks at uCertify requested I review one of their certification test suites.
In my past experiences with certifications I've used a variety of study material, including instructor led classes, books, as well as electronic tools similar to those offered by uCertify.

I prefer instructor led classes, but a mix of books and electronic tools are also a viable option for me.

The uCertify catalog includes a wide variety of test preparation kits for a number of popular certifications, including:  LPIC, Cisco, Zend, Linux, Microsoft, etc. Given I am currently in the process of studying for my LPIC-1, I selected the Junior Level Linux Professional (LPIC-1) track, which provided me access to the 117-101 Junior Level Linux Professional-I preparation kit.

I was able to install the software quickly and easily without any problems.  The activation was also painless, which I expected.

To start out, the tool offers a variety of teaching tools including study notes and practice quizzes, which is what I was really looking forward to. Each of the components is easy to use and follow, although the navigation confused me a bit at first.

The content itself seems accurate. Much of it appears to be snippets of relevant text from the official Linux man pages, with some text with a degree less of technical jargon to it to further explain the topic at hand. There where some areas where the content was a little lacking, but it didn't happen too often.

The practice tests themselves are pretty good. They relate directly to the study material and are worded such that they are easy to comprehend. They also have the same cadence and tone that are on the actual tests.

A couple of nice features that stood out from other tools I have used in the past include the ability to select different test modes and creating custom tests. In addition, within the test itself, the ability to add notes, print items and even provide feedback are all quite helpful. Of course, it also contains other expected features such as bookmarking of questions and a summary of answers for final review prior to submitting for results. The test experience itself was quite good and provided simple methods for reviewing the results and furthering one's understanding of the subject.

Without the benefit of having taken the official exam, it is also a bit difficult to gauge the usefulness of other features such as the Test Readiness Report and Objective Readiness Report, both of which are aimed at providing insight as to how well one might perform on the official test.

Overall, the uCertify tool is a comprehensive and flexible learning tool that is definitely worth considering, specially at the $80 - $100 price point (depends on selected test). Those looking for self-paced preparation kits will find it easy to use, thorough and extremely helpful.

TL;DR
Simple installation
Good Price point
Relevant study material
Comprehensive set of tools
Different learning techniques for varying preferences
Flexible practice tests

uCertify test preparation kits are available at: www.ucertify.com

Enabling Promiscuous Mode on vSphere 4

We are in desperate need of a testing server. The testing server needs to be able to listen to the network, through port mirroring, to record VoIP calls. In the physical world this is no problem, but we don't have the budget for another physical box, especially for something as non-critical as testing a program upgrade (even though the program it self is very critical to our business).

A year ago the software vendor said that they don't support virtual environments and their product doesn't work in a virtual environment. During discussions this year however they told the truth that they simply don't know if it will work, and thus "don't support" it. I am calling it lazy. It doesn't take much these days to get a VM host going and configured for testing things out.

Well we have done the leg work for them. I have confirmed that vSphere does allow for promiscuous mode, even from the physical network. To be honest I was a little shocked to see this worked.

Here are the steps to enable promiscuous mode on your vSphere host and the guest VM.

1. Enable promiscuous mode on the virtual adapter.
   
2. Enable promiscuous mode on the vSwitch.
3. Enable promiscuous mode for the guest.
4. Enable port mirroring on the physical switch (not covered here).
5. Test capturing network data.

Now that we have the general synopsis of the procedure we can begin.

We enable promiscuous mode on the virtual adapter by logging into the vSphere Client, going to the VM Host, clicking on the "Configuration" tab, then on "Networking" in the "Hardware" section on the left. Now click on "Properties..." for the Virtual Switch.


Now enabling promiscuous mode on the vSwitch is pretty simple. Click on the "vSwitch" on the "Ports" tab, as shown below and then click on the "Edit..." button.



Now that we are editing the vSwitch properties click on the "Security" tab. Change the option for Promiscuous mode to "Accept" if it isn't already and hit "OK".


To enable promiscuous mode for the guest we need to break down to the command line. I used putty to SSH into my vSphere host, which I had previously setup. Now you need to edit the .vmx file of the guest that will be listening to the network.

# vi /vmfs/volumes/datastore1/testServer/testServer.vmx

I did a search for ethernet, so the promiscuous mode configuration would be with the rest of the ethernet config. Add the following line to the configuration file:

ethernet0.noPromisc = "FALSE"



And save when you are done. I rebooted my testServer just as a precaution, but I'm not certain it is required.

At this point everything is configured on the VM side of things. Make sure you have port mirroring enabled on your physical switch and give it a test. In my environment I commonly use Wireshark. I did my testing by pinging a server on a mirrored port.

Enabling the Administrator user in Windows 7

This is a very simple fix. The reasons to actually log on as the administrator are shrinking, but for my environment I need to log on as the Administrator user occasionally (for software patching).

1. Open up a command prompt as Administrator (not the same thing we are trying to do)
2. Run "net user /active:yes administrator"
3. Now it is a great idea to set a password for the Administrator user so we can do that right now
4. Run "net user administrator password" but replace password with something more complex similar to "Som3C0mpl3xP@$$w0rd"
5. Exit out of the command prompt.

For my situation I need to run commands as the Administrator user on other machines and need the Administrator shell. I did a lot of testing to make sure that the "Run as Administrator" doesn't work as I need.

Enabling Ping responses in Windows 7

Out of the box if you Ping a Windows 7 host you will recieve "Request Timed Out". This is because the Windows 7 firewall is blocking ICMP echo requests. If this is causing you problems and you need to open up access to ping requests it is fairly simple.

1. Go to the "Windows Firewall" in the Control Panel.
2. On the left hand side click "Advanced Settings"
3. Click on "Inbound Rules"
4. Right click on "Inbound Rules" and choose "New Rule"
5. Select "Custom (Custom Rule)" and press "Next"
6. Select the (default) "All Programs" and press "Next"
7. Change the Protocol type from "Any" to "ICMPv4"
8. Unless you want to restrict the ping response choose the option "Any IP address". (This is for your adapter.)
9. Unless you want to restrict which hosts can ping you choose "Any IP address".
10. On the Action screen ensure it is an "Allowed" connection.
11. Leave all three check boxes check on the Profile screen.
12. On the final screen, Name, give it a meaningful name such as "Echo Ping Request"
13. Finally click finish.
    

3Com Switch find Uptime

We had another incident with our VoIP phones restarting on Friday. As part of my troubleshooting efforts I needed to be 100% certain that the POE switch providing power to our phone didn't reboot.

To start there is no display uptime command in the CLI. But if you run the display version command part of the output is "Switch 4500 PWR 50-Port uptime is 6 weeks, 5 days, 2 hours, 25 minutes". This is exactly what I was looking for!

It should also be noted that the web interface for the switch shows the uptime on the device summary page.

Upgrading the Firmware on a 3com 4500 switch

Again, this is mostly for my own notes, but someone else may find it useful. Last year we purchased a 3c0m POE switch for our new VoIP phone system. This year I needed to update the firmware on it, but with only 8MB of flash drive I ran into a few problems.

First off, BACK UP EVERYTHING!

I used the TFTP method to transfer files to and from the switch. I used Solarwinds TFTP Server on my PC.

File name Prefix / Suffix

s3n / .app = 4500 application software.

s30 / .btm = 4500 boot ROM software

s3p / .web = 4500 web file (HTTP management interface)

3comOScfg.def / .def = 4500 config file

So first things first backing up via TFTP:

<4500>tftp [IP OF TFTP SERVER] put flash:/s3004_01.btm

<4500>tftp [IP OF TFTP SERVER] put flash:/s3p04_03.web

<4500>tftp [IP OF TFTP SERVER] put flash:/s3n03_03_02s56p05.app

<4500>tftp [IP OF TFTP SERVER] put flash:/3comOScfg.def

Please change these files as you see fit. Do a dir on the root directory to get the listing for your particular switch.

Now that we have that backed up we need to clean up the flash:/ drive to make room for the updates.

<4500>delete s3004_01.btm

<4500>delete s3p04_03.web

<4500>detete s3n03_03_02s56p05.app

Now we also have to empty the recycle-bin. This is where I got stuck as I didn't know a CLI could have a recycle-bin, or have never seen it done before.

<4500>reset recycle-bin

See as we now have the free space we need to get the new files we can pull them down from the TFTP server.

<4500>tftp [IP OF TFTP SERVER] get s3p02_01.web

<4500>tftp [IP OF TFTP SERVER] get s3o01_01.btm

<4500>tftp [IP OF TFTP SERVER] get s3n03_02_00s56.app

Again, you will need to use the files that are the current firmware update.

One of the last steps is to tell the switch what files to use on next boot.

<4500>boot boot-loader flash:/s3n03_02_00s56.app

<4500>boot bootrom flash:/s3o02_01.btm

Finally we will save the configuration and reboot the switch.

<4500>save

<4500>reboot

Thats it! After the switch reboots you will be running the newest software, except for the .web file. For some reason this is left out of all of the documentation that comes with the update. I didn't write down the commands I used to get it to update, and I honestly don't think they worked.

How to: Recreate Outlook Web Access Virtual Directory in Exchange 2007

Last week after another round of Microsoft update I rebooted our Microsoft Exchange 2007 server. After the reboot Outlook Web Access was no longer working. I could see in Event Viewer a bunch of errors relating to .Net 1.1 and a few other DLL files relating to authentication.

After a lot of looking around online I figured out a few things.
You cannot install .Net 1.1 on the OWA server. OWA requires IIS to be running in 64-bit mode (x64), while .Net requires 32-bit mode (x86). So I un-installed the .Net framework since I didn't need it any how and rebooted.

Things still where not working, so I tried to delete the Virtual Directory right from the IIS admin screen. That didn't work so I restored the Virtual Directory from a back up I had made right before (Trust me this is always a good idea!).

I also found out that with good examples and the proper references that the new PowerShell interface for Exchange is very powerful. However I am still looking forward to Exchange 2007 SP1 when Microsoft brings some things missing from the GUI back.

Today I found the proper way to recreate the Virtual Directory.
Step one is to view all of the Virtual Directories on the server.
Get-OwaVirtualDirectory will display a list of all the Exchange Virtual Directories on that server. The one you are looking for here is "OWA (Default Web Site)" on a default install.

Step two is to remove the default OWA Virtual Directory with:
Remove-OwaVirtualDirectory -identity "owa (Default Web Site)"

The next step is to recreate the OWA Virtual Directory with:
New-OWAVirtualDirectory -OWAVersion "Exchange2007" -Name "owa (Default Web Site)"

Now go into the Exchange 2007 Management Console and setup the correct internal and external URLs and any other settings you may have changed the first time around. One of the changes I recommend is on the "Authentication" tab the Logon Format for Forms based authentication to "User name only" and then setting the domain. This will make it easier for your users to login by not having to remember the domain or typing domain\username.

Microsoft Exchange TCP/IP Ports List

This is just going to be a list of all the TCP & UDP IP ports that you could possibly need to use (or open in your firewall(s)).

TCP port 25 - SMTP
TCP port 26 - SSL secured SMTP
TCP port 110 - Post Office Protocol v. 3 (POP3)
TCP port 995 - SSL secured POP3
TCP port 143 - Internet Message Access Protocol v. 4 (IMAP4)
TCP port 993 - SSL secured IMAP4
TCP port 80 - HTTP for Outlook Web Access
TCP port 443 - SSL secured HTTP for Outlook Web Access (HTTPS)
TCP/UDP port 389 - Lightweight Directory Access Protocol (LDAP)
TCP port 3268 - LDAP communications with an Active Directory Global Catalog Server
TCP port 119 - Network News Transfer Protocol (NNTP)
TCP port 563 - SSL secured NNTP
TCP port 135 - Remote Procedure Protocol (RPC) however it will also use ports 1024 and up as needed.
TCP/UDP port 53 - Domain Name System (DNS)
TCP port 102 - Mail Transfer Agent (MTA) *Only used in X.400 connections.
TCP/UDP port 88 - KERBEROS
Additionally if you are secureing any servers such as front-end / back-end servers with IPSEC you will need to allow IP protocol 51 for the Authenitcation Header, IP protocol 50, TCP/UDP port 88 for KERBEROS, and UDP port 500 for Key Exchanges.

That's a pretty decent sized list "JUST" for one network service. On the plus side most of those are not needed in a default setup as POP3 and IMAP4 are rarely used in a pure Microsoft network.

Also hopefully this will help me remember some of the less used ports and let me ace my test!

-EDIT: Thanks to the commenter I updated this post to have the correct Global Catalog server port.

Microsoft Settles TestKing Case

Microsoft has settled their suit with leading "braindump" site TestKing.com. This will hopefully be the start of other braindumps going down as well. For those of you that don't know, or haven't taken a certification test, you must agree to a Non-Disclosure Agreement (NDA) to not discuss or disseminate the material in any way out side of the testing room. This is to protect the value of the certifications. Read more about the settlement here.