Convert SCSI Tape Auto-Loader to iSCSI Target

Hi All. We're currently in the process of re-evaluating our server backup process. Currently we're using Backup Exec 11d to backup all our server as though they are all physical servers, performing Full/incremental jobs directly to our Adic Faststor 2 Autoloader.

What we're looking at is upgrading to Backup Exec 12.5, and moving to a backup-to-disk-to-tape solution where we have an online copy of the data on disk, and offload to tape at the end of the month for off-site storage.

As part of this, we want to virtualize our backup server. Using an iSCSI target as the location for our online backup is easy enough, but I'm having trouble getting info about iSCSI solutions for the tape offload. As a way to try and keep costs down, I was curious if we'd be able to use a SCSI-to-iSCSI bridge to convert our existing tape autoloader until a later date when we can get additional budget. i.e. Would something like this (http://www.quantum.com/Products/Connectivity/Index.aspx) work for us?

Has anyone else tried to use a bridge in this type of scenario?

From serverfault Evan M.

• I haven't used a bridge, but I have done this using the ietd software iscsi target stack, and a patch to allow raw IO. This may be a viable option for you

  Notes on this are available at www.wlug.org.nz/iSCSINotes. Key points are to export both the loader and the tape device as separate LUNs under the same target.

  There's more on the actual patch process, including some additional notes about a newer patch required for newer kernel / ietd versions at www.wlug.org.nz/XenNotes.

  dyasny : is the same possible using tgtd instead of ietd?

  Daniel Lawson : dyasny: I haven't tried myself, but I have heard that it does not work. (There's a few howto type pages that suggest it does, but in a vague enough manner that I suspect the authors just assumed it would, as none of them actually go into any detail regarding tape)
  From Daniel Lawson

Outlook Anywhere Credentials on SBS08

I'm running SBS08 and have some clients using Outlook Anywhere (combination of Outlook 2003/2007) to access the Exchange Server.

The users are currently prompted for their domain usernames/password every time they start up Outlook (there is no "Save this password" prompt). Is there a way to configure the server or clients so that the user credentials are somehow cached/remembered?

From serverfault Brad Leach

• 1. The user must be logged into the PC with an Active Directory account
  2. The primary mailbox that they are accessing must be the same one as the account they are logged in as.

  If both of the above are not true, then you will have to enter a password to access Outlook. However, if the above is true and you still have problems, more issues may be at play.

  taspeotis : Outlook Anywhere is RPC over HTTP. See my answer as to how you can save the password.

  Wesley 'Nonapeptide' : I know Outlook Anywhere is RPC over HTTP, but in my experience the user you log in as and the mailbox you attempt to connect to will cause this symptom of the credentials being asked for.

  taspeotis : The question isn't why this happens, it's "Is there a way to configure the server or clients so that the user credentials are somehow cached/remembered?". I don't see where you answered that question.

  Wesley 'Nonapeptide' : Ah ha. I see the nuance now. I suppose I looked at the problem a bit deeper. Instead of answering how to cache credentials, I tried to address why the authentication dialog box popped up in the first place.

  Brad Leach : Thanks Wesley. The computers which I am running Outlook Anywhere are not connected to the domain.

  Wesley 'Nonapeptide' : If your PCs were on the domain and users were logging in via domain credentials, then Basic or NTLM credentials would not matter and Outlook would open without asking for credentials. However, I now realize that my answer isn't quite addressing your specific question.
  From Wesley 'Nonapeptide'

• Use NTLM authentication then edit this registry value. Users can then save the password.

  Brad Leach : Thanks! I will look into this solution.
  From taspeotis

Administrator password reset in Windows Server 2008

I lost my password for Windows Sever 2008. Does anyone know how to reset the admin password?

From serverfault $pageUsers[$entry.posts[0].author].name

• From another admin account net user UserName NewPassword

  Or you can use one of the many bootable NTFS password reset utilities

  This assumes that the machine is in a workgroup and not a domain.

  From MarkM

• You can reset or recover your password in a number of ways. The three most prominent that come to my mind are:

  1. Boot into a Linux Live CD and replace the magnify.exe tool with cmd.exe. Then reboot into Windows and reset the password after using the Accessibility tools that are available at the login screen. More information here: http://blogs.thecodearchitects.com/?p=196
  2. Use a password recovery tool like John the Ripper's Windows CD to brute force reveal the existing password: http://www.openwall.com/passwords/microsoft-windows-nt-2000-xp-2003-vista
  3. Use a pasword reset utility such as the ones found on the Ultimate Boot CD. Be warned, however, that utilities which attempt to replace passwords from a boot environment have been known to cause more problems than they are worth.
  From Wesley 'Nonapeptide'

• Edit: never mind, i like the magnify.exe switcheroo trick. Although i'm particularly partial to this one if the target has a firewire port

  If you know your directory services restore mode password, you can that to change the administrator password, this password is supplied at install time.

  Press F8 during the textmode boot phase and select Directory Services Restore Mode.

  Failing that, if you're on a domain, you'll probably have to rebuild the pdc and active directory domain.

  If that is the case, consider its a lesson the hard way.

  1. Can't stress enough the importance of regular backups, and testing those backups semi-regularly. We all know its a PITA but it will save a much bigger pain. I'd also avoid ntbackup.
  2. Document everything. Update it when you change anything. It's all about dotting your i's and crossing your t's.
  From fenix

Linux distribution for VPN router with VLANs support

I need to build a router with following requirements:

1. 2 physical interfaces (WAN and LAN)
2. Should be able to handle several VPN tunnels
3. VPN tunnel should be routed to certain VLAN
4. Web-based GUI

What Linux distribution can I use as start? Or maybe there is a distribution that fits my needs already?

From serverfault Syndicut

• Well, from personal experience I can recommend Vyatta, which is a Linux based Router, Firewall, VPN and can do much more. Vyatta also sells the hardware and software.

  But my personal favorite is pfSense. pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall, VPN appliance and router<taken from the pfSense site>.

  You did not say anything regarding the expected load on the system, will the system be for a large company, small business, or personal. You could buy a server from a vendor with no OS, or use a desktop. If this is for a small business I had good luck with the ALIX system boards.

  nedm : +1 for pfSense - you can fire up multiple OpenVPN server instances (we use one for each remote office and route accordingly) or use the PPTP or IPSec VPN servers that are also built in. Meets all the OP's requirements, is easy and intuitive to install and set up, has a decently large community of users and best of all is free.

  3dinfluence : I just installed a ALIX based pfSense firewall at my church where I help out with IT. So far it's worked out better than the Cisco PIX 501 for a few reasons. PIX is EOL'ed by Cisco....don't have to worry about with an open project. Cisco's VPN client has limited OS support these days as they are trying to push people to their SSL solution. And it's much easier to manage which is a plus in a team of volunteers that have a range of skill levels when it comes to dealing with networking.
  From Luis Ventura

I need to rewrite https://domain.com => https://www.domain.com because of wildcard SSL

Hey

Like the subject says I need to rewrite https://domain.com => https://www.domain.com. But I have a wildcard SSL setup for the domain and the root domain does not match *.domain.com, thus the browser brings up an error

domain.com uses an invalid security certificate.

The certificate is only valid for *.domain.com

This is my current vhost config

<VirtualHost 127.0.0.1:443>
        ServerAdmin user@domain.com
        DocumentRoot /usr/local/app/domain/webapps/www
        JkMount /* somestuff
        ServerName domain. com
        ServerAlias www.domain.com 
        ErrorLog logs/domain.com-error_log
        CustomLog logs/domain.com-access_log combined
        Customlog logs/domain.com-deflate_log deflate
        RewriteEngine on
        RewriteCond %{HTTP_HOST}   ^domain\.com [NC]
        RewriteRule ^/?(.*)         https://www.domain.com/$1 [L,R,NE]
        SSLEngine on
        SSLCertificateFile /etc/httpd/conf/ssl.crt/x.domain.com.crt
        SSLCertificateKeyFile /etc/httpd/conf/ssl.key/x.domain.com.key

</VirtualHost>

I was hoping that the RewriteEngine would kick in before the SSL is loaded but doesn't work. Is this solvable without getting a new cert that is just for the root domain ?

From serverfault Snorri

• Unfortunately the name that the client is talking to is checked against the certificate by the client, not the server. As far as the client is concerned it is talking to domain.com not <something>.domain.com - it will be unaware of any URL rewriting that is being done at the server end.

  So you will need an extra certificate for the other name to avoid certificate errors.

  serverninja : This is correct. SSL negotiation will always happen first.

  Olaf : One could argue that it's rather "fortunate" that the client checks itself, not unfortunate. If the redirect could happen prior to SSL negotiation, traffic would obviously not be encrypted and a man in the middle could redirect the client anywhere they want to. This extra certificate usually costs money, which is unfortunate :)

  Olaf : Also, you might be able to get both, the wildcard and the toplevel domain in just one certificate - see the answers to http://serverfault.com/questions/87005/can-i-buy-just-one-ssl-cert-for-a-subdomain. I've not tried that, but this way you could work with just one certificate (and on the same IP address) instead of requiring an extra IP address just for the top level address.

  David Spillett : I agre, but it is unfortunate for the person asking the question as it impacts what is trying to do (serve both addresses so redirection works smoothly but with one certificate). Security is a GoodThing(tm), unfortunately being secure isn't always convinient.
  From David Spillett

• The host headers are (normally) not visible without terminating the SSL connection, so the certificate needs to be valid for whatever the client is entering... you could rewrite http://domain.com to https://www.domain.com though (why the heck did the comment code remove the www. when it made the examples into an url for? ^^)

  From Oskar Duveborn

Replication sync failing; Publisher out of Identity ranges.

I have Merge Replication set up with a SQL 2005 Publisher/Distributor and roughly 100 SQL 2005 Express Subscribers. Everything was working fine for months and now all of a sudden everyone is getting the below errors.

I have been Googling around but to no avail. Can anyone offer some insight? I even tried deleting a user's Subscription. I also tried running -->

sp_adjustpublisheridentityrange @publication='MyDB'

Anyway, here are the errors -->

Error messages:
The Publisher failed to allocate a new set of identity ranges for the subscription. This can occur when a Publisher or a republishing Subscriber has run out of identity ranges to allocate to its own Subscribers or when an identity column data type does not support an additional identity range allocation. If a republishing Subscriber has run out of identity ranges, synchronize the republishing Subscriber to obtain more identity ranges before restarting the synchronization. If a Publisher runs out of identit (Source: MSSQL_REPL, Error number: MSSQL_REPL-2147199417)
Get help: http://help/MSSQL_REPL-2147199417
Not enough range available to allocate a new range for a subscriber. (Source: MSSQLServer, Error number: 20668)
Get help: http://help/20668
Failed to allocate new identity range. (Source: MSSQLServer, Error number: 21197)
Get help: http://help/21197

From serverfault Refracted Paladin

• First, are your machines patched with at least Service Pack 3? This error was often thrown by a bug fixed by Service Pack 2 Cumulative Update 4. That may be a place to start.

  If you are all patched up, I'd next check the data type of your identity columns. If they are currently INTs, for example, and the publisher is trying to allocate a range that exceeds the maximum INT value (2,147,483,647), you would get that error. You could resolve it by changing your identity field to a BIGINT. With 100 subscribers, your publisher has had to allocate a large number of ranges, so this could be likely.

  Hope this helps.

  Refracted Paladin : Are there any known issues with upgrading systems currently in a Replication Topology to Service Pack 3 from 2? Thanks.

  Brian Knight : I've not seen any. I've upgraded systems using all three types of replication from SP2 to SP3 and have had no issues at all. Of course, I always recommend testing in a QA environment first ;). Here's the link to the KB article for that fix: http://support.microsoft.com/default.aspx/kb/941989
  From Brian Knight

SBS 2003 R2 install errors

I just installed sbs2003 R2 as a learning lab box on my home network. The install seemed to take quit a while with a bit of shuffling between disks 4 and 5. The continue setup checklist showed the red x besides the exchange install and finally gave me an error about the "schema needing extending run, forest /adprep" and told me at the end that the install did not succeed. After a longer than normal reboot it comes up and seems to be OK.

What logs do i need to check to see what went wrong?

Should i reinstall and try burning the iso's to new media?

cheers

From serverfault piagetblix

• Sounds like its stopped somewhere at the end of the install (while populating the exchange database). Being a learning lab box, it shouldn't be too much or a worry.

  I build a 2k3 SBS R2 playing box last week and didn't run into any errors like that. Check the event logs (Application and System), they might explain something. If all else fails, try reinstalling again. It is only a learning box, and I think I re-installed mine countless times over the years trying new things.

  "Should i reinstall and try burning the iso's to new media?" Being the SBS series was never released as a downloadable ISO (like all there other os's) than you could also have a bad ISO. Might I suggest trying to play in a Virtual Machine environment? You can then mount the ISO's instead of needing to burn 5 CD's VMWare Server is free, and so is ESXi.

  Hope that sort of answers your question in a round about way!

  piagetblix : "Being the SBS series was never released as a downloadable ISO (like all there other os's)" The ones I am using came from Technet where they are available as ISO's. Don't really want to use a VM yet(im using a basic dell desktop pc and i know esxi will not boot from it) I may eventually get there when i can put together a more dedicated system. I have reburned the disks at 1x and verified and will give the reload another shot. Thanks!

  Rod : Technet, of course! Dont they have a DVD copy of SBS R2 on there? would save burning 5 cd's. ESXi 4 is very strict on the HCL side of things, but 3.5 is more flexible. I've got 2 ESXi 3.5 machines in old P4-3Gh HT's with 2/4G ram and only 80gb sata's. Off the original subject and question a bit. We'll see how you go with the reinstall... let me kow how you go, I'll be interest to know if it happens again.

  piagetblix : @Rod Did the re-burn of the disks and the reinstall went good, no errors. I did not install exchange this time though. Perhaps I will add it later. I'm planning on jumping into the esxi realm soon, just waiting for a buddy who said he can get me an old hp rack server with scsi disks for free!! And no technet does not have a dvd! only cd images...beats me I guess they figure you'll use server 2008 and haven't bothered to update the iso's. cheers!
  From Rod