Install Packages on OpenBSD 4.x and OpenBSD 5.x

To install binary packages on OpenBSD, the package manager needs to have the correct download URL.  This URL changes based on OpenBSD version and architecture.  Here is how to set it independently:

export PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(machine -a)/

Once that is done, the pkg_add command will work. In fact all pkg_* commands will work.


OpenVPN connects, but no ping

OpenVPN connection issue on Windows Vista and Windows 7

 

Problem

When connecting to an OpenVPN tunnel on Windows Vista or Windows 7, the OpenVPN GUI shows the connection as successful, but the protected network can not be reached.

Solution

Start OpenVPN as administrator. This is necessary even of the account launching OpenVPN is an administrator level account. If the OpenVPN GUI is already running, quit the application. Before launching OpenVPN GUI, right click, and select “Run As Administrator”.

There is a way to make this permanent in the Windows application properties:

Right click on the OpenVPN GUI icon, then click on Properties, and on the Compatibility tab. Tick the “Run this program as an administrator box.”


Installing a Secure Certificate on IBM Smart Business Server (VERDE)

At the time of this writing, the IBM Smart Business Server’s control panel doesn’t allow importing a secure certificate (SSL cert). Never-the-less it is possible to install a valid (CA signed) secure certificate from the command line. This article assumes that the reader is familiar with SSL and the basic SSL KEY, CSR, and CRT generation step. We are therefore picking up at the point where you have an SSL KEY as well as an SSL CRT. You will also need a machine that has openssl installed (any Linux or Mac box will do). In fact the smart business server itself has openssl installed, as well as keytools, so all the steps can be performed directly on the smart business server.

Please note that this is a draft document, and work in progress. At this time only the public facing websites have been successfully set up with a CA signed certificate.

  • The Apache configuration file for the setup wizard is:/etc/apache2/httpdWSW.conf
  • The Apache configuration file for the intranet is here:/etc/apache2/httpdInt.conf with the corresponding SSL configuration here: /etc/apache2/extra/httpdInt-ssl.conf
  • First copy the new key and cert (in the same file, key goes on top and then the cert) into /etc/opt/ibm/bbp/smartcontainer/httpdWSW.cert
  • (Optional, this step hasn’t been successfully tested, because a non-RFC compiant method is used.) To create an RFC compliant PKCS8 version of the key pair where the intranet config file is expecting it:
    cd /etc/opt/ibm/bbp/
    openssl pkcs8 -topk8 -inform PEM -nocrypt -in smartcontainer/httpdWSW.cert -out PKCS8.cert
  • Make sure the CA bundle is made available and properly reference in the above mentioned config files (cp path/to/sf_bundle.crt smartcontainer/)
  • Create a PKCS12 version of your certificate:
    openssl pkcs12 -export -chain -CAfile sf_bundle.crt -in '<your>.crt' -inkey '<your>.key' -out PKCS12.cert -name <name> -passout pass:111111
    (at the time of this writing, the default cert store password hard coded in the VERDE install is 111111)
  • Location of the Java SSL Keystore: /etc/opt/ibm/bbp/SSLkeystore
  • Location of the [SAFEv3] encription tool:/opt/ibm/bbp/saf/encryptPassword.sh
  • Password retrieval command:/opt/ibm/bbp/saf/lib/security/manageAdminCreds -f get -a JavaKeyStore2048BitKey -i 1
  • Create a new keystore based on the PKCS#12 cert:
    keytool -importkeystore -destkeystore SSLkeystore.new -srckeystore PKCS12.cert -srcstoretype PKCS12 -alias <common_name_of_SSL_cert>
  • Update the Keystore configuration reference in /opt/ibm/bbp/saf/cfg (use the password retrieved above).
  • Copy the PKCS#12 cert to the VERDE Tomcat cert store:
    cp PKCS12.cert /var/lib/verde/host.p12
    cp /var/lib/verde/host.p12 /usr/lib/verde/etc/host.p12
    (Make sure you save your previous copies of any file you modify.)

At this point, you have to restart the system, to make sure that all public services get the proper certificate loaded on boot. If you prefer, you can restart the services:

  • /etc/init.d/lwi restart
  • /etc/init.d/simpleAgent_d restart
  • restart the VERDE software from the web console

References

  • http://conshell.net/wiki/index.php/Keytool_to_OpenSSL_Conversion_tips
  • http://cunning.sharp.fm/2008/06/importing_private_keys_into_a.html
  • Many thanks to the bISV IBM support team

Sametime 8.5.1 Deployment

To deploy a Sametime environment with multiple levels of licensing, multiple Sametime servers with each respective license versions needed (Entry, Standard, etc.). The Sametime wiki has a number of useful resources to plan out a complex Sametime deployment:

  • http://www-10.lotus.com/ldd/stwiki.nsf/page.xsp?documentId=6F6353B28F5FB51185257775007AC431&action=openDocument
  • http://www-10.lotus.com/ldd/stwiki.nsf/dx/1.3_Lotus_Sametime_product_family
  • http://www-10.lotus.com/ldd/stwiki.nsf/xpViewCategories.xsp?lookupName=Learning%20Center

And here are some documents that delve into the details:

  • http://www-10.lotus.com/ldd/stwiki.nsf/dx/Chapter_2._Planning_a_Sametime_8.5.1_deployment
  • http://publib.boulder.ibm.com/infocenter/sametime/v8r5/index.jsp?topic=/com.ibm.help.sametime.v851.doc/plan/plan_topol_deploy.html

Domino 8.5.2 Adding Email Aliases

Often times people need to receive email for multiple valid variation of their email addresses. On most email systems, these are called email aliases. IBM Domino has a slightly unusual way of allowing system administrators to define aliases:

  • Open the Domino Administrator Tool
  • On the People & Groups tab, select People
  • Edit the Person document of the person you would like to add an email alias to
  • Add the alternative email addresses to Short name/UserID like this:

    "UsedID alias1@domain.com
    alias2@domain.com
  • Save and close the Person document
  • Navigate to the Server... tab
  • Select the Server console
  • To enable the changes on the SMTP server, enter in the Domino Command: TELL ROUTER UPDATE CONFIG

Domino 8.5 SSL Key Import Into Keyring File

Domino Server SSL Key Import

By default, the SSL key order process in the Domino Administrator assumes that only single domain certificates are used. Hence, when you have a multi domain UCC or a wildcard certificate, it has to be loaded into the keyring (a.k.a. kyr file) outside of the Domino Administrator.

The basic overview of the process is this:

  • Create a kyr (keyring) file to hold the keys.
  • Create a p12 (PKCS#12) file with the certificate that needs to be added to the keyring.
  • Add the p12 (PKCS#12) file to the keyring.
  • Install the new keyring on the Domino Servers (mail, traveler, sametime, Quickr)

Domino Server PKCS#12 key generation and import

Create PKCS#12 from SSL KEY and CRT files

For this step I recommend to be on the Linux or AIX with openssl installed. Assuming that you have the certificate key, the CA issued certificate, and the certificate chains all in the same directory, you can run the following command to generate the p12 file:

openssl pkcs12 -export \
-in certificate-from-CA.crt \
-inkey certificate-key-file.key \
-certfile root-ca-bundle.crt \
-out certificate-in-pkcs12-format.p12

Add PKCS#12 to Domino Server Kyr Keyring File

For this step I recommend to be on the sametime server under Linux or AIX. In theory, this should work, but in practice, I found that the version 7 of the gsk tools doesn’t seem to be able to open kyr files. So you may need to skip ahead to the legacy Windows XP method, unless you can find the gsk5bas package on one of your older install media.

rpm -Uvh ${SAMETIME_CD_PATH}/SametimeEntryServer/GSKit/Linux/gsk7bas-7.0-4.28.i386.rpm
vi /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/security/java.security

Add last provider to list:

security.provider.1=com.ibm.jsse2.IBMJSSEProvider2
security.provider.2=com.ibm.crypto.provider.IBMJCE
security.provider.3=com.ibm.security.jgss.IBMJGSSProvider
security.provider.4=com.ibm.security.cert.IBMCertPath
security.provider.5=com.ibm.security.sasl.IBMSASL
security.provider.6=com.ibm.spi.IBMCMSProvider

remove conflicting jar file:

mv /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/ext/gskikm.jar /opt/ibm/lotus/notes/latest/linux/ibm-jre/jre/lib/ext/gskikm.removedjar-

set environment:

set JAVA_HOME
JAVA_HOME=/opt/ibm/lotus/notes/latest/linux/ibm-jre/jre export JAVA_HOME

Domino Server Required Utilities for SSL Key Import (legacy Windows XP method)

  • Download and install IKEYMAN.
  • Open the kyr file in gsk5.
  • Import the p12 cert.
  • Save the new kyr file.

Domino Server SSL Key Management References

  • http://www.redbooks.ibm.com/redpapers/pdfs/redp0046.pdf
  • http://www.turtleweb.com/turtleblog.nsf/dx/11022009232215GDAVGR.htm?opendocument&comments
  • http://www.deadspace.de/?p=294
  • ftp://ftp.software.ibm.com/software/webserver/appserv/library/v61/ihs/GSK7c_SSL_Ikm_Guide.pdf
  • https://support.quovadisglobal.com/KB/a93/how-do-i-install-my-digital-certificate-into-lotus-notes.aspx
  • http://replay.waybackmachine.org/20081121002554/http://www.justinclarke.com/archives/2005/08/sending_smime_e.html
  • http://www.eulerhermes.com/en/documents/secure-email/ehcica_howto_import_lotus_notes_en.pdf/ehcica_howto_import_lotus_notes_en.pdf
  • http://publib.boulder.ibm.com/infocenter/sametime/v8r0/index.jsp?topic=/com.ibm.help.sametime.802.doc/Entry/st_adm_security_ssl_ikey_lin_t.html

For more information about Domino Server solutions, visit our collaboration section.


Linux Kernel Hangs During Boot

While rebooting a machine for example to apply a kernel update, it hangs. You try older kernels, and it hangs too. Not necessarily at the same spot. Here are some examples:

...
io scheduler cfq registered (default)
...
Real Time Clock Driver v1.12ac

These kernel hangs during boot are interestingly traceable to the USB keyboard. If you use a PS2 keyboard instead, the kernel may just continue booting. No comment.


Domino Server Crash Debug Data Collection

Even though Domino servers tend to be very stable, it may happen that every now and then there is a crash. In that case it is good to be able to provide appropriate details to IBM. Here are some recommendations form IBM tech support:

  • Make sure gdb is installed on the OS (Unix OSs only)
  • Add the following lines to notes.ini:
    debug_threadid=1
    debug_show_timeout=1
    debug_capture_timeout=1

These recommendations apply to any Domino based server: Quickr, Sametime, Traveler.