Author: harlan

https://www.ssllabs.com/ssltest/index.html

I needed to make a PGP encryption system to transfer some files around. Strictly for entertainment and memory process here’s an example of the command lines you need to encrypt a file and then decrypt it.

Encrypt looks like this:

(Now sometimes you have to do this prerequisite)

gpg –edit-key email@****.com

trust
5 (select 5 if you ultimately trust the key)
save

Ultimate Encryption Command:

F:test>gpg -r (NameOfCert) -o (NewEncryptedFile.pgp) -e (FileToBeEncrypted.pdf)

Decrypt looks like this:

F:test>gpg –batch –yes –passphrase (your passphrase) -o (UnencryptedOutput.xml) -d (EncryptedFileInput.pgp)
gpg: encrypted with 4096-bit RSA key, ID ********, created 2014-10-20
“Certificate Name, Description, Etc. <Email Address>”

I built a Windows 2012 file server to upgrade from 2008r2 I used this robocopy command to pre-seed the file server in order to speed things up.

robocopy.exe “\source serverd$” “d:” /b /e /copyall /r:6 /xd dfsrprivate /log:robo.log /tee /MT

We started using dfsr to populate the machine initially but it was taking too long and pulling from a remote server. Using the robocopy pre-seed command copied the files from a local host and executed at line speed – resulting in a much faster time to completion.

Also, don’t forget to take advantage of the new feature in Windows 2012, De-Duplication…. I’m saving over 20-30% on my file servers now that I’ve enabled dedupe.

I’ve had to come back and edit this because I discovered something that really helps ease the mind while performing the above operation. – and is something that should be done to spot check the system before introducing a pre seeded system into DFS. Check your hash for the directories and files to make sure that they are identical. This will allow a faster delta transition time between the old and new systems.

C:Windowssystem32>dfsrdiag filehash /filepath:\onrfs01d$vacancy_monitoring

File Hash: DBCCC7FA-E523939F-835B14D5-31020191

Operation Succeeded
C:Windowssystem32>dfsrdiag filehash /filepath:\onrfs02d$vacancy_monitoring

File Hash: DBCCC7FA-E523939F-835B14D5-31020191

Operation Succeeded

dfsrdiag backlog /RGname:asdfjkl.comdirdir /rfname:dir /smem:sendingservername /rmem:recievingservername

Use the above command to check backlog status.

Today I wanted to take advantage of installing a passive instance of Sophos UTM 9.x (we use version 9.307006 at the moment)

Our installation is entirely virtual, we only have virtual hosts, ESXi 5.5 2456374, Force10 Switches and SAN gear.

First thing to do is get your UTM setup and configured the way you want it. Put a couple extra nics in there for the future, get basic firewall functionality setup and “everything” working. OR, if you’ve already got a UTM setup, start by logging into your UTM shell as root and enter the following command:

cc set ha advanced virtual_mac 0

The above MUST be done for the HA system to work in the vmWare environment.

Next, clone your existing system. I have an even/odd numbered vhost scheme going on so I changed the name of the existing UTM to UTM01 and cloned it from vHost01 to vHost02 as UTM02.

Once the clone snapshot completed, I logged into the UTM01 and went to:

Management, High Availability, and clicked the Configuration tab.

Here, select Hot Standby (active-passive)

Below in Configuration, select your NIC, I used the last one added to the system. (eth7)

Then enter the device name (csutm01) and a device node select 1 and set an encryption key.

Go ahead and apply all your settings, (click both apply buttons)

By now your clone should be done, DO NOT POWER IT ON.

Right click the VM, and disconnect all network cards except the one connected to the HA network.

Now, power up the UTM02 and open the console. Wait for the system to come to the login screen and use your root credentials to login.

Now we will reset the configuration of the UTM02 to factory. MAKE SURE you are on the CORRECT SYSTEM!!

So, login as root,

cc (enter)

RAW (enter)

system_factory_reset (enter)

The system will power off when complete. Once it has powered off, reconnect your internal interface. Power back up again and go through the basic setup settings. The only thing required is an internal network. Don’t configure anything else. (may have to add a license file)

Once the system allows you to login,  go to

Management, High Availability, and clicked the Configuration tab.

Here, select Hot Standby (active-passive)

Below in Configuration, select your NIC, I used the last one added to the system. (eth7)

Then enter the device name (csutm02) and a device node select 2 and set an encryption key.

Go ahead and apply all your settings, (click both apply buttons)

The web interface will lock up indicating that you have lost connection to the secondary UTM02.

You should already be logged in to UTM01 and if you go to the High Availability menu, you should see the system UTM01 Active, or Master and the UTM02 status Syncing. It takes about 15 minutes for the system to stabilize so be patient.

There you have it. the above steps are exactly how I set up my three data centers and a development environment. If you have any troubles please feel free to send me a message