password aging field

http://www.tech-faq.com/password-aging.shtml
http://www.cse.ohio-state.edu/~mamrak/CIS762/unix_encryption_tut.html


On non-trusted systems password aging is stored as part of the encrypted password each user's account in the system's password file.  The password field, which is the second field is divided in two by a comma.  The first portion, characters 1-13, is the encrypted password.  The second portion, after the comma (characters 15-18), is the password aging field for that account.
password aging field (characters 15-18) breakdown:
character 1: max weeks password is valid before expiration
character 2: min weeks password before password can change
remaining characters: last password change (in number of weeks since 1/1/1970)

the characters are Base-64, so it's kind of tricky.  See the above links for a conversion table for Base64.

calculate:
,N/TT

N = 25 weeks, 175 days max password lifetime
/ = 1 week, 7 days miniumum password before changing
S = 30
T = 31
31 * 64 = 1984
1984 + 31 = 2050 weeks since January 1, 1970 = 08/07/08

lanadmin options for gigabit cards

some good stuff here: http://docs.hp.com/en/J5683-90002/ch02s02.html

specifically I like the lanadmin -x card_info PPA   it gives you firmware, driver versions, etc. level details.  example below for a port on a HP A9784-60002 PCI/PCI-X 1000Base-T FC/GigE Combo Adapter
*********** Version Information **********
Driver version: B.11.23.0609
Firmware version: 1.0.9/1.11
Chip version: 0x10
PCI Sub-System ID: 0x12ca (1000Base-T)
PCI Sub-Vendor ID: 0x103c
Board Revision: A0
Software Key: 0
Engineering Date Code: A-4550

********** Card Setting ***********
Driver State: IGELAN_ONLINE
Auto Negotiation: On
Flow Control: On
Send Max Buf Descriptors: 10
Recv Max Buf Descriptors: 1
Send Coalesced Ticks: 150
Recv Coalesced Ticks: 0

using font server with Cygwin/X

In cygwin\bin\startxwin.bat

%RUN% XWin -multiwindow -clipboard -silent-dup-error -fp tcp/FONT_SERVER:7000

where FONT_SERVER is the name or address of the font server, typically tcp port 7000

great inexpensive waterproof camera case

here's a great inexpensive waterproof digital camera case: Dicapac

However, the WP-410 product, even though it says it fits the Olympus Stylus 1010 or 1020, the camera zoom lens will sit on the clear plastic lens of the bag even when using the rubber extender that comes with the case.

http://tech.yahoo.com/blogs/raskin/17377?comment_start=26&comment_count=20

http://www.dicapac.com/

buy from http://www.dicapacusa.com  www.amazon.com and probably other outlets.

hpux 11.00 trusted account unlock

to "reactivate" a locked / expired "lifetime maximum reached" account on hp-ux 11.00 trusted system server:

/usr/lbin/modprpw -l -x USER


I believe in 11.11 and up all that needed is:  /usr/lbin/modprpw -k USER

c7000 blade enclosures and port maps

bl860c blade server to c7000 interconnect bays port mapping:

http://docs.hp.com/en/AD217-9015B-ed5/ch03s09.html

netbackup name resolutions issues

STATUS CODE 6: Veritas NetBackup (tm) for Oracle database backups fail with a NetBackup Status Code 6 (the backup failed to back up the requested files), and the RMAN log shows an ORA-2702


bpclntcmd -self -- This returns who the client believes it is
bpclntcmd -pn -- This returns who the client believes the master is, and what the master says the client is
bpclntcmd -hn -- This returns the IP address is associated with the master server, using gethostbyname()
bpclntcmd -hn -- This returns the IP address is associated with the client server, using gethostbyname()

bpclntcmd -ip -- This returns the hostname associated with the master server's IP address, using gethostbyaddr()

bpclntcmd -ip -- This returns the hostname associated with the client server's IP address, using gethostbyaddr()

All names and IP addresses should match

swremove selection had errors

doing swremove and getting error swremove: selection had errors.

Nothing further in the swremove.log or any of the swagent.log files in /var/adm/sw.  The problem turn out to be two bundles with the same name, one with the name uppercase, the other lowercase.  In order for the swremove command to work, I needed to specify both bunldes:

swremove BUNDLE1 bundle1

Netbackup and restores to alternate host

to allow restores to an alternate host, use the altnames directory:
http://joostm.nl/netbackup/nbu-env/nbu-env-2-4/doc/TOUCHFILES  (see the No.Restrictions file, to allow any client to restore, BUT it's not safe)

logname and utmp/utmpd problem

I've encountered the following problem a number of times:
ssh (or telnet) into a box, sometimes only occurs on a particular tty, like /dev/pts/1
$ logname logname: could not get login name
even though:
$ id
uid=101(me) gid=102(mygroup)

UPDATE for sshd issues:
update your version of SSH or HP patches; see the last couple comment on this ITRC Forum posting.
try changing UsePrivilegeSeparation to no in sshd_config: /etc/opt/ssh/sshd_config
UsePrivilegeSeparation no

then send a SIGHUP to sshd:
kill -s SIGHUP $(cat /var/run/sshd.pid)
end update

It seems like the utmp database is corrupt or not functioning properly. When logname gives the error message "could not get login name", then system doesn't know who I am, so it thinks I'm root (it writes root-root in the sulog file).

To fix it, I just stopped and restarted the utmpd daemon process: /sbin/init.d/utmpd stop ; /sbin/init.d/utmpd start

This problem sometimes causes logins to hang when processing /etc/profile, if logname is used in /etc/profile or another login script.

goosh.org - the unofficial google shell

goosh.org - the unofficial google shell.
interesting concept: http://tech.slashdot.org/article.pl?sid=08/06/02/222234

OVO agent issues

$ /sbin/init.d/opcagt start
ERROR:   Problems with starting OpC Agent processes or none configured.


/opt/OV/bin/OpC/opcagt -start
/opt/OV/bin/OpC/opcagt -status
The VPO control agent is currently not running. (OpC30-1045)

edit hosts file and make sure the main IP address for the machine is listed first, escpecially if the hostname is listed more than once.

$ opcagt -status
Error opcctla   (Control Agent)(5900) : Initialize of the VPO Control Agent failed. (OpC30-1036)
Can't lookup servers: Communications failure (dce / rpc). (OpC20-108)
Can't lookup servers: Communications failure (dce / rpc). (OpC20-108)
Stopping all VPO Agent processes... (OpC30-1192)

from: http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=991091

/opt/OV/bin/OpC/opcagt -kill (stop OVO agent)

ps -ef |grep -i rpc
(make sure both rpc and rpcbind are seen)

/sbin/init.d/Rpcd stop

Then if rcpd is still running kill it:
    root  1759     1  0  Sep  2  ?        479:48 /opt/dce/sbin/rpcd

kill -9 1759

rm /var/opt/dce/dced/Ep.db
rm /var/opt/dce/dced/Llb.db
(clear rpcd db files)

/sbin/init.d/Rpcd start
(restarts rpcd)

/opt/OV/bin/OpC/opcagt -start (restart the OVO agent)

APA lan monitor mode hot standby failover mode

Here's what it looks like when a network link fails over to a secondary, standby lan (and then back again):

secondary port is down:

Link Aggregate PPA #             : 900
Link Aggregation Mode            : LAN_MONITOR
Load Balance Mode                : Hot Standby (LB_HOT_STANDBY)
Active Port PPA #                : 0
Port(s) ready                    : NONE
Port(s) not ready                : 1
Port(s) connected to active port : NONE

SYSLOG:
May 11 21:00:17 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan1 is down (lan0 is active)
May 11 21:00:52 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan0 isn't receiving poll packets (lan0 is active)


after plugged in:
Link Aggregate PPA #             : 900
Link Aggregation Mode            : LAN_MONITOR
Load Balance Mode                : Hot Standby (LB_HOT_STANDBY)
Active Port PPA #                : 0
Port(s) ready                    : 1
Port(s) not ready                : NONE
Port(s) connected to active port : NONE

SYSLOG:
May 11 21:01:32 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan0 is now receiving poll packets (lan0 is active)
May 11 21:01:52 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan1 is up (lan0 is active)

then:
Link Aggregate PPA #             : 900
Link Aggregation Mode            : LAN_MONITOR
Load Balance Mode                : Hot Standby (LB_HOT_STANDBY)
Active Port PPA #                : 0
Port(s) ready                    : 1
Port(s) not ready                : NONE
Port(s) connected to active port : 1




Primary port down:
Link Aggregate PPA #             : 900
Link Aggregation Mode            : LAN_MONITOR
Load Balance Mode                : Hot Standby (LB_HOT_STANDBY)
Active Port PPA #                : 1
Port(s) ready                    : NONE
Port(s) not ready                : 0
Port(s) connected to active port : NONE

SYSLOG:
May 11 21:03:05 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan0 is down (lan1 is active)
May 11 21:03:42 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan1 isn't receiving poll packets (lan1 is active)


Primary port back up:
Link Aggregate PPA #             : 900
Link Aggregation Mode            : LAN_MONITOR
Load Balance Mode                : Hot Standby (LB_HOT_STANDBY)
Active Port PPA #                : 1
Port(s) ready                    : 0
Port(s) not ready                : NONE
Port(s) connected to active port : NONE

SYSLOG:
May 11 21:05:12 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan1 is now receiving poll packets (lan1 is active)


May 11 21:05:32 sbhs3010 vmunix: APA/LM: FOG:lan900 - lan0 is up (lan1 is active)
same time:
Link Aggregate PPA #             : 900
Link Aggregation Mode            : LAN_MONITOR
Load Balance Mode                : Hot Standby (LB_HOT_STANDBY)
Active Port PPA #                : 1
Port(s) ready                    : 0
Port(s) not ready                : NONE
Port(s) connected to active port : 0


doesn't fail back to original active port because both ports have the same priority.

using Twitter with Google talk for your domain

http://www.kavinda.net/2007/07/31/HowToTwitterOnGTalkForYouDomain.aspx  explains how to add the necessary DNS SRV records to your zone in order to twit via Google chat.  This is necessary to get twitter to work with Google Talk when your using Google Apps for your domain.

Go to the Chat section under 'Service Settings' when in the administration 'manage this domain' page for your domain.  a link will be to: http://www.google.com/support/a/bin/answer.py?answer=60227&hl=en   But you'll need to follow the above instructions as well (maybe, haven't tried yet)

HP APA (auto port aggregation)

HP-UX has no built in lan aggregation or failover; I know - it's a damn shame.  (note: serviceguard does have a local lan failover mode)  HP APA (Auto Port Aggregation).

Be sure to do the configuration from a console connection or connect from a NIC that won't be involved in APA, otherwise you'll drop and may not be able reconnect over tha lan if you screw up the config.

commands to configure it:
lanqueryconf
lanapplyconf
lancheckconf
landeleteconf

Here's my quick and dirty version of creating a lan failover group:

--- APA configuration --
added the following line to /etc/rc.config.d/hp_apaconf
HP_APA_USE_SYSLOG=1

add the following to: /etc/rc.config.d/hp_apaportconf
HP_APAPORT_INTERFACE_NAME[0]=lan5
HP_APAPORT_CONFIG_MODE[0]=LAN_MONITOR

HP_APAPORT_INTERFACE_NAME[1]=lan6
HP_APAPORT_CONFIG_MODE[1]=LAN_MONITOR


 /sbin/init.d/hplm stop
 /sbin/init.d/hpapa stop
 /sbin/init.d/hpapa start
 /sbin/init.d/hplm start

create ascii file:
lanqueryconf -s

change priority of both primary and secondary to the same value, so that failback doesn't occur.
vi /etc/lanmon/lanconfig.ascii

check validity of ascii file:
lancheckconf

apply the changes to the binary file:
lanapplyconf

check config:
lanscan and lanscan -q and lanadmin -x -v PPA  and netstat -in



Once it's configured, here are some useful commands for looking at the status:
real status of ports:  lanadmin -x -i 900 
load balancing mode:   lanadmin -x -l 900
verbose config:        lanadmin -x -v 900

Where 900 is the PPA number for the apa/failover group

serviceguard error renaming hosts

The following is from renaming hosts or changing their IP addresses in a SG cluster.  In addition to changing all the cluster configuration files (cmclnodelist, cluster ascii, package ascii and control files) from the old names to the new names, you also probably need to delete /etc/cmcluster/cmclconfig (the cluster binary config file).  The old IP address are "stuck" in there and cmcheckconf or cmapplyconf  won't proceed without deleting the cluster binary file.

If you don't delete it, here's the message you will receive when running cmapplyconf or cmcheckconf:

Checking nodes ... Done
Checking existing configuration ... Done
Warning: Unable to get configuration for cluster CLUSTER_NAME
Error: Node HOSTNAME is refusing Serviceguard communication.
Please make sure that the proper security access is configured on node
HOSTNAME through either file-based access (pre-A.11.16 version) or role-based
access (version A.11.16 or higher) and/or that the host name lookup
on node HOSTNAME resolves the IP address correctly.
cmcheckconf : Failed to gather configuration information

single vs. dual core in HP-UX

use machinfo:  /usr/contrib/bin/machinfo

the following hints are from: http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1209686

Single-core processors ======================
processor family: 31 Intel(R) Itanium 2 Family Processors


Dual-core processors ====================
processor family: 32 Intel(R) Itanium 2 9000 series
or
processor family: 32 Intel(R) Itanium 2 9100 series


So, processor family 32 means dual core;  processor family 31 means single core.

get CPU speed on HP-UX

echo itick_per_tick/D | adb -k /stand/vmunix /dev/kmem | tail -1 | awk '{print $2/10000}'

or
sam  --> performance monitors,  system properties

Itanium:  11iv2
machinfo

ECC agent fails or hosts don't appear

the hosts don't appear in the EMC Control Center (ECC) master server, or one does but then is replace by another. Sometimes the agent starts, but then unexpectedly quits/dies. If you clone your boxes, exclude /var/ECC or else!

Otherwise just: stop the agent; nuke /var/ECC ; restart agent is the fix for this issue it seems


open a http://powerlink.emc.com account and see the article: "Hostname change not reflected in ControlCenter console." EMC doc ID: emc139067

Looks like you also need to remove a couple more files in /usr/ecc/exec any files with the extensions .lck, .port, .uid and .comfile

set up the IP stack in EFI on HP integrity servers

from an ignite DVD or even the boot disk of an HP-UX system:
cd \EFI\HP\TOOLS\NETWORK
load tcpipv4.efi
ifconfig sni0 192.168.1.50 netmask 255.255.255.0 up
route add default 192.168.1.1

ping 129.168.1.1

to reuse IP on different interface, unload the tcpipv4 driver, find the driver handle first:
dh
unload AF


not sure how to print the routing table, if anyone knows please comment ('route print') does NOT work.