How To Create A Domain In Windows Server 2008 And Things To Consider

Gone are the days when separate user names had to be configured and used for logging into numerous servers for working on a network. For example, back in the early days a user might have to login to a mail server with a separate user name and password as compared to a data a UNIX server for managing files. With the advent of solutions such as the Active Directory, user authentication and management is much simpler now. For example, Kerberos authentication allows a user to easily manage mails, database related activities and access across multiple places on a network with a single user profile via the Active Directory in a Domain environment. In this post we will tell you the steps to create a domain in Windows Server 2008 and the things that you need to consider during this process.

For the purpose of this article, we are using Windows Server 2008 R2 to create a domain, the same configurations apply for the 32-bit version. To get started, go to Run or a Command Prompt and type dcpromo and hit Enter.

This will show you a message to wait until the installation wizard opens. Once the installation wizard opens, hit Next. Make sure the Use advanced mode installation option is unchecked.

The next step will display a screen explaining operating system compatibility details with a link at the bottom of the wizard which can be used to get more information about the topic. Hit Next to continue.

When making a domain you will be given the option to add a domain in an existing forest or creating a new domain within a new forest. You can also use this wizard to add a domain controller to an existing domain (a domain tree). Here we will select Create a new domain in a new forest option and hit Next.

A tree is made up of multiple domains and multiple trees merge under the realm of a forest.  The name of the first Domain created within a forest (the forest root Domain) also becomes the name of the forest. To move forward, enter a FQDN (Fully Qualified Domain Name), e.g. addictivetips.com. The wizard will proceed further after checking the NetBIOS name to make sure that there is no existing domain already present with the same name.

In the next step, select the forest functional level by choosing the appropriate Windows Server version. Choosing a newer version will give you more functionality options, however, you can select older levels as well.

The DNS Server checkbox is checked by default to install the DNS server

While attempting to proceed further you may be prompted to assign a static IP if it is set to obtain (IP automatically). It is not advised to use a dynamic IP from the DHCP server for a domain as the dynamic IPs change after a set period of time which will cause major disruptions as client operating system will disconnect if and when the IP changes.

To assign a static IP to the adapter, go to the Network and Sharing Center and click on Change Adapter Settings. From here select TCP/IPv4 and set a static IP e.g. 192.168.1.254. Also set a Default Gateway, which is normally the IP of a router. In the Proffered DNS section you can simply enter the Domain IP (which in this case is 192.18.1.254) or add a loopback IP (127.0.0.1) so that the domain automatically send itself the DNS queries. This will be helpful if you ever change the Domain IP, as the DNS will not have to be adjusted. You can also use an alternative DNS in the Alternative DNS Server section. To move forward click on “No, I will assign static IP addresses to all physical adapters”.

In the next step, you will have the choice to save the Database, Log and SYSVOL files to the same or separate locations. Some administrators save them separately to balance the load or hard disk space considerations, whereas others save them at the same location. This is not much of an issue nowadays, especially in the wake of better disaster recovery mechanisms.

Moving forward, you will be asked to save a restore mode password (which is separate from the Domain Administrator’s account). This password is configured to be used when the Domain Controller is started in Directory Services Restore Mode.

In the final part of the wizard, you can check the summary of the configurations in the Review Your Selections box and proceed to create your Domain.

The installation will complete after a brief period of time (depending upon your hardware capability) and you will be able to start working on your Domain after restarting the system.

Read More

Introducing the New Cloud Control Panel

The New Cloud Control Panel lets you manage your Rackspace Cloud infrastructure through a simple, intuitive graphical interface. This article introduces you to some of the cool features we've put in place that will make your daily administration tasks seem effortless.

New Server and Control Panel Names

At Rackspace, we're continually evolving and growing to provide you with nothing less than an extraordinary experience. As part of our effort, we've made many improvements to our products and how you interact with them. We need a way to let you know where you are and what you're working with, so here are the new names for our Cloud Control Panels and Cloud Servers:

• The New Cloud Control Panel is named New Cloud Control Panel, or simply, the Cloud Control Panel.
• The existing Cloud Control Panel is now called Classic Cloud Control Panel.
• Our new Cloud Servers are called next generation Cloud Servers Powered by OpenStack, or just next generation Cloud Servers.
• Existing Cloud Servers are now called first generation Cloud Servers. In the New Cloud Control Panel, a blue asterisk follows the name of each of your first generation Cloud Servers. 

You'll see these new names throughout this article and as soon as you log into the New Cloud Control Panel.

Quick Access to Rackspace Products

You can work with the any of the supported Rackspace products by clicking the product name located at the top of the New Cloud Control Panel. The product names run along the top of the page and look like this:

One click and you'll be in the product workspace where you can begin managing your cloud resources. By popular demand, you'll notice that DNS now has its own dedicated workspace where you can manage DNS settings for all of our products. 

Organizing and Finding Your Cloud Resources

Several exciting new features help you organize, find, and efficiently manage your resources no matter the size or shape of your cloud inventory.

Tags

Tags let you add customized labels to any of the assets that make up your cloud infrastructure. They're completely flexible, so there's no limit to how many tags you create or how you assign them. For example, you could distinguish your servers by their functional role, a certain website association, a specific technology, or even by geographical location.

If you hover your mouse over a first generation Cloud Server, you'll also see the first generation Cloud Server tooltip.

Filters

Our new filters help you find all assets that share these common properties: Tag, Status, Image, RAM, Region, and Type. When you create and tag assets, the filters are automatically populated. When you click a check box next to a filter, the list of assets shows only the matching assets.

Here's an example of what the filters might look like for Cloud Servers:

You'll notice that tags are also included in the list of filters. This gives you a powerful yet simple way to find only the specific assets you want to work with. For example, you could filter your list of servers to show all 2 GB Cloud Servers that you've tagged as production. Using the Status filter, you can drill down even further and find the servers that are currently Running, Offline, or have a different status. 

Search

With a convenient and fast new search field in the upper right corner of each asset listing (servers, files, and load balancers) you have yet another method for locating any asset, merely by entering part of the asset name, tag, or IP address in the search field. 

Using tags, filters, and search, your cloud inventory can grow to any size and you'll still be able to promptly locate and manage any asset.

Performing Administrative Actions

We've added a variety of new ways to perform administrative tasks. It doesn't matter if you're currently looking at a list of assets or a detailed view of a single asset. There's no need to switch screens or leave your current location to perform a task; every task you might want to perform is right where you need it.

The Actions Cog, Actions Menu, and the Edit Pencil

• When viewing resouces in a list, click the actions cog to the left of the asset name and you'll find a drop-down menu with all available actions for that asset. The actions cog is always part of every list, whether it's a list of servers, files, or load balancers. The following screenshot shows the Actions cog drop-down menu for a first generation Cloud Server named 1TestVyatta:

• If you're looking at the details of a specific asset, you'll find the Actions drop-down menu in the upper right corner of the page. Again, all the actions you can perform on the asset are easily accessible. 

• You'll also see that you can edit an existing setting for a resource by clicking the edit pencil that appears next to the asset description. For example, you could resize this server, change the image, or add a record by selecting the option that appears after the description for each setting:

Pop-overs

Whenever you perform an administrative action on an resource, you'll instantly see a pop-over that lets you modify the settings or perform an action without taking you to another screen. This makes modifying an asset much faster since you don't have to wait for the page to reload. Here's an example of the Reboot Server pop-over accessed from the server list for a first generation Cloud Server called 1TestVyatta:

Accessing the Classic Cloud Control Panel

You can reach the Classic Cloud Control Panel from the user account drop-down menu located in the upper right corner of the page. The user account menu is labeled with your Rackspace Cloud account user name. From this menu you can access billing information, API Keys, and usernames/contacts. It looks like this:

Read More

Using iotop to check I/O and swap

The iotop utility provides an easy-to-use interface for monitoring swap and disk I/O on a per-process basis.

Watching the disk

Sometimes you get more disk activity on your system than you would like. Maybe you saw the problem by running iostat, or you’ve noticed that the system is swapping heavily, or you got an email from support pointing out the problem. In cases like that it’s useful to know which process is causing all the hubbub.

Enter iotop. It works like the traditional top command but it tracks device I/O (input/output) on a per-process basis. That can help you zero in quickly on which process is responsible for all the I/O and troubleshoot from there.

Prerequisites

The iotop command requires a kernel version 2.6.20 or higher and python 2.5 or higher.

CentOS and Red Hat Enterprise Linux 5.5 (current at the time of this writing) use an older version of python and so cannot run iotop on a standard installation. They can, however, run dstat, which performs a similar function to iotop.

Check your kernel version by running “uname -r”:

$ uname -r
2.6.35.1-rscloud

And check your python version by running “python -V”:

$ python -V
Python 2.5.2

Install

You can install iotop through your distribution’s package manager (if it’s available in the repository) or you can download the source package from the project’s website.

From package manager

To install iotop using your package manager pick the appropriate command from the list below (aptitude for Ubuntu/Debian, yum for Fedora, etc.):

sudo aptitude install iotop
sudo yum install iotop
sudo emerge iotop
sudo pacman -Sy iotop

If there is no iotop package in your repository but your system meets the prerequisites, you can install from source instead.

From source

The latest version of iotop is available from the project’s web site. Look for a link to the latest source package for iotop and download it with wget:

wget http://guichaz.free.fr/iotop/files/iotop-0.4.1.tar.bz2

Once you’ve downloaded the tarball, unpack it:

tar -xjvf iotop-0.4.1.tar.bz2

From inside that directory you can either run iotop where it is (by running “./iotop.py”) or you can run the installer to put iotop in /usr/bin:

sudo ./setup.py install

Basic usage

At its simplest you can run iotop with no arguments:

iotop

You should see a list of processes along with details about their current I/O use:

The column titles should be pretty self-explanatory, but there are two particular stats to note.

IO

The “IO” column lists total I/O for each process (which includes disk use and swap). Results are sorted by I/O by default when iotop is launched.

SwapIn

The “SwapIn” column lists swap activity for each process.

Runtime commands

Using the right and left arrow keys while viewing iotop will change the column used to sort the results.

If you want the processes sorted in reverse order hit “r” while viewing iotop.

Hitting “o” will filter the list so it will only show processes that are actively doing I/O. Typing “o” again will return to a list of all processes.

Script usage

You can use iotop in “batch mode” to have it print just one set of results instead of launching a constantly-updating interface. Batch mode can be useful when you want a script that logs regular I/O usage to a file.

Sending the “-b” flag to iotop will tell it to run in batch mode. You’ll usually want to combine that with some other flags:

The “-o” flag causes iotop to report only process with active I/O.

The “-t” flag will add a timestamp to the results.

The “–iter=#” option will limit the number of samples iotop returns when run.

The “-q” flag will prevent iotop from displaying column headers after its first run. You can prevent headers from being printed at all with “-qq”. To prevent both headers and I/O summaries from being printed use “-qqq”.

For example, the result of:

iotop -bto --iter=1

Would look like:

Total DISK READ: 0.00 B/s | Total DISK WRITE: 27.64 K/s
    TIME  TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
17:08:25   177 be/4 root        0.00 B/s    7.90 K/s  0.00 %  0.05 % [kjournald]

A sample cron script

You can use cron task scheduling to get iotop to run every minute and log any I/O activity it detects. Open this file for editing (with sudo):

/etc/cron.d/iotop

And put the following into that file:

#  Run iotop and log any detected activity.

* * * * * root iotop -botqqq --iter=3 >> /var/log/iotop

Save the file. That cron.d entry will cause iotop to run every minute, logging any I/O activity it finds to “/var/log/iotop”. It takes three samples when it runs (five seconds apart), doesn’t log headers or summary information, and only logs processes with measured I/O activity.

After a minute take a look in /var/log. If the script ran as expected there should now be an “iostat” log there (though it may be an empty file if it didn’t find any I/O to log).

Tweak the command to your liking. If you want a different number of samples per minute change the “–iter” value. If you want I/O summaries printed when the script runs change “qqq” to “qq”.

Rotate the created log

If you plan to leave the iotop logger running (and aren’t just going to run it for a day or so to check on a burst of disk activity) you’ll want to rotate its log occasionally to keep it from getting too big.

To that end, create a file for editing at “/etc/logrotate.d/iotop” (again using sudo).

Put the following into the file:

/var/log/iotop {
  rotate 5
  weekly
  compress
  missingok
  notifempty
}

For more details on what that logrotate config will do you can look through our articles on logrotate. For example, you might change the frequency of rotations from “weekly” to “daily” if you find you’re logging a lot of disk I/O. You could then increase the number of archived logs it keeps accordingly.

Similar commands

Another program that can be used to check I/O is dstat. While its presentation isn’t necessarily as attractive as iotop’s, it allows for more flexibility in what can be written to a log when used in a script. It also runs on older versions of python than iotop so it will run on more distributions.

The “sysstat” package includes several commands useful for gathering system usage statistics, and newer versions of the package include a program named “pidstat”. When run with the “-d” option pidstat will display disk I/O information on a per-process basis.

Summary

As “top” is to processor and memory use, so “iotop” is to disk I/O and swap use. The ability to see I/O on a per-process basis is relatively new to Linux (thus the requirement for a newer kernel to run iotop), but it was a very welcome addition. Iotop can be very useful when trying to track down which process is using swap memory or is causing an excessive amount of disk activity.

Read More

Preventing DNS Amplification Attacks via the Windows Firewall in Windows 2008 R2 or Windows 2012

This article will address how to prevent a DNS amplification attack when using Windows DNS Server installed on Windows Server 2008 R2 or Windows 2012 cloud server. For more information about a DNS amplification attack, please see the following link: http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack.

Once DNS is installed and the service is running, you can verify that the DNS server is allowing for an amplification attack by using either the “dig” command or the “nslookup” command. To verify using dig please use the following command: {dig @IPAddressofYourServer FQDNOfWhateverSite} (for the nslookup command, please see the example below). Here are two examples of how a DNS amplification attack would look using either command:

Now that you have verified that the DNS server is an configured as an open DNS resolver, all you need to do is modify theDNS TCP/UDP Incoming firewall rules à Scope tab and add any other cloud server’s IP addresses under the “Remote IP Address” section as pictured below:

Important: If you are joining other servers to a Windows Active Directory domain, you will need to make sure that you are adding the other cloud server’s IP addresses to the “Remote IP Address” section. If you don’t, the other cloud servers will not be able to connect to the DNS server and will fail to join Active Directory.

Once the firewall rules are in place for TCP and UDP, you should be able to run the same test from above and see that the server is no longer able to resolve for the FQDN. Below are the results from both the “dig“ command and the “nslookup” command:

Congratulations on setting up a secure Windows DNS Server that does not allow for a DNS amplification attack!

Read More

Installing Active Directory on Windows Server 2008 R2 Enterprise 64-bit 

From The Rackspace Cloud -- Cloud Servers Knowledge Base

This article will address how to prepare and install Active Directory Domain Services (AD) on Windows Server 2008 R2 Enterprise 64-bit (W2K8).

This article is not intended for adding a Domain Controller (DC) to an already existing Active Directory Forest Infrastructure.

Preparation for Active Directory

Installing Active Directory Domain Services on a Rackspace Cloud Server is a relatively easy process. There are a few requirements that must be present first to ensure a smooth installation however.

1. Have your domain name selected along with the Domain Administrator Password that you wish to use.

• Note- Though it is not a requirement, It is recommended you use a multiple name format for you domain name. Example would be, domainName.com or domainName.local rather than simply domainName.

2. A properly configured and available DNS server. This can be installed locally on the DC, and will be the case with this installation scenario.

• W2K8 can properly install and configure DNS during the AD installation if it knows that DNS is to be local.
• This is accomplished by having the Private network adapter’s Preferred DNS server address point to the already assigned IP address of the same Private network adapter.

To do this, select View Network Connections within the Server Summary of Server Manager.

Right click on the Private adapter and select Properties. Or Double click the Private adapter and select Properties.

Double click Internet Protocal Version 4, or select it and click Properties.

Now copy your assigned IP address: displayed in the top box into the Preferred DNS server: box and click “OK”.

Now click OK again for the private Properties and close the Network Connection window.

3. The last step for prepping W2K8 for AD is adding the proper Server Role.

• New to W2K8 is the ability to configure the server to perform specific roles.. The “Active Directory Domain Services” Role will be added. This only installs the framework for W2K8 to become a DC and run AD. It does not promote the server to DC or install AD.

To add the “Active Directory Domain Services” Role click on the Role Directory within Server Manager and select Add Roles in the Roles Summary.

Click Next at the “Before You Begin” section.

Now simply check mark Active Directory Domain Services and click “Next” twice, “Install” and finally “Close” when complete.

Installation of Active Directory Domain Services (DCPROMO)

Now that the Server has been prepared the installation of AD we can proceed. You now have three different ways we can begin the installation.

1. Within Server Manager, if you expand the Roles directory you will see the Active Directory Domain Services directory. Select that and you will find in the Summary “Run the Active Directory Domain Services Installation Wizard (dcpromo.exe)” Simply click that to begin the installation.

2. The comandline equivilant to Active Directory Domain Services Installation Wizard is - Servermanagercmd.exe –I ADDS-Domain-Controller

3. The last and probably the most recognized method is typing DCPROMO.exe at the command prompt.

Whichever way you choose, You should get to this point. Simply click Next. You do not check advanced mode.

Click Next again.

Now select “Create a new domain in a new forest” and click Next.

Now enter the domain name you have chosen.

After the installation verifies that the NetBIOS Name, you will choose the Forest function level. I chose 2008 R2. After selecting click Next.

It will examine and verify you DNS setting. DNS server should already be checked. Now click Next.

You will now be prompted with the following message. This is OK. Just click Yes.

Click Next Again.

Now enter your Domain Administrator Password that you chose. This is not your Admin Password that emailed to you during the creation of you Server, unless you want to use it. It is your decision.

Click Next.

The installation will now complete. You can check the reboot on completion if you like.

If not, you will need to click Finish here. Then restart your server.

After a few minutes, reconnect to your server via the Console in your Control Panel or RDP.

To log in, you will need to select “Switch User”, then Other User. Type in your full domain name you picked followed by a back slash and Administrator for user. Then enter the password that was emailed to you when you first built the server. If you had already changed your password for the local admin account to this server before your began the install for AD, use that password.

!!!Congratulations!!! You have installed an Active Directory Domain Controller.

Read More