Creating SSL Certificates with Multiple Host Names

Creating an SSL Certificate with Multiple Hostnames

There's another article on creating wildcard certificates in apache (and here on IIS), but we've not discussed the possibility of having a single certificate answer to several hostnames (DNS cnames, and http host headers). This uses an SSL feature called SubjectAlternativeName (or SAN, for short). Not only is this possible, but it's reasonably easy. We'll talk about generating the certificates using openssl on linux, but openssl is available for Windows, also, and the procedure is the same. Note that Windows' selfssl utility doesn't provide the ability to generate a certificate request file with SANs, so if you want to use this on Windows, you'll need to use openssl or another ssl utility.

Active Directory (AD) Authentication on a Linux Server

Domain Authentication for Linux

I've updated the instructions here to support RHEL 6. I've streamlined things a bit, too, so I'd head over to this page to get the latest on setting up AD authentication for a Linux server. There are a lot of how-tos surrounding the integration of authentication and authorization in Linux through Active Directory domains. I've found a variety of them helpful, and I've found more to be confusing, rather than helpful. Here I'm hoping to put together a start-to-finish process for using your domain to authenticate and authorize users on your linux box. These instructions are written for Red Hat Enterprise Linux v5 (RHEL from now on). That means the file locations should be the same for CENTOS distros (which I highly recommend as a server OS), but that they might move around a bit for others.

A very small bit of background: this system uses winbind and smb to connect to the domain to authenticate users. Kerberos is used to join the system to the domain. The benefit of this system is that it's secure and it's pretty easy to configure. Coupled with PAM (Pluggable Authentication Modules), it's quite flexible, and it's really pretty cool functionality.

Singing the praises of DekiWiki

I've been a devotee of MediaWiki for some time, now, and I still have a soft spot in my heart for it. Having said that, however, I've become a real fan of DekiWiki. It's a very full-featured wiki with a ton of extensibility. And the best part: it's released in a community-supported edition, so it's available to everyone without cost. There is a lot that can be said for DekiWiki, and the truth is that I'm too lazy to run through it all. Suffice it to say that it has a ton of features, including extensions, a very flexible scripting language, and--for many the Holy Grail--a very robust ACL system, by which permissions can be set on the individual page level. Here's another bonus: they provide a feature by which MediaWiki installations can be converted to Deki. And I can attest to this: the conversion works well. The commercially-licensed version, to which I suspect we'll move in the near future (I'll post our experience), has a suite of additional features, including a desktop-based toolset that allows for publishing from Outlook and Word, as well as drag-and-drop functionality for organizing the articles. Installation instructions for the GPL'd edition can be found at the MindTouch Deki site. I'll leave it with this: the developers are very active on the MindTouch developer site, very quickly--and thoroughly--addressing problems you might run into. They're a most helpful bunch.

Installing OpenSolaris on a server with a HP Smart Array Controller

I'm quite new to OpenSolaris; insofar as it's like Linux, I'm pretty comfortable, but there appear to be enough little gotchas to make the learning curve a little steeper than one might like. Take, for instance, the fact that OpenSolaris doesn't ship with the drivers for the almost-ubiquitous HP Smart Array controller. That makes for an installation hiccup that a quick Google search shows many people have found difficult. It's too bad, too: it appears that this has stymied a lot of folks in trying to install the OS. Like most things, the solution is easy, once you know how to do it. These instructions, originally, were for OpenSolaris 2008.11, but they've since been updated to work with 2009.06.

Setting up a VNC remote desktop in Enterprise Linux 4, 5, and 6

This is something that is terribly useful, and there are lots of how-to articles running around. Unfortunately, I've not found one that was quite complete, especially for someone who is only just getting familiar with Linux (which is precisely when you most need a GUI!). So this is a step-by-step instruction list on getting a remote X Windows session set up on enterprise linux 4, 5, and 6 (RHEL and CENTOS) that can be accessed with VNC viewer software (do a quick search on VNC if you're not familiar with it). In some set-ups, people create a VNCSERVER process that runs all the time. This does allow for persistent sessions (sessions that survive a disconnect), but it's not really what most of us need most of the time. What we're doing here is using xinetd, which will spin up Xvnc on an as-needed basis. Much cooler. Please note: vnc is not a secure protocol. What this means is that any traffic that VNC sends over the wire is *not* encrypted. Do make sure that your use of this doesn't put you at risk for having sensitive data (passwords, for instance) compromised.

SQL Server Bulk Insert Using a Format File to Read Data that also Includes a Comma in the String

There are a lot of resources out there on the net about using SQL Server Bulk Insert, and there are a lot of technical discussions about the inner details of Format Files. The problem is that there aren't many concrete examples of a very common need: importing a CSV (comma-separated) file where a quoted string also includes a comma. Here's an example of what some data might look like:

ID,Name,Phone 
100983,"Jones, Frank",555-1212
118928,"Smith, Joe",555-1313
115454,"Franklin, Alibaster",555-1414

Using a bulk insert statment without a format file would give us data that would look like this:

ID	Name	Phone
100983	"Jones	Frank"	555-1212
118928	"Smith	Joe"	555-1313
115454	"Franklin	Alibaster"	555-1414

When in reality, we want the data to look like this:

100983	Jones, Frank	555-1212
118928	Smith, Joe	555-1313
115454	Franklin, Alibaster	555-1414

WebLogic Case Sensitivity

Prior to v9.0, Weblogic was case-insensitive in Windows, but starting with v9, the default is, like Apache, to be case sensitive. A web search on changing that behavior isn't very helpful, and the setting is buried a bit, so I thought I'd post the instructions on changing that setting. The first step is to run the weblogic admin console. The default URL, once that has been started, is to browse to http://servername:9999/console. You'll be prompted for the username/password that you configured when installing weblogic. Once there, click on Domain-> Security-> Advanced. There you will see a "Web App Files Case Insensitive:" setting. By default, this is set to "false". Change it to "os", click on save. Once it's been saved, the changes have to be Activated. Click on the green Activate Changes button on the left-hand side of the screen.

You'll have to reboot the admin console, as well as your standard weblogic web services, for this change to take effect.

Persistent Problem with MS Update

Have you ever gotten a Windows system that simply won't update? That is, it'll find all the updates it needs from Microsoft, but the updates won't do anything but fail. It's a bummer, because the normal reboot simply won't fix the problem. It turns out there is a solution. The problem appears to come from XP SP3, beauty, that. In any case, this should fix the problem: Run: REGSVR32 WUAPI.DLL REGSVR32 WUAUENG1.DLL REGSVR32 ATL.DLL REGSVR32 WUPS2.DLL REGSVR32 WUCLTUI.DLL REGSVR32 WUPS.DLL REGSVR32 WUWEB.DLL REGSVR32 WUAUENG.DLL

Windows Vista Look and Feel in XP

If you're interested in making your XP system look like Vista, there are a ton of resources out there. Why another one? Because I want to keep it simple. I found two resources that gave me the whiz-bang look and functionality without fiddling too much with lots of other apps. In short, I used what must be the gold standard, Vista Transformation Pack, along with TrueTransparency and the Microsoft Zune XP theme. With these three packages, I got more than I needed, and they're all free. I ended up unselecting the toolbar and start button transformations from the vista transformation pack; I don't care for the tool bar, and the Start Button just wasn't quite where I think it should be: you can't right-click on the icons, and there's just a bit missing. Still, it makes for a great user experience, without a lot of the Vista negatives.

Desktop Search for Windows x64

Windows released version 4 of its desktop search recently, and I must say that it (mostly) works well. With the Vista desktop, one simply can begin typing a search string at the start menu, and Windows will present the search results there as you type.

The problem: UNC indexing isn't apparently supported in the 64 bit environments, at least not with Server 2008, and the network shares I want to index are stored on Windows Server 2000 boxes: those won't run the new indexing tool.

So what to do?