How To Form A Nonprofit Public Charity In About 1 Year

posted Aug 6, 2011 8:36 AM by Paul Valentino [ updated 8 hours ago ]
It all started with an idea in the year 2010 at VMworld in San Francisco as outlined on the page:http://www.vcommunitytrust.org/origins
Even though we knew very little about nonprofit organizations we were confident that we would be able to figure things out with the help of the community. We were right; people like @clinek, @SirStan and others came forward to help review our 1023 Application as well as other business documentation. As a result of this assistance we were able to avoid many common pitfalls that companies face when starting a nonprofit organization. Also, keep in mind that the majority of our efforts were coordinated through social media such as twitter and facebook and continue to be to this very day. We have board meetings using Skype due to the distributed nature of our team; we use twitter, facebook, blogging and google apps extensively for providing updates, collaborating on documentation or disseminating information. We've even had the great pleasure of participating in a podcast with our good friend @Niketown588. We would not and could not exist in our current form without these social media resources.
The Office of the Secretary of State and MN Council of Nonprofits websites proved to be key resources for helping to determine requirements for establishing a nonprofit corporation in Minnesota. A wealth of information for establishing a 501(c)(3) nonprofit organization was also found at the IRS web site. Furthermore, one of the greatest forms of assistance came from reviewing examples of other nonprofit 1023 applications, Articles of Organization and Bylaws. Many were found on the web, by request (public charities must provide copies of certain documents for a small fee upon request if they don't already publish them online) and by friends who are members of private foundations and public charities. Of course, we needed to apply our own business plan and mission when drafting our business documents but the examples provided a wealth of direction for satisfying all of the required elements, especially in the case of the attachments to the 1023 Application.
After choosing our name we needed to confirm that it was available. Although it was only required that the name be available in MN, we did a more extensive search to ensure that we wouldn't have any conflicts with naming for companies in other states or countries. We also made sure that we wouldn't have any issues with registering our domain name. To confirm availability in MN we used the Name Availability tool on the Secretary of State website. Once we felt comfortable that we wanted to move forward with the name we filed a name reservation form online with the required fee of $45.00 at the time of our filing September 20, 2010. We also filed for our EIN online with the IRS being careful to follow the instructions for a nonprofit.
We then spent the next three days researching the requirements for a nonprofit organizations Articles of Organization and Bylaws keeping in mind that we intended to apply for 501(c)(3) tax exempt status with the IRS. Amazingly, we had a fully drafted and reviewed set of documents which we submitted on September 23, 2010 with the $80.00 fee and obtained our Certificate of Incorporation as a Minnesota nonprofit formed under 317A on September 24th. The key thing to remember with your business filing is that it must be renewed every year to maintain a nonprofit status; in our case we must go to the Minnesota Office of the Secretary of State siteOnline Annual Renewal Filing page to stay current with our filing (No fee required unless a name change, address change, or registered agent change dictates an Amendment to Articles and associated $45 fee is required for online filing). Similarly, we must file form 990 annually with the IRS and may be eligible to file e-postcard990-N if donations remain below $25,000 per year.
At this point the fun began. We spent the next three months completing the 1023 Application for 501(c)(3) and the associated attachments. When you view the document links below it will be fairly obvious why three months were required, especially considering that we are full-time employees and were doing as much as we possibly could in the off hours (wee hours of the night). With business plan in hand and all the examples we could muster out of the interwebs as well as friends, we plugged away and were able to file on January 11, 2011 with the required $400 fee (fee could be larger for company expecting greater income). Then the waiting game began; the IRS processes 1023 Applications on a first come first serve basis so the time to wait will vary based upon volume of applications.
Now it is worth noting that even if you file the appropriate change of address forms with the IRS, the department processing your 1023 application wont get that update and inevitably continue sending notifications to your old address, so be sure to send a copy of any change of address forms to the address you sent the 1023 Application to, or if you've already been assigned an agent you may send them a fax with the information (Can you tell that we don't know this from our personal experience :-). Once our agent was assigned, the process was rather painless as she proved to be very helpful. We simply needed to file one Amendment for Article IV (If you copy the verbiage from this Amendment rather than using what we submitted in original Articles above you can save this step and the $45 fee that goes with it) and answer a few simple questions. Once we faxed all the information back it was only a matter of a couple of weeks before we received our letter of determination. Once we did receive the letter it was only a matter of a couple days after providing the required documents to the merchants before we got our Donation buttons up and running again for both Google Merchant and PayPal.
Yay! On August 4th, 2011 the LOD arrived stating we are officially a tax exempt nonprofit public charity.
Some other considerations were the creation of a website and establishing nonprofit merchant accounts for accepting donations. We chose Google Sites and Google Apps in an effort to ensure no monthly administration fees and for its ease of use. So far we've been perfectly willing to accept the limitations for customization of our site because we'd much rather not have to rely on public donations to cover any expenses other than certification and training costs. In hindsight, it would have been better to wait for our letter of determination before establishing merchant accounts because they ended up disabling our ability to accept donations shortly after we were setup because we did not have a letter of determination yet. It did not help matters that we sent all of our filings and a copy of our submitted 1023 Application to the merchants either.
We wanted to ensure that public donations would primarily service the needs of the candidates and we're proud to say that less than $30 of our donations to date have been used for administrative expenses. The board of directors contributed all of the fees for the 1023 Application and all of the business filings; we only needed to utilize a small amount of the donations to obtain certified copies of our business documents for banking purposes. This is also a factor for choosing not seek paid professional services but rather volunteer professional services. Our primary purpose is to further the cause of education and get people certified in a way that ensures real world success; therefore, we gratefully accept volunteer assistance from qualified professionals to meet our goals.
We hope you find this information useful and of value. If so, please consider making a financial, software, and/or hardware donation. Every contribution helps tremendously.
Regards,
Paul Valentino - Chairman
vCommunity Trust Inc.
@vcommunitytrust
@sysxperts

Please donate to vCommunity Trust Inc. to help the economically challenged to obtain their technical education and certification

$
       
Posted by Picasa
 
Posted by Picasa
Finding potentially unused IP addresses or invalid DNS
Disco Dancing with iTach
Likewise Open Tips

Finding unused IP addresses and invalid DNS entries

The method used in the example below will not help eliminate all invalid DNS entries or find IPs that are live yet unused, however, it will provide a fairly efficient means of finding unused IPs that are not pingable at the moment and provide a list of potentially invalid reverse lookup entries which in turn would also give you clues you need to start looking for invalid A records, etc.

For this example I am going to assume we want to find unused IP addresses and potentially invalid DNS entries for the network range 192.168.1.1-100

From the prompt of your linux host with nmap installed run:

nmap -v -sP 192.168.1.1-100|grep down |for i in `awk '{print $2}'`;do host $i;done

  • nmap -v -sP 192.168.1.1-100 performs ping scan and returns status for specified range
  • grep down - filters the list to only return non-pingable hosts
  • for i in `awk '{print $2}'` - filters the list further to only return the IP addresses in a loop to do the host [ip address] lookup for each IP returned

One could easily substitute host with nslookup or dig but I chose host to streamline the output for readability.

Bottom line is that if you see output similar to the following:

Host 5.1.168.192.in-addr.arpa. not found: 3(NXDOMAIN)

Then you can probably safely use 192.168.1.5 for a new device and DNS entry although it would be safer to scan the DNS table by IP for forward lookup entries first.

On the other hand, if you see output similar to:

5.1.168.192.in-addr.arpa domain name pointer name.domain.com

Then you most likely have a system that is shutdown at the moment which uses that address or an invalid/outdated DNS entry to clean up.

One could easily schedule this command to run with cron and send output to an email or ticketing system for regularly scheduled DNS maintenance

Generate Wildcard SSL for Apache 2.x using OpenSSL
openssl req -new -newkey rsa:2048 -nodes -keyout star.domain.key -out star.domain.csr
Convert an Apache Cert and Key to IIS format
openssl pkcs12 -export -out star.domain.pfx -inkey star.domain.key -in star.domain.crt
Import Key into IIS from pfx format:
  1. Start > Run
  2. Type in MMC and click GO
  3. Go into the Console Tab > select Add/Remove Snap-in
  4. Click on Add > Double Click on Certificates and click on Add > OK
  5. Select Computer Account
  6. Select Local Computer
  7. Click the + to Expand the Certificates Console Tree
  8. Right click on the Personal Certificates Store
  9. Choose > ALL TASKS > Import
  10. Follow the Certificate Import Wizard to import your Primary Certificate from the .pfx file. When prompted, choose to automatically place the certificates in the certificate stores based on the type of the certificate.
  11. In your IIS manager, right-click on the site that you would like to use the certificate and select properties.
  12. Click on the Directory Security Tab and hit the Server Certificate Button. This will start the server certificate wizard.
  13. If you are asked what you want to do with the current certificate on the site, choose to remove it, finish the wizard, and click the server certificate button to run the wizard again.
  14. Choose to 'Assign an existing certificate' to the site and choose the new certificate that you just imported and supply the password used to create the pfx file.
  15. Finish the certificate wizard.
  16. Restart the server.

Extract values within quotes from com...

Extract values within quotes from command output on Linux using perl

For example:
To obtain all values within quotes from the output of a jstack command you could

 ./jstack <pid> |perl -lne 'print $1 if (/"(.*)"/)' 

and if you wanted a count of how many quoted values there are

 ./jstack 23545 |perl -lne 'print $1 if (/"(.*)"/)' |wc -l

Oracle on Linux RMAN from Netbackup t...

Oracle on Linux RMAN from Netbackup to Avamar Backup Client


I recently migrated some Oracle 10g and 11g RHEL 5 VM’s and Physical boxes from Netbackup based clients to Avamar clients with the RMAN plugin. I will create a separate post regarding automation of the AvamarClient setup and focus on the RMAN configuration for event/client driven backup here.

First thing I did before automating any of the processes was to download the required docs and binaries from the Avamar web interface. There is a Documents and Downloads link at the bottom of the page of the following sample url:

http://avamarservernameorip

Then I downloaded the Avamar Oracle Client User Guide and the appropriate binaries for the platform from the right hand column, for example:

AvamarClient-linux-rhel4-x86_64-5.0.101-32.rpm

AvamarRMAN-linux-rhel4-x86_64-5.0.101-32.rpm

Also, ask your friendly EMC Avamar installer to provide a copy of AvOracleRMAN.pdf and AvOracleDatabasePrep.pdf which provide a lot more detail than the Client User Guide.

Installation and registration of the Avamar Client

1. As root cd to location of downloaded rpms

2. Type rpm -ivh AvamarClient-linux-rhel4-x86_64-5.0.101-32.rpm

3. Type /usr/local/avamar/bin/avregister

4. Enter the fqdn of the Administrator server when prompted [avamarserver.domain.com]

5. Enter the Avamar server domain [clients] when prompted

6. The Avamar Client installation is now complete

Installation of the AvamarRMAN Plugin

1. As root cd to location of downloaded rpms

2. Type rpm -ivh AvamarRMAN-linux-rhel4-x86_64-5.0.101-32.rpm

3. Update iptables with following rules to allow secure backups and also update any firewalls to allow backup through these ports:
-A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 28002 -j ACCEPT
-A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 27000 -j ACCEPT
-A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 29000 -j ACCEPT
-A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 8672 -j ACCEPT

4. Create a new user account that will have access to backup/restore jobs on the domain containing the Oracle backup jobs using the Avamar Administrator Console.

5. Create a my-avtar-flags.txt file for linux in /usr/local/avamar/bin containing:
–pidname=Oracle
–pidnum=1002
–logfile=/usr/local/avamar/var/avtar.log
–vardir=/usr/local/avamar/var
–id=[userid from prior step]
–ap=[password from prior step]
–path=[/domain/oracleservername]
–expires=[number in days]

6. Create RMAN scripts (avorabackup and avorarestore) that can be launched with cron or scheduler of your choosing, examples below:

launch this example backup script from a file named avorabackup as follows:


       rman target / nocatalog @avorabackup


run {

configure device type sbt clear;

allocate channel c1 type ‘SBT_TAPE’ PARMS=”SBT_LIBRARY=/usr/local/avamar/lib/libobk_avamar64.so, ENV=(PATH=/bin:/usr/bin:/usr/local/avamar/bin)” format ‘%d_%U’;

send ‘”–flagfile=/usr/local/avamar/bin/my-avtar-flags.txt” ‘;

send ‘”–sysdir=/usr/local/avamar/etc” “–bindir=/usr/local/avamar/bin” “–vardir=/usr/local/avamar/var”‘;

configure retention policy to recovery window of 10 days;

configure retention policy to redundancy 2;

backup database plus archivelog;

delete noprompt obsolete;

crosscheck backupset;

release channel c1;

}


launch this example restore script from a file named avorarestore as follows:


     rman target / nocatalog @avorarestore


run {

allocate channel c1 type ‘SBT_TAPE’ PARMS=”SBT_LIBRARY=/usr/local/avamar/lib/libobk_avamar64.so, ENV=(PATH=/bin:/usr/bin:/usr/local/avamar/bin)” format ‘%d_%U’;

send channel=’c1′ ‘”–flagfile=/usr/local/avamar/bin/my-avtar-flags.txt” ‘;

send ‘”–sysdir=/usr/local/avamar/etc” “–bindir=/usr/local/avamar/bin” “–vardir=/usr/local/avamar/var”‘;

restore database;

recover database;

release channel c1;

}


NTP Update PoSH for ESX

NTP Update PoSH for ESX

$Cluster = "<cluster name>"
$Hosts = Get-Cluster $Cluster | Get-VMHost
ForEach ($Host in $Hosts)
{
Remove-VmHostNtpServer -NtpServer "x.x.x.x" -VMHost $Host | Out-Null
Remove-VmHostNtpServer -NtpServer "x.x.x.x" -VMHost $Host | Out-Null
Add-VmHostNtpServer -NtpServer "ntp0.sysxperts.com" -VMHost $Host | Out-Null
Add-VmHostNtpServer -NtpServer "ntp1.sysxperts.com" -VMHost $Host | Out-Null
Get-VMHostService -VMHost $Host | Where-Object {$_.key -eq "ntpd"} | Restart-VMHostService Confirm:$false | Out-Null
write "NTP Server was changed on $host"
}

Enabling a VirtualBox Win7 guest to connect to 8021x

Enabling a VirtualBox Win7 Guest to Connect to 802.1x Corporate Network


Disable everything but the VirtualBox Bridged Networking Driver on the interface connected to the corp. LAN and also disable authentication as this will be handled by the guest OS.


 image


image



Disable VirtualBox on the interface connected to your Internet enabled network

image



Create 1 bridged interface and 1 host only interface on your VirtualBox Guest under Virtual Box Settings then power on Guest and go to Network Connections to verify

image

  image



On the bridged interface you will enable authentication for 802.1x and edit settings as follows.

image

 

 

Settings - edit servernames with your own Domain Controllers/802.1x auth providers

image



Additional settings - Set to User Authentication and replace credentials with your Domain auth in the form DOMAINNAME\username

On the Host Only interface set it to a static IP in the same range as that which is configured on the Host as shown under File > Preferences > Network


image

 

image



Now you should be able to join your Windows 7 guest to the domain and access corporate resources with 802.1x authentication.

And your shared local drive too if you added under Devices > Shared Folders

image


Enabling a VirtualBox Win7 guest to connect to 8021x

Enabling a VirtualBox Win7 Guest to Connect to 802.1x Corporate Network


Disable everything but the VirtualBox Bridged Networking Driver on the interface connected to the corp. LAN and also disable authentication as this will be handled by the guest OS.


 image


image



Disable VirtualBox on the interface connected to your Internet enabled network

image



Create 1 bridged interface and 1 host only interface on your VirtualBox Guest under Virtual Box Settings then power on Guest and go to Network Connections to verify

image

  image



On the bridged interface you will enable authentication for 802.1x and edit settings as follows.

image

 

 

Settings - edit servernames with your own Domain Controllers/802.1x auth providers

image



Additional settings - Set to User Authentication and replace credentials with your Domain auth in the form DOMAINNAME\username

On the Host Only interface set it to a static IP in the same range as that which is configured on the Host as shown under File > Preferences > Network


image

 

image



Now you should be able to join your Windows 7 guest to the domain and access corporate resources with 802.1x authentication.

And your shared local drive too if you added under Devices > Shared Folders

image


vDR locks snapshots upon failed backup

vDR locks snapshots upon failed backup

So if you've reviewed all the snapshot troubleshooting on the web and still have not found a solution to your problem you might be the victim of a bad vDR configuration.

We decided to give vDR a try in our Test and Dev environment to reduce backup licensing costs and ran into problem where if the vDR backup failed the snapshots would fill up the LUNs and we had no luck removing or consolidating them using any of the methods available.

The quick fix ended up being as follows:
1) Shut down the vDR appliance
2) Detach the disks with orphaned snapshots from the appliance
3) Verify and correct for space requirements on target LUNs
4) Create a new snapshot with vSphere client (or service console)
5) Delete snapshot with vSphere client (or service console)
6) All went well and we were back in business at this point

Investigating preventative measures at the moment, will update with findings.

OpenVPN

OpenVPN

This installation of OpenVPN applies to Ubuntu 9.10

sudo apt-get install openvpn  # to intall the openvpn server


Copy the required example files to /etc/openvpn 
cp -r /usr/share/doc/openvpn/examples/easy-rsa /etc/openvpn/
cd /etc/openvpn/easy-rsa/2.0

Build the Certificate Server
. ./vars
./clean-all
./build-ca

The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command:

# ./build-ca
Generating a 1024 bit RSA private key
............++++++
...........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [MN]:
State or Province Name (full name) [Minnesota]:
Locality Name (eg, city) [Andover]:
Organization Name (eg, company) [OpenVPN-TEST]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:openvpn1.sysxperts.com
Email Address [me@myhost.mydomain]:
Note that in the above sequence, most queried parameters were defaulted to the values set in the vars or vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above, I used "openvpn1.sysxperts.com".

Now build the OpenVPN server certificate and key
./build-key-server openvpn1
As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter "openvpn1".  Two other queries require positive YES responses, "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]".

Build client certificates and keys
./build-key pvalentino
./build-key user2
Remember to type the appropriate Common Name for each client when prompted, i.e. "username1", "client2", or "server3". Always use a unique common name for each client.

For greater security, instead of generating the client certificate and keys on the server, we could have had the client generate its own private key locally, and then submit a Certificate Signing Request (CSR) to the key-signing machine. In turn, the key-signing machine could have processed the CSR and returned a signed certificate to the client.

Build the required Diffie-Hellman parameters for the OpenVPN server
./build-dh

Now we will find our newly-generated keys and certificates in the keys subdirectory (/etc/openvpn/easy-rsa/2.0/keys). Here is an explanation of the relevant files:
FilenameNeeded ByPurposeSecret
ca.crtserver + all clientsRoot CA certificateNO
ca.keykey signing machine onlyRoot CA keyYES
dh{n}.pemserver onlyDiffie Hellman parametersNO
openvpn1.crtserver onlyServer CertificateNO
openvpn1.keyserver onlyServer KeyYES
pvalentino.crtpvalentino onlypvalentino CertificateNO
pvalentino.keypvalentino onlypvalentino KeyYES
user2.crtuser2 onlyuser2 CertificateNO
user2.keyuser2 onlyuser2 KeyYES
server3.crtserver3 onlyserver3 CertificateNO
server3.keyserver3 onlyserver3 KeyYES

-rw-r--r-- 1 root       root 4003 2010-01-22 17:41 openvpn1.crt
-rw------- 1 root       root  887 2010-01-22 17:41 openvpn1.key


Copy sample configuration files to /etc/openvpn for server side configuration
cd /usr/share/doc/openvpn/examples/sample-config-files
gzip -d server.conf.gz
cp server.conf /etc/openvpn/

Edit /etc/openvpn/server.conf as follows:
In my environment I'm using the following:
192.168.1.206 is the OpenVPN server interface and my internet access device is configured to NAT forward port 1194 udp to that address.  These settings can typically be found under Port Forwarding on a Netgear router or under Applications and Gaming Settings on a Linksys router.
10.8.18.0  is my VPN subnet
10.1.1.0 is another private subnet on my network

# Which local IP address should OpenVPN
# listen on? (optional)
local 192.168.1.206

port 1194

# TCP or UDP server?
;proto tcp
proto udp

;dev tap
dev tun

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key  # This file should be kept secret

dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

server 10.8.18.0 255.255.255.0

ifconfig-pool-persist /etc/openvpn/ipp.txt


# Push routes to the client to allow it
# to reach other private subnets behind
# the server.  Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
push "route 10.1.1.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"

keepalive 10 120

comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status /etc/openvpn/openvpn-status.log

verb 3

mute 20


OpenVPN iptables rules to allow traffic to local subnets attached to eth0 and eth1 on the OpenVPN server
without the need for a bridging config

iptables --append FORWARD --in-interface tun0 -j ACCEPT
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE

iptables-save > /etc/iptables.rules

Then modify /etc/network/interfaces like so in my case (NOTE the pre-up line)
This restores my iptables nat rules after a reboot:

auto eth0
iface eth0 inet static
    address 192.168.1.206
    netmask 255.255.255.0
    network 192.168.1.0
    gateway 192.168.1.1
        pre-up iptables-restore < /etc/iptables.rules
auto eth1
iface eth1 inet static
    address 10.1.1.200
    netmask 255.255.255.0
    network 10.1.1.0


For client configuration email, scp, or sftp a copy of client.conf to yourself for editing and providing to the clients ensuring that configuration is compatible with server side.  Below is example Tunnelblick client.conf which works with the server.conf above.  This client.conf is for a Mac using Tunnelblick with it's config stored under /Users/pvalentino/Library/Application Support/Tunnelblick/Configurations/client.conf.  Be sure to secure your private key on each client as well by removing group and other access with chmod go-rwx client.conf.

Tunnelblick for OSX client example: 
client

;dev tap

dev tun
;dev-node MyTap

;proto tcp
proto udp



# for me i use dyndns.org dyndns updater to keep my dhcp comcast address in sync with domain name
# you can get a free dyndns.org hostname and download the updater for free as well
remote openvpn1.sysxperts.com 1194

nobind

user nobody
group nogroup

persist-key
persist-tun


mute-replay-warnings

# Note that these files must be provided - ca.crt and client cert must come from openvpn server and key may come from server or from client depending on how you generate csr
ca /Users/pvalentino/ca.crt
cert /Users/pvalentino/pvalentino.crt
key /Users/pvalentino/pvalentino.key

ns-cert-type server

;tls-auth ta.key 1

;cipher x

comp-lzo

verb 3
mute 20

OpenVPN Windows client example:
For example, on Windows 7 64bit client install the OpenVPN client with default options, change the network connection name to MyTap under change adapter settings for the TAP-Win32 Adapter V9 interface.  Then create and save the file below into c:\Program Files(x86)\openvpn\config as client.ovpn.

client

;dev tap
dev tun

dev-node MyTap

;proto tcp
proto udp

remote openvpn1.sysxperts.com 1194

nobind

# Not valid on windows
;user nobody
;group nogroup

persist-key
persist-tun


mute-replay-warnings

# Note the use of double backslashes on a windows client and I put them in a folder I manually created under my users folder
ca C:\\Users\\pvalentino\\openvpncerts\\ca.crt
cert C:\\Users\\pvalentino\\openvpncerts\\client2.crt
key C:\\Users\\pvalentino\\openvpncerts\\client2.key

ns-cert-type server


comp-lzo

verb 3
mute 20

When you run the openvpn client on windows be sure to right-click and select run as administrator or the software will not be able to create necessary routing configurations for the tunnel.

After saving config and starting the application with administrator privileges you will have a new icon in your system tray.  Simply right-click and select connect to establish the tunnel.

If there are problems right-click the same icon and choose View Log to start the troubleshooting process.

Update pam.d files with FISMA complia...

Update pam.d files with FISMA compliant options

 
#!/usr/bin/perl
my $outpdir = '/etc/pam.d';
my $inpdir = '/etc/pam.d';
opendir(my $pamd, $inpdir);
my @pamddir = readdir($pamd);
closedir($pamd);
foreach my $file (@pamddir) {
        my $fileabs = "$inpdir/$file";
        if (-r $fileabs && ! -d $fileabs) {
                print "Processing $file:\n";
                open(PAMFILE, $fileabs) or die "Failed to open $fileabs: $!";
                my @pfLines = <PAMFILE>;
                close PAMFILE;
                open(DESTFILE, ">$outpdir/$file") or die "Could not write $outpdir/$file: $!";
                foreach my $line (@pfLines) {
                        chomp $line;
                        if ($line =~ /pam_rhosts_auth\.so/) { print DESTFILE "#$line\n"; }
                        else { print DESTFILE "$line\n"; }
                }
                close DESTFILE;
        }
}

Perl script to update FISMA compliant...

Perl script to update FISMA compliant kernel paramaters

 
#!/usr/bin/perl -w
use strict;

# Make timestamped backup for sysctl.conf and limits.conf
my $timestamp = `date +%Y%m%d%H%M`;
system("cp /etc/sysctl.conf /etc/sysctl.conf.$timestamp");
 
my $drpf = '1';
my $arpf = '1';
my $dasr = '0';
my $tmsb = '4096';
my $aasr = '0';
my $dar = '0';
my $aar = '0';
my $dsr = '0';
my $asr = '0';
my $ieib = '0';
my $dser = '0';
my $aser = '0';
my $tsyn = '1';
 
# Write out sysctl.conf
open OUTP, '>/etc/sysctl.conf.fisma' or die "Cannot write /etc/sysctl.conf.fisma: $!";
open SYSCTL, '/etc/sysctl.conf' or die "Cannot read sysctl.conf: $!";
 
while (my $line = <SYSCTL>) {
        chomp $line;
        next if $line =~ /^net\.ipv4\.conf\.default\.rp_filter/;
        next if $line =~ /^net\.ipv4\.conf\.all\.rp_filter/;
        next if $line =~ /^net\.ipv4\.conf\.default\.accept_source_route/;
        next if $line =~ /^net\.ipv4\.tcp_max_syn_backlog/;
        next if $line =~ /^net\.ipv4\.conf\.all\.accept_source_route/;
        next if $line =~ /^net\.ipv4\.conf\.default\.accept_redirects/;
        next if $line =~ /^net\.ipv4\.conf\.all\.accept_redirects/;
        next if $line =~ /^net\.ipv4\.conf\.default\.secure_redirects/;
        next if $line =~ /^net\.ipv4\.conf\.all\.secure_redirects/;
        next if $line =~ /^net\.ipv4\.icmp_echo_ignore_broadcasts/;
        next if $line =~ /^net\.ipv4\.conf\.default\.send_redirects/;
        next if $line =~ /^net\.ipv4\.conf\.all\.send_redirects/;
        next if $line =~ /^net\.ipv4\.tcp_syncookies/;
 
        print OUTP "$line\n";

    }
 
close SYSCTL;
 
print OUTP "net.ipv4.conf.default.rp_filter = $drpf\n";
print OUTP "net.ipv4.conf.all.rp_filter = $arpf\n";
print OUTP "net.ipv4.conf.default.accept_source_route = $dasr\n";
print OUTP "net.ipv4.tcp_max_syn_backlog = $tmsb\n";
print OUTP "net.ipv4.conf.all.accept_source_route = $aasr\n";
print OUTP "net.ipv4.conf.default.accept_redirects = $dar\n";
print OUTP "net.ipv4.conf.all.accept_redirects = $aar\n";
print OUTP "net.ipv4.conf.default.secure_redirects = $dsr\n";
print OUTP "net.ipv4.conf.all.secure_redirects = $asr\n";
print OUTP "net.ipv4.icmp_echo_ignore_broadcasts = $ieib\n";
print OUTP "net.ipv4.conf.default.send_redirects = $dser\n";
print OUTP "net.ipv4.conf.all.send_redirects = $aser\n";
print OUTP "net.ipv4.tcp_syncookies = $tsyn\n";
 
close OUTP;
 
# Write new file back to active config file
system("mv /etc/sysctl.conf.fisma /etc/sysctl.conf");


One liners

Bash One liners



for path in `awk '($3 ~ "ext2|ext3") {print $2}' /etc/fstab`;do find $path -xdev -type d -perm -0002 ! -perm -1000 >> /tmp/sticks;done

Where /tmp/sticks contains directory listing one per line with world writeable permissions and no sticky bit set i.e.
    /usr/openv/netbackup/logs/user_ops
    /usr/openv/netbackup/logs/user_ops/nbjlogs

Read lines in file /tmp/sticks and echo them out
    cat /tmp/sticks |while read dlist; do echo "${dlsit}";done

chmod the folders listed in the file by adding sticky bit (prevent other users with write from deleting anything but their own files)
    cat /tmp/sticks |while read dlist; do chmod +t "${dlist}";done


Read lines in file and echo them out
    while read dlist; do echo "${dlist}";done < <(cat /tmp/sticks)

find files and echo their names
    find /tmp -name 'sticks*' |while read tfile; do echo "${tfile}";done
 
find world readable directories
for PART in `awk '($3 ~ "ext2|ext3") {print $2}' /etc/fstab`;do find $PART -xdev -type d -perm -0002 -a ! -perm -1000 >> /tmp/sticks ;done
 
Change world readable directories to have sticky bit set
cat /tmp/sticks |while read dlist; do chmod +t "${dlist}";done
 
rm -rf /etc/exports if not used:
 if ! grep ^[^#] /etc/exports;then rm -rf /etc/exports; else mail -s "exports in use on `hostname`" pvalentino@sysxperts.com < /etc/exports;fi
 
User home directories should be 750 or less:
#!/bin/sh
find `awk -F: '($3 >= 500 && $1 != "nobody") {print $6}' /etc/passwd` -maxdepth 1 -type d -prune  \( -perm -g+w -o -perm -o+r -o -perm -o+w -o -perm -o+x \) -ls
 
Fix for home dir permissions:
find `awk -F: '($3 >= 500 && $1 != "nobody") {print $6}' /etc/passwd` -maxdepth 1 -type d -prune  \( -perm -g+w -o -perm -o+r -o -perm -o+w -o -perm -o+x \) -exec chmod 750 {} \;
 
Test for world writable files:
#!/bin/sh
for PART in `awk '($2!="/data" && $2!="/apps" && !/^#/ && $6 != "0") { print $2 }' /etc/fstab`; do
  find $PART -xdev -type f \( -perm -0002 -a ! -perm -1000 \) -ls;
done

Fix world writable:
#!/bin/sh
for PART in `awk '($2!="/data" && $2!="/apps" && !/^#/ && $6 != "0") { print $2 }' /etc/fstab`; do
  find $PART -xdev -type f \( -perm -0002 -a ! -perm -1000 \) -exec chmod o-w {} \;;
done
 
Fix log permissions:
find /var/log -type f -exec chmod o-rx {} \;
 
Find and log SUID/SGID System executables:
#!/bin/sh
for PART in `awk '(!/^#/ && $6 != "0") { print $2 }' /etc/fstab`; do
  find $PART -xdev -type f \( -perm -04000 -o -perm -02000 \) ! -path /bin/su >> /tmp/sgidfiles;mail -s "SUID/SGID files on `hostname` pvalentino@sysxperts.com < /tmp/sgidfiles ;
done
 
Find unowned files:
#!/bin/bash
for PART in `awk '(!/^#/ && $6 != "0") { print $2 }' /etc/fstab`; do
  find $PART -xdev \( -nouser -o -nogroup \) -ls;
done
 
FIX unowned files:
#!/bin/bash
for PART in `awk '(!/^#/ && $6 != "0") { print $2 }' /etc/fstab`; do
  find $PART -xdev \( -nouser -o -nogroup \) -exec chown root:root {} \;;
done

Ubuntu system account shell set to nologin:
rm -rf /tmp/sysaccts; awk -F: '($1!="root" && $1!="halt" && $1!="sync" && $1!="shutdown" && $3<500 && $7!="/bin/false" && $7!="/bin/sh" && $7!="/usr/sbin/nologin") {print $1}' /etc/passwd >> /tmp/sysaccts;cat /tmp/sysaccts |while read slist;do usermod -s /usr/sbin/nologin $slist;done

Redhat system account shell set to nologin:
rm -rf /tmp/sysaccts; awk -F: '($1!="root" && $1!="halt" && $1!="sync" && $1!="shutdown" && $3<500 && $7!="/sbin/nologin") {print $1}' /etc/passwd >> /tmp/sysaccts;cat /tmp/sysaccts |while read slist;do usermod -s /sbin/nologin $slist;done