21 May 2020

Breaking into an operational UniFi Cloud Key

A fellow on a group I follow was taking over from another group who was managing a RV Park's UniFi network. The old group wouldn't provide credentials for the onsite cloud key (a good reason to be rid of them).

Rather than go to each device and reset it in order to adopt them, another user (John Goggan at RFM Tech) suggested the following:

1. Reset the Cloudkey by holding down the reset button for more than 5 seconds.
2. SSH to the CK -- login with default ubnt/ubnt. Leave this sitting for now.
3. Log into the CK (not Controller) web interface with the default ubnt/ubnt. It'll force you to put in a new password -- do that.
4. Stop the Unifi Service.
5. Restore the latest backup -- there should be one there.
6. Start the Unifi Service back up.

The web interface should now show options to log into the CK or the Controller side. Cloudkey login is still ubnt and the password you set above. The Controller password is still unknown, but is up and running from that latest backup you just restored.

Now you go back to that SSH session that you opened earlier that is just sitting there and reset the password on the admin account. First, you find the admin login with this from a SU prompt:

mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"

That will give a list of all admin accounts (often just one). You then force a new password into that account with something like this:

mongo --port 27117 ace --eval 'db.admin.update( { "name" : "[User Found Above]" }, { $set : { "x_shadow" : "$6$9Ter1EZ9$lSt6/tkoPguHqsDK0mXmUsZ1WE2qCM4m9AQ.x9/eVNJxws.hAxt2Pe8oA9TFB7LPBgzaHBcAfKFoLpRQlpBiX1" } } )'

Note that you need to put the admin account into the "[User Found Above]" spot. And that hashed password above in my example is actually the word "password" literally.

You've now found the admin login and reset the admin password on the Controller to "password". Go back to the main web interface and log into the Controller GUI using those.
You're now logged into the Controller as the admin. You can then do whatever you want as usual, whether that is to continue using the on-site Cloud Key or migrate the the client to a cloud-based Controller.

31 December 2014

OSX Yosemite Hackintosh install on DH61AG

A friend of mine has been a huge fan of PC hardware used to build inexpensive Mac OSX systems, and suggested I should as well, by handing me an Intel motherboard installed in a heavily modified Sun IPX case. It looks odd, but is geekily satisfying.

In any case, for a while, I have run OSX Mavericks (10.9) with varying (and diminishing) degrees of success. Every time I applied updates to 10.9, something would either stop working (like sound), or would work less well.(like video performance or any use of Flash). Months after the release of Yosemite, I decided it was time to start with a clean slate, so I bought a 240GB Crucial SSD mSATA drive and went through the steps here.

Of course, not everything went to plan - otherwise, this would not be a very interesting article!

Motherboard: Intel DH61AG, 8GB RAM
Disk: Crucial M500 240GB mSATA internal SSD
External USB Bluetooth adapter: IOGear GBU521
External USB Audio adapter: Sabrent AU-MMSA
Apple TrackPad


In MultiBeast, I started with a minimal group of items:
EasyBeast
ALC892 audio (on-board audio chipset)
TRIM patch (because I am not using an Apple SSD)
AppleIntelE1000e v3.1.0 (Network driver)
1080p Display Mode (because I have a 1080p monitor - might not be needed)
Verbose Boot (to see any issues that pop up as the system boots)

There were a few challenges that came up - most I could fix (kernel panics, due to my own error), and another I simply punted and worked around (no audio).

This board is small, and is pretty simple. It has Realtek ALC892 audio and Intel's HD3000 video, and is mostly compatible with the general installation steps. There are a few items that will be necessary if you are doing the same thing.
USB Boot issues: The USB3.0 ports don't work properly with OSX when booting the USB stick, so use the USB 2.0 ports.

Boot failure after install (Boot0 issue): The instructions here were exactly what I needed. I chose a Crucial M500 240GB mSATA SSD drive, and it has the "problem" configuration. I ran into kernel panics when I did this the first time, but it was because I didn't run the "dd" command properly - I wrote to disk0s1, when the instructions say to write to disk0s2.

Audio: The on-board audio was problematic with the original Mavericks install, and before the installation of Yosemite was not working at all - I had retreated to the less-elegant Sabrent AU-MMSA, a simple but reliable solution to the issue. Following the instructions did not yield working audio, so I tried an alternate solution in this thread that had helped others - to no avail. I went back to the Sabrent USB audio adapter, and audio is working fine with that.

The system seems reliable - power save is working fine (this is a desktop, and it comes in and out of standby just fine). I'm happy with the result thus far!

16 January 2014

CentOS 6 under VMware ESXi 3.5...

CentOS, a "genericized" version of Red Hat Enterprise Linux, has been my server OS of choice for several years now. It has all the acceptance and compatibility of Red Hat Enterprise, without the heavy cost for updates. It has a long support lifespan, and follows the policy of backporting patches, so updates should not affect the configuration of running services.

My employer is releasing a brand new version of their core software offering, and I have been working to put together a new template image from which we can deploy new systems. With the relatively recent release of Red Hat Enterprise Linux 6 (and thus CentOS 6) and the major updates to the software that came with that, it seemed the obvious choice from which to assemble this new template.

In our hosting environment, we are running VMware Infrastructure 3i, using ESXi 3.5. I have plans to upgrade the hosts to a much more current version of vSphere, but the window for that has not yet presented itself! All of our production VM guests are using the vmxnet ethernet adpater.

Building the template in this environment proved easier said than done - The OS would install just fine in the template VM (I went with a "minimal" install, so as to keep the template as lightweight as possible), but once I tried to deploy a second system from the template, I could not get the network to come up. The VMware Tools and associated drivers (when downloaded from a 3.5 update 6a host) would build with no trouble.

After several false starts and ample searching, I found that there had been a few changes made to the behavior of device detection in the switch from RHEL 5 to RHEL 6, and the impact that was having was being felt in the changes that happen to a VMware network interface when one deploys a new cloned VM from a template.

Whenever you deploy a clone from a template, you have a VM that is identical in *most* regards to the template - except for a few minor identifiers, as well as a new MAC address on the cloned system's network adapters. This change leads udev to behave as though the adapter is new (and that the adapter with the template's MAC address is simply not present - but the configuration remains). As such, you have a eth0 that will not start, and an eth1 that is not configured.

Simple solution, based on findings at Aaron Walrath's blog:

On any template from which you will be deploying CentOS 6 machines:
Step 1: Remove /etc/udev/rules.d/70-persistent-net.rules
Step 2: Remove the HWADDR entry from /etc/sysconfig/network-scripts/ifcfg-eth0 (left in default DHCP configuration)
Step 3: Shutdown the system, convert it to a template

You should now be able to deploy CentOS 6 (or presumably RHEL 6) without network issues.

Display driver frustration

I use an older (4.5 years old) Dell Precision M4400 laptop running Windows 7 64-bit at work, and while it is certainly getting a bit long in the tooth, it has worked well for me. My demands are relatively light - I use most of the 8GB of RAM it has for web applications and browsing, and a few other applications. I don't put the graphics processor to the test much, aside from having a second Dell display connected via DisplayPort. Both displays were operating just fine at 1920X1200.

As time has gone on, however, the newer drivers for my graphics chipset have started causing a very annoying issue. Power saving behavior incorporated into the driver (called "Powermizer") is not compatible with the firmware Dell has made available for my laptop. As a result, if a fairly current version of the nVidia Quadro FX 770M graphics driver is installed, the laptop will blue screen (with a STOP 0x00000116 error). Safe mode worked to prevent this from happening, but prevents use of a number of system items. Simply removing the driver was insufficient - Windows 7 would install the "current" driver from Windows Update, and the blue screen would happen on the next normal reboot.

Solution: I uninstalled all nVidia driver components (in Control Panel) and installed only the following parts of the driver package:
nVidia Graphics Driver 275.33
nVidia nView 135.85

I also downloaded a piece of freeware called Powermizer Switch which (via registry settings) disables the Powermizer feature that causes the blue screen. I downloaded it from here.

Where before, the system would blue screen on login or would simply say "Unable to save Display Settings" when I would attempt to enable the external display - now it works just fine, as it has for 4.5 years.

Conclusion: If you are happy with how something works, resist making changes, applying updates, etc. You never know what might break, and further, you don't know if your "update" will be reversible!

10 August 2011

VMware certificate issues!

Here and there I post some interesting technical detail I run across, but this one will be pretty esoteric for most.

I currently manage several VMware Infrastructure 3i clusters (ESXi 3.5). I don't upgrade on a regular basis, because, well, these systems just run. They're not highly exposed (they're behind a firewall) and none of the host ports are exposed to the public internet. That said, an upgrade to VMware 4.1 is forthcoming!

As a result, I didn't become aware that VMware has a certificate on their systems against which patches are checked - and that this certificate was expiring in June 2011.

Using the VMware Infrastructure Update tool, I tried to update the ESXi systems I have at my DR site (in preparation to update those in production), and while one updated without trouble, the second failed, with "Signature check failed." in the esxupdate log (in /var/log/vmware/, if you're logged into the console on the host.)

Because this is an ESXi system, I didn't have the (relatively) easy RPM-based update mechanism that the ESX systems have, and all of what I could find from VMware indicated the same thing - that I needed to get the most recent version of ESXi 3.5 on an ISO, boot from that and perform the upgrade that way.

That seemed like way too much work, in particular because these machines are 1975 miles away from me.

The contents of the particular ESXi offline patch file I needed (ESXe350-201105401-O-SG, downloadable here includes three components - firmware, VMware Tools, and the Virtual Infrastructure Client.

The patch file is in a Zip format, though ESXi has no "unzip" tool, so I opened that archive and pulled out the three zip files it contained. The one that matters is the one with the firmware (in this case, ESXe350-201105401-I-SG.zip).

I extracted the folder contained within it (ESXe350-201105401-I-SG) to the desktop on my Windows workstation. I then uploaded the folder to a datastore reachable from the host.

At this point I verified that no VMs were running on the host, and I switched it to maintenance mode.

Not knowing what all I would need to execute in this directory, I got on the console (I enabled SSH a while ago), and navigated through the filesystem into the ESXe350-201105401-I-SG folder (in my case, it was in a folder off the root of a datastore called "DR-Test", so /vmfs/volumes/DR-Test/update/ESXe350-201105401-I-SG). The important script therein is "install.sh", and as it was not set executable (it was -rw-------), I performed a "chmod 755 -R ESXe350-201105401-I-SG", so the script could run.

I then ran the script (typing "./install.sh"). The script ran a quick filesystem check, then indicated progress with percentages (0%, 14%, 28%, ...). Once it was finished, I went back to the VMware Infrastructure Client and rebooted the host.

In a few minutes, I was up and running the new version ("vmware -v" showed "VMware ESX Server 3i 3.5.0 build-391406.

Let me know if this helps you!

Thanks to VMwareWolf for the good info.

12 November 2010

Blogging is hard

I initially started this blog because of a challenge from my friend Naomi Takeuchi - she decided to start blogging *daily* (and she did, for quite a while).

I knew that I would never be able to do that, so I just posted sporadically. And then 16 months went by, and I hadn't posted.

No good.

So what keeps me from posting? I certainly want to make sure I'm writing something worthwhile, something of value. I know not many care about the minutia of my daily life, as we all have that - and my particular minutia is no more interesting than anyone elses'!

I certainly can truthfully claim that I am busy - but really, who isn't? I love traveling and visiting friends, but weekends where I get stuff done are particularly satisfying. Of course, combining the two is even better!

That said, the real reason is the constant struggle to make posts worthwhile - when really, posts that are "good enough" would yield not only more content, but likely are better than I think they are. This is not applicable only to my highly irregular blog postings - it is applicable to my entire life, it seems!

It is a case of Voltare's adage: Perfect is the enemy of the good (or to paraphrase, Perfect is the enemy of done.) How many projects have I postponed, half-completed, or spent WAY too much time on? Too many to count. I have to stop trying to achieve that 100% perfect, because the 80/20 rule applies: the last 20 percent takes 80 percent of the time!

This is solvable, with deliberate attention to how I work on things - and it does not mean that I will work with no attention to detail. It is a fuzzy balance between detail and speed.

But it is not the only challenge...

16 July 2009

Keep your smile intact!

This will sound a bit like an advertisement, but it isn't - I am just a happy customer passing on what I have found...

---

I don't like going to the dentist, though I'm not phobic about it. Up until a year ago, I was always really bad about flossing until a few weeks before my next dentist appointment - and mainly because I didn't want that regular speech about how important it was to floss.

I know it is important for me to take good care of my teeth. It is a very rare occasion that I go to bed without brushing - and because I'm so easily distracted, I often would find myself brushing for 5 minutes, because I'll lose track of where my brush has been...

I was pleased that my dentist told me I was "dentally boring" two years ago, though he still indicated that I needed to floss more. This was my third visit to him after about a 4-year hiatus from going to the dentist (which was preceded by a 5-year hiatus from going to the dentist), so I figure I must have pretty good teeth!

Still, I got to thinking about it - I do want my teeth to last me as long as possible. While I don't like going to the dentist, I like oral surgery even less. Dental pain is like bone pain - best avoided!

With that in mind, I started looking at how I care for my teeth. I had been satisfied with my regular toothbrush - toothpaste was the most variable item in my oral hygiene. The dentist had suggested one of the ultrasonic toothbrushes (like the Sonicare or Oral-B Sonic), but I thought they were way too expensive (over $70), considering the cost of a perfectly effective regular brush was well under $5.

When I went to my parents'-in-law in Colorado during Christmas 2006, I discovered that I had somehow left my toothbrush at home. Stopping at the Super City Market in Montrose, I found the Oral-B Sonic Complete toothbrush that my dentist had recommended on sale - so I went ahead and took the plunge.... and I have never looked back.

It takes a little bit of getting used to it, but it makes good brushing incredibly easy. No need to really "brush" - just apply a little pressure as you run it over the surfaces of your teeth, and it does an excellent job. I don't like tartar-control toothpaste (too gritty for me), and this does an exceptional job of keeping it under control with regular toothpaste. I do not like that it has a "non-user-replaceable" NiCd battery, but as of now, I'm still using the original battery. Generally, the battery typically lasts about 2 years, and it is tricky to replace. Don't just put it on the charger after every use - I charge mine just once a week. New replacement heads are also inexpensive and available on eBay.

That said, it still doesn't prevent me from needing to floss. My main issue with flossing is wrapping that floss around my fingers and having circulation cut off as I struggle to get the floss between my tightly-spaced teeth!

The solution I currently use is the Reach Access Flosser (on the right here). I don't have to put my fingers in my mouth, it works very well, is convenient, and the floss is quite durable!

One other item - and I only heard this recently, from my hygenist - that it is best to floss first, then brush. The only reason they brush then floss you is to get the polishing media out from between your teeth!

Certainly, do what you think is best, is most cost-effective and comfortable, but don't just brush as you always have simply because of inertia. Technology has advanced - leverage it to your advantage!

Personal scent care...

As a proper citizen of the United States, I concern myself with personal hygiene. I brush, I floss, I (try to) make myself look presentable.

Scent has been a somewhat vexing item, though. I was never been a fan of smelling like typical deodorant/anti-perspirant, so I chose unscented. If I wanted a scent, I'll reach for my cologne.

It wasn't until college that I started to think more about picking a scent. I didn't grow up in a particularly "smelly" household, so I didn't think about it much. But as I met people who applied a scent I liked, I started to consider it more.

Add in the fact that I a) don't sweat much normally, and b) have read enough about the risks posed by aluminum, the main sweat-reducing ingredient in modern anti-perspirants, to feel like I should avoid them, and I'm lead to choose the simple deodorant. Not a fan of roll-on or other wet/gel-based application, I use a stick.

Trouble is, deodorants don't typically come in "unscented", and as I said, I don't want to smell like... deodorant (or non-deodorant). I tried an unscented "Kiss my Face"-brand unscented deodorant from Whole Foods, and it just didn't hold up through a normal day.

What I did discover during my quest was that both of the colognes I like (Curve for Men, shamelessly stolen from my brother, and Halston Z-14 from high-school friend Brian Rockwell) both come as a deodorant stick as well. Yes, it is more expensive up front than buying a typical stick of Sure, but it takes me at least 6 months to go through one $10 stick (which I can buy least expensively on eBay). And it lasts a long time - I smell just fine over 48 hours later!

Let's think about that for a second - the smell I want to have, lasts a long time, cost-effective... it's a complete win!

So, consider that the next time you're putting on your current scent (or non-scent) - Do you like how you smell? Find a scent you like and make it yours!

20 January 2009

Protect your data!

As previous posts have made clear, I am a bit of a packrat. I might need that 24V AC power supply sometime, so it goes in the power supply drawer, along with MANY others.

Needless to say, this collective nature applies to the digital realm as well. Over the past 20 years, I have collected a terabyte or few of digital data. Between a decade or so of email, amusing pictures, sound samples, documents and all my digital media files, I maintain a pretty good-sized file server at home to keep all this data in one place.

Keeping it organized is certainly an omnipresent challenge (as it is everywhere else in my life), but I'm less concerned that it will be lost now.

When the 10-year-old computer that was my home server finally refused to boot even a newly-installed OS, I took the opportunity to build anew the server and tackle the issue that had caused me concern for a few years - how to back up all the important stuff?

DVD media has a lot of capacity, but once you get to a certain amount of data, it becomes a bit cumbersome to burn all those discs. Also, as the data changes, how do you keep track of the new from the old on all that separate, often read-only media?

I liked the online backup options much better, as I have good cable-based broadband at the house, and their software will track the changes to the files. However, in order to leverage best the inexpensive "unlimited" online options, the client must be installed on a "workstation" OS - such as Windows XP or 2000 Professional. The second caveat is that the backup software is smart enough to only back up data on locally-attached drives. It will not include mapped network drives or USB-attached volumes in its backup set.

Much as I like Windows 2000 Pro, I figured that if this system was going to have the longest legs, it was best to stick with something that wasn't already out of current support, so Windows XP Professional it was. All the "server" apps I needed it to run (TiVo Desktop, Rio Receiver server, VMware server, as well as file/print sharing) would run fine there - all that was missing was a DNS and DHCP server, which I can get by without for the moment.

Trouble was, I didn't have much extra space on the XP server I had built. It was an amalgamation of various drives, and only one disk was protected from failure by a second mirrored disk. Much as I liked having the online backup, I'd much rather protect from failure in the first place. But if I had a second server, how would I back *that* up? I only wanted to have one server and backup set to maintain.

Enter the home SAN. I have worked with UNIX systems for a long time, and thought I might have found a loophole - iSCSI-attached volumes are block devices just like local disk. Would my backup software (Carbonite) see through my ruse and refuse to back up the data on those "locally attached" iSCSI volumes?

I bought several big drives on sale and installed them into one chassis, and installed Openfiler. Openfiler is a general-purpose storage device - it can act as a Windows file server, as an NFS server or as an iSCSI SAN device. It is not terribly easy to figure out if you are tech-challenged, but it is a worthy alternative to buying a "real" SAN. The system is flexible and permits you to build RAID volumes in software as well as in hardware. I wholeheartedly recommend gigabit ethernet hardware for communications between the server and the SAN (if you can make the whole path speak Jumbo Frames, so much the better) if you'd like performance to be as good as it can be.

Am I happy with what I've assembled? Thus far, yes. Speed to the SAN-attached disks is not horribly slow (between 75 and 200 Mbit), mainly limited by the speed of the controller card. I can always add additional space to the server by adding more drives to the SAN (I have 3 free SATA controller ports). And best of all, the Carbonite software *does* backup the SAN disks.

18 September 2008

Windows device cleanup!

Ever wonder how Windows remembers (read: doesn't need to install drivers every time you connect it) your USB drive, external monitor(s), DVD-ROM drive, etc? It keeps track of everything that it ever detected (through Plug and Play or otherwise).

Forever.

While researching VMware physical-to-virtual (P2V) and virtual-to-physical (V2P) conversion, I couldn't figure out why I kept receiving error messages about an IP address configured on an interface that was no longer in the system. I did some digging, and found this Microsoft KB article, which outlines the two-step process to finding all these hidden devices (which can cause some unintended conflicts).

Have a look at your system, and see just how much old junk you can pull out of there!