Updating your godaddy certs during the G2 intermediate hierarchy to the TLS Root CA - R1 hierarchy

 

If you use GoDaddy TLS certificates you should be aware of some changes during the transition from the G2 Intermediate certificates to the new R1 Intermediate Certificates.

Browsers such as chrome are not taking the new R1 intermediate certificate and is labeling it as untrusted.  On IIS and Apache this is an easy fix by installing the R1 to G2 Cross Certificate into your intermediate certificate store.  However with apache tomcat it is not so simple a fix.

I have two servers that use apache tomcat and the configuration is a little bit different for each server and it is due to the software provider and how they configured it.  One is something called Horizon Web Services and the other is Papercut.

The following process using openssl worked for fixing horizon web services, however getting papercut was far more frustrating to fix.  You will need openssl installed I am using the version for windows, but this can also be done on Linux.  

First off when you download your certificates from GoDaddy, you will also need to go get the GoDaddy TLS Root CA - R1 to G2 Cross Certificate and the GoDaddy TLS Root CA - R1.  

The TLS R1 to G2 Cross Certificate will need to be installed in your intermediate certificate library on windows and the TLS Root CA - R1 will need to go in your trusted root certificate library.  On apache you will need to add the certs to your apache2 cert library typically located at /etc/ssl/certs/.  

For Apache tomcat, you will need to generate a new cert (I used a PFX PKCS#12 Generated certificate) including the GoDaddy TLS Room CA - R1 to G2 Cross Certificate as the certificate is just generated with the R1 intermediate certificate.  add the certs to your windows library as well if your hosting tomcat on windows otherwise you will need to add it to your certificate key.

PS C:\OpenSSL .\openssl pkcs12 -export -out tomcat.pfx -inkey "$PathToKey\$CertKey.key" -in "$Path2Cert\$CERT.crt" -certfile "$Path2Intermediate\$IntermediateCert.crt.pem" -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg SHA256

Once that was created I copied the cert to the tomcat server; now replacing the certificate in the server config was not enough; I had to append the certificate to the pfx using keystore-explorer.  So I Opened the Root-R1-Cross-G2.crt and made 3 different certs to append to the pfx file r1crossg2_1.crt, r1crossg2_2.crt and r1crossg2_3.crt as shown below.

Once that is done you will need to restart the service or computer for the changes in the certificate to take affect.  Chrome may lag behind if you don't shut the browser down and relaunch it after you added the certificates to the server.

For papercut I could not use the same process for updating the certificate.  No matter how many different times or ways I used openssl to generate the certificate; I would get a certificate error on the server for papercut.

What I eventually ended up doing was taking my tomcat certificate library for Horizon Web Services and using Keystore Explorer convert from the pxf (Save as) it to a jks format and put that in place.

That got the certificate to finally be recognized in chrome without issue.

How to make google calendar more secure

With the rash of spam and phishing attempts lately, I would recommend making the following changes to your google calendar settings to secure your account.  By default, Google Calendar automatically parses your emails for invites and displays them on your calendar before you even click accept.  If you see a calendar event you don’t recognize please don’t press any links in it and delete the event or label it as SPAM.

How to stop unwanted google calendar invitations.

Go to calendar.google.com -> Settings: -> General or click this link https://calendar.google.com/calendar/u/0/r/settings

Change guest permissions from “From everyone”

To either “Only if sender is known” or “When I respond to the invitation in email”   I am using “When I respond to the invitation in email”

With regards to the other permissions you will have to make a judgement call for what is best for how you would like to work.  When I set up a calendar event I don’t allow invited guests to change the event, however I do allow them to view who is invited and to invite others to the event.  

Depending on how you want to work you will either add/remove these permissions for the events you set up.  The other setting to modify is the Google Workspace smart features shown below.  You will want to make sure “Show events from Gmail” is unchecked.

Also be careful of any third party plugins or apps that may have access to your google workspaces account.

 

With at least those two settings changed your calendar will be far more secure.

Fix a windows network printer that is offline

How to fix a network printer that get's installed and shows offline.

By default SNMP is set to public, so when you are installing a network printer; you need to ensure you have all the information about the printer.  If you don't configure the SNMP of your print driver to the same as the printer it installs but shows up offline.  It also takes forever to install.

There are two ways to approach a resolution to this problem.  Install the driver then change the SNMP in the driver or setup the port and add the printer.  In my case I added the printer first so then I'm going to update the port.

Get the properties of the printer you want to edit in my case the 2525AC and go to ports select the port in use and configure port

Change the SNMP Status from public to what it you need it to be

Hit OK and close the printer properties.  It will take a few seconds but then the printer status will change from offline to ready.

Removing Show Recent History and Recently Open Documents from Windows Explorer

How to remove the Recent History and Recently Open Documents from Windows Explorer Using the Registry Editor

Press the Windows Key + R, type regedit, and hit Enter.

Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer on the left panel.

Look for the ShowRecent DWORD value on the right panel, or create it if it is missing by right-clicking, choosing New > DWORD (32-bit) Value, and naming it ShowRecent.

Double-click ShowRecent and change its value data to 0 to disable/remove the recent history, or 1 to enable it.

Then go to  

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced and change Start_TrackDocs to 0 to stop tracking recent documents.

Restart File Explorer or sign out and back into your account for the changes to work.

The end result looks like this

Crontab changes in Linux 26.04 vs previous versions

I use a small Linux server to control the turning on and shutting off our client stations with crontab.  The system I typically use is Ubuntu Server running on Hyper-V, I setup the server, enable WOL to turn them on and NET RPC to shut them down. I have been doing this since ubuntu 12.04.  and this is the first time where I've had to reconfigure my scripts to make it work.

Here is a sample of the crontab on versions of Ubuntu Linux (before 26.04)

00 21 * * 1-4 $USER    $PATH/$Script.sh

My crontab is setup so at 9:00 pm on Monday though Thursday the script "$Script.sh" is run as $User that is located located at $PATH 

However in Ubuntu 26 it throws an error when running the script as the $USER, so once I removed the user from the crontab now looks like this.

00 21 * * 1-4 $PATH/$SCRIPT.sh

Terminal of Cron throwing an error

Created a log file to catch the error.  Add >> /$PATH/$LOGFILE.log to crontab

After looking at the log it is erroring out on the user?

Once the error is resolved

After troubleshooting and finding out that the user in the crontab was causing the error; I removed the user and crontab started running the scripts.  I was able to acknowledge that the script was running as the log filled up with the commands.  I was going though documentation for Ubuntu 26.04 and I either missed or I can't find the changes made in crontab.  It is interesting the little changes that though such a big monkey wrench into a system that really hasn't changed for years.  At any rate the issue has been resolved and the system is running the scripts as expected.

Fixing error 401 Unauthorized IP: $IPADRESS when running apt-get on Linux

 I have a very dated VM that works as a mail forwarder for my organization, it is a Ubuntu Server VM running 20.04 LTS which connects to google workspaces and sends email for our on prem devices such as copiers, software, scripts, etc.  I went to run some security updates using apt-get and I got an interesting error saying that there is a 401 Error Unauthorized IP.

The fix is to disable the sources in the sources.list directory, which I have two files.

• ubuntu-esm-infra.list
• ubuntu-esm-infra.list.distUpgrade

In VI I commented out the source lines.

reinstalled apt

After I was able to update the system; and upgrade the outdated packages.  Now I can go headed and upgrade the system to the newer release.

StorageSpaces replace a drive using the serial number

Backup Your Data (Crucial!): Before anything else, ensure you have a current backup of your data, as drive failures can be unpredictable

Identify the Failing Disk: Use the Storage Spaces Management tool (or PowerShell) to identify the specific physical disk that is unhealthy.  This will also show up in the Physical Disks Section in storage on windows server.

If you can't or are unable to identify the disk in software, you may have to if possible shut the system down and find the drive.  Mark and label the drives that need to be replaced; you can do that by finding the serial number of the drive that failed as down below.

Use the following command to get the status of your storage spaces; note any drives that are failing by serial number.

Get-StoragePool -FriendlyName "Data" | Get-PhysicalDisk

We can get the serial numbers of the disks we want to replace we can't use the FriendlyName due to both disks having the same friendly name.  The disks we want to replace are

Disk 1 - W381A7X4

Disk 2 - W391A8Z8

Get-PhysicalDisk -SerialNumber $SERIALNUMBER 

So we need to set the disk as retired; to do that we are going to use the following powershell command.

$DiskToRemove = Get-PhysicalDisk | Where-Object { $_.SerialNumber -like '*OldSerialNumber*' } | Set-PhysicalDisk -Usage Retired

As shown below 

$DiskToRemove = Get-PhysicalDisk | Where-Object { $_.SerialNumber -like '*W391A8Z8*' } | Set-PhysicalDisk -Usage Retired

Storage spaces will automatically move data off the drive. Use the command

Get-StorageJob

to get the progress of the job.  This shouldn't take very long, once finished remove the bad/retired drive and replace with the new one.

In windows add a new disk

It will find the disk you put in while the disk you removed will still show in your lists of disks until we remove it in software.

After the new disk has been added; select the old disk and remove it.

Once the disk is removed windows will begin repairing the storage spaces array

If you use the Get-PhyscialDisk command in powershell it will show the newly added drives

When Storage Spaces has completed it's rebuild there will be no job running, to check that you can use the command Get-StorageJob to get the status.

When completed everything will show up fine and as repaired.