Testing SMTP and POP3 Connections

It often happens that I need to check a certain SMTP and POP3 connections. Whether it is the user credentials or the authentication methods. Using telnet is one method, but you have to make sure you don’t make typos while you are in the session. A much easier approach is to use a GUI tool named SMTP Explorer from http://outlook-net.de to test the SMTP connections. POP3 accounts can be checked using Magic Mail Monitor.

Clearing datastores in ESXi (Call “HostDatastoreSystem.RemoveDatastore” for object “ha-datastoresystem” on ESXi x.x.x.x failed)

When trying to delete a datastore you get following error message

Call "HostDatastoreSystem.RemoveDatastore" for object "ha-datastoresystem" on ESXi

Checked that all VMs are deleted, no ISO images are being referenced from any VM, but the problem still persisted. After checking the logs, I found this error message:

ValidateLayout: Invalid block boundaries: curStart: 522 prevEnd: 522 curEnd: 536

Next step: Trying out a manual deletion of the partitions on the ESXi console/shell.

/var/log # partedUtil "get" "/vmfs/devices/disks/naa.6782bcb0208864001569518a19be9f9d"
243133 255 63 3905945600
1 63 8386622 6 0
2 8386623 8611902 252 0
3 8613888 3905945599 251 0
/var/log # partedUtil "delete" "/vmfs/devices/disks/naa.6782bcb0208864001569518a19be9f9d" 3
/var/log # partedUtil "delete" "/vmfs/devices/disks/naa.6782bcb0208864001569518a19be9f9d" 2
Error: Invalid argument during write on /dev/disks/naa.6782bcb0208864001569518a19be9f9d
Unable to delete partition 2 from device /vmfs/devices/disks/naa.6782bcb0208864001569518a19be9f9d

/var/log # partedUtil "get" "/vmfs/devices/disks/naa.6782bcb0208864001569518a19be9f9d"
243133 255 63 3905945600
1 63 8386622 6 0
2 8386623 8611902 252 0
/var/log # dd if=/dev/zero of=/vmfs/devices/disks/naa.6782bcb0208864001569518a19be9f9d bs=512 conv=notrunc
dd: writing '/vmfs/devices/disks/naa.6782bcb0208864001569518a19be9f9d': Read-only file system
4922+0 records in
4921+0 records out

That made the datastore inaccessible and after a reboot I could reinitialize the datastore again.

More infos about deleting datastores from the cli, here. The proper outlines are documented here on the vmware KB.

Measuring Network throughput in Windows

There is a nice tool called netperf to measure the network throughput. There is a port for Windows available here and it is very easy to use:

  1. On the server side start:
    cd c:\downloads\netperf\
    netserver.exe
  2. On the client side start:
    cd c:\downloads\netperf\
    netclient.exe -H <IP.OF.SERVER>

You can find more info over here.

(BuyVM/FranTech) VPS PPTP VPN Setup

Install pptp package

apt-get install pptpd

Edit pptp.conf

nano /etc/pptpd.conf

Add the ip address which the server should hand out to the dialing in client:

localip 192.168.10.1
remoteip 192.168.10.101-200

Enable ip forwarding

nano /etc/sysctl.conf

net.ipv4.ip_forward=1

Add credentials for dial-in:

nano /etc/ppp/chap-secrets

dialin_user pptpd dialin_password *

Add to firewall

iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p 47 -j ACCEPT
iptables -A FORWARD -i ppp+ -o vent0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to-source <OUTBOUND_IP_ADDRESS>

Add this permanently as a bootup script and reboot the system.

Backing up your Motorola Milestone/Droid using nandroid

Preperation

Prerequisites:

  • your phone has to be rooted
  • USB drivers installed on your Windows machine
  • the Android SDK
  • charge your phone to 100% otherwise you can get into serious troubles
  • ADBRecovery.zip

Then…

  • Extract ADBRecovery.zip
  • everything in the folder “in_sd_root” has to be moved to the root of your SD card. Make sure you do *not* move the folder “in_sd_root” itself, just the content inside the folder
  • Boot your phone into recovery mode:
    • shut down your phone
    • turn it on, while holding down the camera-button
    • wait until you see the triangle on the screen
    • release the camera button
    • press down the volume-up button, hold it pressed and press the camera button
    • your phone should now show you that it is in recovery mode
  • Use the DPAD to  scroll down to apply sdcard:update.zip, press the golden button
  • Connect your phone with the help of a USB cable to your computer
  • Open the command box on your Windows computer
  • Change into the folder where the SDK has been installed, e.g.
    cd "c:\program files\android-sdk_r05\tools\"
  • enter:
    adb shell

Now we’re ready to create a backup/recover a backup.

Backup

Enter:

nandroid-mobile.sh --backup

Now enter a name for your backup and press enter. If you want to list your content using ls, don’t forget to use alias ls=’ls –color=never’ .  The backups will be stored in /sdcard/nandroid/console=ttyS2,115200n8 in a subfolder, prefixed with the name you have just supplied. The backup consists of multiple files!

Don’t forget to move these files off your SD card to a save place :)

Recovery

Enter:

nandroid-mobile.sh --restore

If only one backup is available it will automatically proceed to recover your backup, otherwise you have to enter the complete and full name of your backup.

Further information including other commandline options for nandroid incl. backup/recovery of partial data/drives please read here.

Windows XP logs off immediately

After entering your password Windows XP logs you off. You can see briefly how it tries to log on, then loads your settings, logs you off and saves your settings. This is usually caused by malware, which change the userinit.exe file in Windows. There are multiple workarounds where you have to restore the userinit.exe file and/or fix the registry value which points to a wrong userinit.exe. In this case none of the given workarounds were successful. I was able to boot the computer into safe mode however, but even then re-checking the registry values for the userinit.exe did not reveal anything abnormal.

So I tried using autoruns to find out whether some service or process is being started automatically upon booting the system. Things were a bit more complicated as I only had remote access to the computer. I was able to enable RDP remotely to test whether login works. Before being able to use RDP I had to disable the Windows firewall by starting compmgmt.msc and connecting remotely to the machine. Then I used psexec to run autorunsc (the console version of autoruns). You have to make sure that you add the “-accepteula” option

C:\Dokumente und Einstellungen\Administrator>”C:\Dokumente und Einstellungen\Administrator\Desktop\PsTools\PsExec.exe” -c \\name-of-pc “C:\temp\autorunsc.exe” -accepteula -a > a.txt

This runs autorunsc.exe remotely on “name-of-pc” and dumps everything into the file a.txt. After inspecting the output dump I found something suspicious

userinit.exe
utqgkzuldd.exe
c:\windows\system32\utqgkzuldd.exe

Checking the filesystem revealed that there was indeed such a file in system32. Deleting/renaming the file was not possible since it was locked by some filehandle. Starting processexplorer showed that crss.exe had a file handle open on that file. I deleted the file handle and then I was able to rename the utqgkzuldd.exe file. After that I was able to log in successfully.

Inspection of the utqgkzuldd.exe file revealed that it was a trojan horse called W32.Qakbot!gen3.

Disk Thrashing After Suspending a VM

I have had the issue that after suspending a certain VM the disk activity would go up after a few minutes. Quite annoying because the system was almost unusable. Kind of like it was doing some defragmentation. After a few minutes of researching (a.k.a googling ;) ) I came across this thread on the VMWare user forums which explained that you had to edit the .vmx file and add following three lines:

mainMem.useNamedFile = "FALSE"
mainMem.partialLazySave = "FALSE"
mainMem.partialLazyRestore = "FALSE"

This did the trick for me.

Connecting to a VM’s console via a SSH tunnel

From the client you have to build an SSH tunnel forwarding ports 443, 902, 903. Make sure you are *not* forwarding from 127.0.0.1 (since according to this posting on the VMware forums) this seems to have a special meaning when using the VMWare client, instead use 127.0.0.2. In this example the server’s IP address is 192.168.2.57, and the ssh machine is at 172.20.0.1, listening to port 3333:

ssh -L 127.0.0.2:443:192.168.2.57:443 -L 127.0.0.2:902:192.168.2.57:902 -L 127.0.0.2:903:192.168.2.57:903 root@172.20.0.1 -p 3333