Recover ESXi 7.x Bootbank

November 15, 2022 1:06 PM / Leave a Comment /

During the the installation of a VMware VIB file I lost connectivity to my usb stick containing the installation of esxi. Facing the following errors:

ESXi Log

Could not install image profile: Failed to copy files from /tmp/stagebootbank to /altbootbank: [Errno 5] Input/output error

Device or filesystem with identifier mpx.vmhba32:C0:T0:L0 has entered the All Paths Down Timeout state after being in the All Paths Down state for 140 seconds. I/Os will now be fast failed.

Lost connectivity to storage device mpx.vmhba32:C0:T0:L0. Path vmhba32:C0:T0:L0 is down. Affected datastores: BOOTBANK1″, “BOOTBANK2”, “LOCKER-624c4a59-8a3bf37a-8986-e435c87de92a.

After a reboot I saw the error message “BANK5: not a VMware boot bank” however BOOTBANK2 was intact so ESXi was booting with last working state from BOOTBANK2 (BANK6 in my case). Checking with “ls /altbootbank” I saw that alot of files where missing. I started to check if the filesystem was damaged with:

Check ESXi bootbank device

vmkfstools -P /altbootbank

Check and repair filesystem

dosfsck -r -w /dev/disks/mpx.vmhba32:C0:T0:L0:5

While mpx.vmhba32:C0:T0:L0:5 is the output of the previous command and :5 is the partition number. So :5 is BANK5 and :6 is BANK6.

Afterwards you can completely copy over the contents of /bootbank to /altbootbank with “cp”. You need to edit boot.cfg and modify “updated” to a number lower (-1). While the next VIB or update/patch you install on esxi will completely maintain the bootbanks again.

Posted in: ESXi, Hardware, vCenter, VMWare / Tagged: , , , , ,

Microsoft Edge URI List – Open Office Apps without Prompt for SharePoint

September 5, 2022 2:02 PM / Leave a Comment /

By default Microsoft Edge always prompts when it opens external applications like Microsoft Word or Microsoft OneDrive. You may want this prompt to disappear for your trusted local SharePoint 2013/2016/2019/Subscription Farm.

The list of URI Schemes is published here: Office URI Schemes | Microsoft Docs
I found out these URI schemes are not complete and in some cases not valid anymore.

So how to configure this now? Add the Microsoft Edge Group Policies to your domain controller and search for the following settings: “Define a list of protocols that can launch an external application from listed origins without prompting the user”.

This has the be in json format and will look like the following:
[{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"ms-word"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"msoutlook"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"ms-excel"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"ms-powerpoint"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"ms-access"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"ms-project"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"ms-visio"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"onenote"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"viewinfileexplorer"},{"allowed_origins":["sharepoint.example.com","officeonline.example.com"],"protocol":"odopen"}]

The following URI Schemes are being used here:

URI SchemeDescriptipon
ms-wordMicrosoft Word
msoutlookMicrosoft Outlook
(not documented)
ms-excelMicrosoft Excel
ms-powerpointMicrosoft PowerPoint
ms-accessMicrosoft Access
ms-projectMicrosoft Project
ms-visioMicrosoft Visio
onenoteMicrosoft OneNote (Phat Client)
viewinfileexplorerExplorer View
(not documented)
odopenMicrosoft OneDrive
(not documented)
Posted in: Microsoft, OfficeWebApps, SharePoint / Tagged: , , , , ,

Boot Batocera from HDD

September 5, 2022 1:47 PM / 14 Comments /

Recently I acquired a Fujitsu Futro S740. Its sold as a thinclient, but is technically a full blown pc with a small SSD (8 or 16GB). I replaced it with a M.2 2280 B+M Key SSD and planned to use it as “Retrostation”. I tried recalbox, however the S740 only allows GPT/EFI boot, there is no legacy mode anymore. So I tried batocera. It boots well from the USB Stick but after installing to the SSD from the Menu it doesn’t boot.

I got this fixed by booting a Live Linux and set the EFI Partition to label “EFI system partition” and edited the flags to “boot”,”esp”,”legacy boot” (use GParted and Ubuntu Mate Live CD for ex.). After wards you just register it to the BIOS with:
efibootmgr -c -d /dev/sda -p 1 -L "Batocera" -l '\EFI\BOOT\bootx64.efi'

The command won’t work from within Batocera, using a bootable linux of an USB stick is mandatory.

Reboot and have fun.

Posted in: Hardware / Tagged: , , ,

Synology iSCSI/LUN SSD Cache with DSM 7.0

September 28, 2021 2:31 PM / Leave a Comment /

UPDATE: Seems to be gone with ‘Flashcache Version : flashcache-1.0-2021-10-18-20:42’ on 7.0.1. 🙁

With DSM 7.0 Synology removed the feature of accelerating Block-Level LUNs. This is an interesting feature for iSCSI LUNs used for Hypervisors like VMware ESX.

Synology DSM 7.0 Release Notes:

- Creating SSD caches on block-level LUNs is no longer supported. Existing SSD caches for block LUNs will function normally after the update.

However this is valid but you can re-enable acceleration for Block-Level iSCSI LUNs.

Logon to your Synology NAS via SSH and get the root shell via “sudo -i”. Execute the following command to re-enable the cache.

/var/packages/ScsiTarget/target/bin/synoiscsihook --flashcache_enable

This works as long as you’re not rebooting. You can create a task within DSM with trigger at “Boot-Up” to execute this command line to enable the Cache again.

Posted in: ESXi, Synology, VMWare / Tagged: ,

Install EWSManagedAPI NuGet (GitHub) for SharePoint 2013/2016/2019

August 2, 2021 12:37 AM / Leave a Comment /

Recently I tried to enable SiteMailboxes for SharePoint 2019. The documentation (Configure site mailboxes in SharePoint Server – SharePoint Server | Microsoft Docs) claims to download EWSManagedAPI.msi but this results in a 404, as this project moved to GitHub (OfficeDev/ews-managed-api (github.com)). However on GitHub there is no executable or MSI to install.

You can install the NuGet Package (NuGet Gallery | Microsoft.Exchange.WebServices 2.2.0) on your SharePoint Server with the following command:
Install-Package Microsoft.Exchange.WebServices

Basically you are done and should find the NuGet Package at the following location:
C:\Program Files\PackageManagement\NuGet\Packages\Microsoft.Exchange.WebServices.2.2\lib\40\

However the Setup Scripts within the SharePoint Documentation will fail as the DLLs are not registered in GAC (Globaly Assembly Cache).

Verfiy with:
$assm = [System.Reflection.Assembly]::LoadFile("C:\Program Files\PackageManagement\NuGet\Packages\Microsoft.Exchange.WebServices.2.2\lib\40\Microsoft.Exchange.WebServices.dll")
$assm.GlobalAssemblyCache

This should return “False”. Claim gacutil.exe from a Visual Studio (Free Community Edition maybe fine, check Terms and License) Installation with for ex. Windows 10 SDK. Copy it over and run:
gacutil.exe -i C:\Program Files\PackageManagement\NuGet\Packages\Microsoft.Exchange.WebServices.2.2\lib\40\Microsoft.Exchange.WebServices.dll
gacutil.exe -i C:\Program Files\PackageManagement\NuGet\Packages\Microsoft.Exchange.WebServices.2.2\lib\40\Microsoft.Exchange.WebServices.Auth.dll

Restart your powershell console and rerun the commands above. It will return “True” and the Setup Scripts run through without an issue.

Posted in: Microsoft, SharePoint

open-vm-tools: Unknown ioctl 1976

November 25, 2020 6:12 PM / 3 Comments /

Recently I setup my Raspberry Pi 4B 8GB ESXi Cluster. After compling and installing the open-vm-tools for Arm64/AArch64 I got alot of messages regarding “Unknown ioctl 1976”. This happens due to missing “VMCI_SOCKETS” module load during startup. You can simply fix this by adding the following lines to /etc/modprobe.d/blacklist.conf:

blacklist vsock_loopback
blacklist vmw_vsock_virtio_transport_common
install vsock_loopback /usr/bin/true
install vmw_vsock_virtio_transport_common /usr/bin/true

Posted in: ESXi, VMWare / Tagged: , , , ,

Synology Virtual Machine Manager increase vDisk Limit

November 25, 2020 4:11 PM / 2 Comments /

Recently I tried to run a VMware vCenter Appliance (vCSA) on my Synology. Trying to import the provided OVA File results in an unplausible error, so I tried to convert it with the OVFTool thats provided by VMware on the installation disk. I converted or extracted the vmdk diskimages via OVFTool, its basically achieveable by calling ovftool.exe <ova> file.

After that I imported all vmdk images to my Virtual Machine Manager via Images -> Disk Images and started “importing” a virtual machine with the uploaded diskimages. Sadly Synology limits the maximum vDisks for new and imported virtual machines to 8. This is not a hard limit as Virtual Machine Manager is run by qemu and qemu limit is 256 disks.

So how about trying to add the disks after the virtual machine creation via command line? I was messing around with this but the vdisks are added via virtio-scsi and I found this hard to add the disks manually.

So lets see if we can achieve this a different way. I analysed the JavaScript used by Virtual Machine Manager. This can be found here “/volume1/@appstore/Virtualization/ui/virtualization.js”. There is even a check in it, that prompts you with an error if a machine has more than 8 vDisks. So how can we increase the maximum virtual machine attachable disks?

Open “/volume1/@appstore/Virtualization/ui/virtualization.js” and edit the value of “this.maxVdiskNum=8” from 8 to 16. Save the file, gzip it again via gzip -k virtualization.js and restart Virtual Machine Manager or your whole NAS.

However for a vCenter it takes sometime to setup the machine. Keep the first two disks with VirtIO and all other disks on SATA Setting.

Good Luck.

Posted in: Synology, vCenter, VMWare / Tagged: , , , ,

Error while trying to Access “Details” of a SharePoint App

November 6, 2015 1:22 PM / Leave a Comment /

Recently we added Access Services to our SharePoint 2013 environment. After the initial setup we started testing the new implementation and stumbled over an error while accessing the details page of an app. This has nothing to do with access itself, more with apps in general.

2015-11-06_13-03-54

After clicking on details you get an error message with the correlation id. So nothing easier to get the log regarding that error.

SqlError: ‘The EXECUTE permission was denied on the object ‘prc_CountAppInstanceData’, database ‘SharePoint_Logging’, schema ‘dbo’.’    Source: ‘.Net SqlClient Data Provider’ Number: 229 State: 5 Class: 14 Procedure: ‘prc_CountAppInstanceData’ LineNumber: 1 Server: ‘Database.fqdn.com’ f2ec3e9d-ac28-80f1-8d80-1d89f5d672a9
11/06/2015 12:50:34.93  w3wp.exe (Servername.fqdn.com:0x5DE4)            0x5D34 SharePoint Foundation          Database                       5214 Critical Insufficient SQL database permissions for user ‘Name: NT AUTHORITY\IUSR SID: S-1-5-17 ImpersonationLevel: Impersonation’ in database ‘SharePoint_Logging’ on SQL Server instance ‘Database.fqdn.com’. Additional error information from SQL Server is included below.  The EXECUTE permission was denied on the object ‘prc_CountAppInstanceData’, database ‘SharePoint_Logging’, schema ‘dbo’. f2ec3e9d-ac28-80f1-8d80-1d89f5d672a9

This leads us to a permission issue. We tried granting the App Management Service Account “SPDataAccess” permission on our logging database, which did not help.

As you can see in the log there is an user specified IUSR SID: S-1-5-17. This leads to a permission issue from IIS WebServer. Makes sense as all SharePoint Applications are running within the IIS and their Application Pools. As our App Management Service Account wasn’t the issue we granted our Application Pool Account under which the Web Applications are running, the “SPDataAccess” permission on our logging database.

2015-11-06_13-04-42

Et voila, this fixed the issue.

Problem: App Details do not work.

Solution: Grant SPDataAccess Permisson to your Web Application Pool Account on your SharePoint Logging Database.

Posted in: Microsoft, SharePoint / Tagged: , ,

Reinstall WSUS and keep downloaded content

June 3, 2015 8:37 PM / 1 Comment /

Our scenario was that we wanted to upgrade our WSUS running on Windows Server 2012 to Windows Server 2012 R2 and changing the database to WID. The database wasn’t that important for us, as all computers placed in one group where all patches are approved. But we wanted to keep the content of 800 Gigabyte without redownloading all that stuff.

A huge advantage is if you have the data on a seperate drive or partition. Before you start, shutdown the WSUS Service and rename the WsusContent folder or move it to a different location.

Then you’re good to go. Reinstall or setup a new machine and install WSUS. During the initial configuration wizard its important that you choose “synchronize manually” and do not trigger a sync before or at the end of the wizard. Then copy the previous saved WsusContent folder to the location you’ve chosen in the wizard and replace everything. After that you can manually start your synchronization and WSUS is reindexing the whole content without downloading a huge amount of data. It should take around 3-4 hours, depending on your hardware and disk. You can see the status on synchronization tab.

Good luck!

Posted in: Microsoft, Windows Server / Tagged: , , , , ,

SSLLabs A+ rating with nginx without breaking compatibility

February 4, 2015 5:09 PM / Leave a Comment /

Update 05.03.2015: This configuration is not vulernerable to POODLE, BEAST, HEARTBLEED or FREAK Attack. Proof: SSLLabs.com

After a lot of searching on the internet I found the perfect setting for nginx to get an A+ rating on ssllabs without breaking compatibility. There are some guides, but quite old.

nginx A+

Removing TLSv1 is easy but breaks compatibility to everything lower Android 4.4, Windows 7 IE11 and most search engine crawler.

The following settings are requitred to get A+ rating as of february 2015.

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;

ssl_ciphers ‘kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !MD5 !EXP !DSS !PSK !SRP !kECDH !CAMELLIA !RC4 !SEED’;

# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
add_header Strict-Transport-Security max-age=15768000;

resolver <trusted DNS Server>;

After restarting nginx you will see the result above with the following ciphers:

Ciphers

 

If you’re interested in even more compatibility Mozilla SSL Configuration Generator may help you to suit the configuration your needs.

Note: A+ can only be reached with SHA2 certificate or higher. Best you can reach with SHA1 is A rating.

Posted in: Webserver / Tagged: , , , , , , , , ,