Ach ti mladi

 „Naše mládež je nevychovaná, vysmívá se autoritám a nemá žádný respekt ke starcům. Naše děti dnes nevstávají, když vstoupí do místnosti kmet, odmlouvají rodičům a místo práce se vybavují. Jsou docela prostě špatní.“ Sokrates (469-399 př. Kr.)

„Ztrácím veškerou naději v budoucnost naší země, pokud ji zítra povede dnešní mládež, protože tahle omladina je nesnesitelná, nezkrotná, prostě strašná.“ Hesiodos (720 př. Kr.)

„Náš svět dosáhl kritického stadia. Děti už neposlouchají rodiče. Konec světa nemůže být daleko.“ Egyptský kněz (2000 př. Kr.)

„Tato mládež je prohnilá skrz naskrz. Mladí lidé jsou zlomyslní a leniví. Nikdy nebudou jako mladí kdysi. Ti dnešní nedokážou zachovat naši kulturu.“ Hliněná tabulka nalezená v troskách Babylonu, stará 3000 let 

Installing PSC SSL Cert from machine certificate

In relation to the action plan provided by Paul, it would be indeed beneficial to replace the Lookup Service SSL certificate on a Platform Services Controller 6.0 to be the same as the PSC Machine SSL Certificate.

I would recommend to use below steps - they are based on provided KB article, however, the difference is that we are not going to generate new certicate for Lookup Service SSL certificate - we are going to use the same certificate like for PSC Machine SSL Certificate. By doing this, it will be no difference in certificate that is present on port 443 (Machine SSL certificate) and 7444 (Lookup service SSL certificate).

Please find below the procedure to change the lookupservice certificate (presented on port 7444) to be the same as the PSC Machine SSL Certificate (presented on port 443):

1. Connect to PSC server as root through SSH session.

2. Make a new directory

mkdir /ssl

3. Run the following VECS-CLI commands to export the PSC Machine SSL Cert

/usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /ssl/machine_ssl.crt

/usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store MACHINE_SSL_CERT --alias __MACHINE_CERT --output /ssl/machine_ssl.key

4. Run this command to generate a .p12 file consisting of both the ssoserver.cer and ssoserver.key file:

openssl pkcs12 -export -in /ssl/machine_ssl.crt -inkey /ssl/machine_ssl.key -name "ssoserver" -passout pass:changeme -out /ssl/ssoserver.p12

Note: Do not modify the -passout value. This must remain as changeme.

5. Run this command to backup the existing ssoserver.p12 file:

cp /usr/lib/vmware-sso/vmware-sts/conf/ssoserver.p12 /usr/lib/vmware-sso/vmware-sts/conf/ssoserver.p12.backup

6. Run this command to replace the old ssoserver.p12 with the newly generated ssoserver.p12 file:

cp /ssl/ssoserver.p12 /usr/lib/vmware-sso/vmware-sts/conf/ssoserver.p12

7. Run this command to restart the Platform Services Controller services:

service-control --stop --all

service-control --start --all

WordPress - instalace

su -l [webmaster]
cd [web-document-root-directory]
fetch https://wordpress.org/latest.zip
unzip latest.zip
mv wordpress [site-name]

su -l root
cd /usr/local/etc/apache24/extra/
vi httpd-vhosts.conf

<VirtualHost *:80>
    ServerAdmin david.pasek@gmail.com
    DocumentRoot "/usr/home/[webmaster]/[site-name]/"
    ServerName [site-name].dpasek.com
    ServerAlias [site-name].dpasek.com
    Options Indexes FollowSymLinks Includes
    ErrorLog "/var/log/[site-name]-error.log"
    CustomLog "/var/log/[site-name]-access_log" common
</VirtualHost>

apachectl restart

mysql -u root -p
CREATE DATABASE wp_[site-name] CHARACTER SET utf8 COLLATE utf8_bin;
grant all privileges on wp_[site-name].* to 'wp_[site-name]'@'localhost' identified by "pwd-[site-name]";

PowerCLI installation

Find-Module VMware.PowerCLI
Install-Module VMware.PowerCLI

Get-Module -ListAvailable VMware*

Update-Module VMware.PowerCLI

VCSA HA heartbeating

Q: What method is used for VCSA HA heartbeating (to validate that the primary VC is really not available)?

A:
There is a TCP hearbeat that happens every second between the nodes (initiated from the Active node). We monitor the active node via that heartbeat and ping. A failover is triggered when there are 3 lost heartbeats followed by 5 failed pings. Therefore, the node (or network) would need to be down for at least 8 seconds for a failover to be triggered.

The heartbeating technology that we use is based off of FDM (which is what vSphere HA uses) so it is a mature methodology that should work quite well.

WordPress - mod_rewrite na staticke stranky

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
# BEGIN EWWWIO

# END EWWWIO

vSphere 6.5 - backup

I would like to follow up on the vSphere workshop we had on 9.3 and answer questions about vCenter 6.5 backup:

Q1: Is the backup single file?  What is approximately a size?

A1: Backup is multiple files (screen1 attached) one per specific service. Approximate backup size might differ base on the number of components you are using (VUM, image builder and their data). During the backup process, it is calculated how much space it will approximately need (screen2), the portal in latest available version seems to be still unable to include amount of data from VUM and Imagebuilder, therefore 1.2GB expected by the tool differs by about 500GB from the real situation.

Q2: Best practice for backup of VCSA in HA mode

A2: VCSA in HA mode supports standard configuration backup through VCSA VAMI. In such case only configuration of the primary appliance is backed up. During the restore process VCSA is properly restored with HA mode being disabled -> afterwards HA mode should be re-enabled. In this case this was expected behavior as the VCSA VAMI backup is in-guest backup therefore it is not fully aware of the configuration of the other VCSA nodes (like Image level backup would be).

More information can be found: http://pubs.vmware.com/vsphere-65/index.jsp?topic=%2Fcom.vmware.vsphere.install.doc%2FGUID-AFF34FA6-B7CF-4AE0-9C12-C674F160682C.html andhttp://pubs.vmware.com/vsphere-65/index.jsp?topic=%2Fcom.vmware.vsphere.install.doc%2FGUID-F02AF073-7CFD-45B2-ACC8-DE3B6ED28022.html.

Test observations

During the tests I noticed strange problem, which was so far identified as a bug. For initial placement of the Secondary and Witness appliance is not supported to choose SDRS Cluster. Further in the deployment you can choose specific datastores (can be part of the SDRS Cluster) and that should be supported configuration – but it is still not accepted and you are not allowed to proceed with the deployment (screen3). I’m currently working with the PM team and engineering to clarify the setup and resolve the problem.