VMware remote console + Firefox 3.6 (updated)

Firefox 3.6 is the default browser on Ubuntu since Karmic but unfortunately it no longer works when attempting to launch a VMWare server remote console session from within the web gui. This is one of the reasons I decided to move away from VMware to Virtualbox headless, with mixed results.

My virtualbox experiment is over and I have decided to go back to VMware. It is a shame but vbox just has too many ways to get itself tangled up and lacks the "management polish" that you get with vmware server.

That being said, there is still the problem that new versions of Firefox refuse to work with the remote console plugin and that is a show stopper. It forces me to keep Jaunty on my laptop just so I can get a console session when needed.

The good news is that I have just discovered a workaround for this problem.

Apparently, there is an undocumented* feature in vmware player that enables it to connect to a remote host!

I have long been wondering why such a feature was not available and now I find out it actually is! Yay!

Anyway, assuming you have installed vmware player, if you type the following at a shell prompt;

vmplayer -h

you will be presented with a dialog that looks like this;



Enter your server details (including the port which is 8333 by default)



Click OK and you will see a list of the guest machines on that host, like so;



Click on a host and open to create a remote console session and you are done!

I can't tell you how excited I am to discover this trick. Now I have no more reasons to avoid changing my main browser to Chrome.

[UPDATE]

I having been playing about and you can streamline the process by adding the host and login details to the command line.

vmplayer -h jupiter -u brettg -p mypassword

* It is not mentioned when you type vmplayer --help at the console.

HOWTO: SAMBA + LDAP on 10.04 Lucid Part 1

Wow, it has taken me weeks to get this to the point that it seems to be working. The official documentation is horribly broken, but I have finally got what i think is a working solution. I will probably need to tweak this guide as time goes on (see the end of the post for revision history)

PLATFORM:
* Ubuntu Server 10.04 LTS (Lucid)

PREREQUISITES:
* A standard vanilla Ubuntu 10.04 server install.
* Set your admin user as a system user.
* Mount our user home directories to an NFS server

Network overview;
* domain name: tuxnetworks.com (change this to suit your own)
* ldap-server 10.1.1.5 (change this to suit your own)

Installing Samba

We will start by configuring samba.

Download this samba config file;

~$ wget http://www.tuxnetworks.com/configs/smb.conf

Note:

Edit this file to suit your own network. You need to change the "ldap suffix" & "ldap admin" values, but you will probably also want to change "workgroup" and "netbios name" as well.

Create a samba directory;

sudo mkdir /etc/samba/

Copy the new smb.conf file into place;

~$ sudo cp smb.conf /etc/samba/

Install Samba;

~$ sudo apt-get install samba samba-doc smbclient

Install the LDAP server

Next we want to install the OpenLDAP server daemon slapd and ldap-utils, a package containing LDAP management utilities;

~$ sudo apt-get install slapd ldap-utils libpam-smbpass smbldap-tools

Notes:

By default slapd is configured with minimal options needed to run the slapd daemon.

The configuration example in the following sections will match the domain name of the server. For example, if the machine's Fully Qualified Domain Name (FQDN) is ldap.tuxnetworks.com, the default suffix will be dc=tuxnetworks,dc=com.

OpenLDAP uses a separate directory which contains the cn=config Directory Information Tree (DIT). The cn=config DIT is used to dynamically configure the slapd daemon, allowing the modification of schema definitions, indexes, ACLs, etc without stopping the service.

The backend cn=config directory has only a minimal configuration and will need additional configuration options in order to populate the frontend directory. The frontend will be populated with a "classical" scheme that will be compatible with address book applications and with Unix Posix accounts. Posix accounts will allow authentication to various applications, such as web applications, email Mail Transfer Agent (MTA) applications, etc.

* For external applications to authenticate using LDAP they will each need to be specifically configured to do so. Refer to the individual application documentation for details.

Remember to change "dc=tuxnetworks,dc=com" in the following examples to match your LDAP configuration.

First, some additional schema files need to be loaded. In a terminal enter:

~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

Download this LDIF file

~$ wget http://www.tuxnetworks.com/configs/backend.ldif

Edit the file to change "dc=tuxnetworks,dc=com" and "mypassword" to suit your own domain details.

TIP:

A quick way to do this is to use sed;
sed -i s/dc=tuxnetworks,dc=com/dc=example,dc=net/g backend.ldif

Now add the LDIF to the LDAP directory:

~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f ~/backend.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"

adding new entry "olcDatabase=hdb,cn=config"

Samba needs us to tell it the LDAP admin password which we can do with this command;

~$ sudo smbpasswd -W
Setting stored password for "cn=admin,dc=tuxnetworks,dc=net" in secrets.tdb
New SMB password:
Retype new SMB password:

Note:

Use the password you entered in the backends.ldif file earlier.

And finally, we restart samba again;

~$ sudo service smbd restart

You can test that samba works by using the samba-client (when it asks for roots password just press Enter);

~$ sudo smbclient -L localhost

You should see something like this;

~$ sudo smbclient -L localhost
Enter root's password: 
Anonymous login successful
Domain=[SAMBA] OS=[Unix] Server=[Samba 3.4.7]

 Sharename       Type      Comment
 ---------       ----      -------
 print$          Disk      Printer Drivers Share
 shared          Disk      
 archive         Disk      
 IPC$            IPC       IPC Service (Samba 3.4.7)
Anonymous login successful
Domain=[SAMBA] OS=[Unix] Server=[Samba 3.4.7]

 Server               Comment
 ---------            -------
 MYSAMBASERVER        Samba 3.4.7

 Workgroup            Master
 ---------            -------
 MYSAMBAWORKGROUP     MYSAMBASERVER

Note:

If you don't see the expected output, then you should stop right now and repeat the process. Having Samba incorrectly configured at this point will cause the rest of the procedure to fail.

OK, now that that we have the basic part done you should proceed to part 2.

HOWTO: SAMBA + LDAP on 10.04 Lucid Part 2

This is Part Two of my SAMBA + LDAP howto. You must successfully complete Part One before attempting this procedure.

OK, with Part one done we must now provide our samba users with profile and netlogon directories, let's create them now;

~$ sudo mkdir -v -m 777 /var/lib/samba/profiles
~$ sudo mkdir -v -p -m 777 /var/lib/samba/netlogon

Next we must add the samba schemas to the LDAP server. These schemas are part of the samba-doc package that we installed in Part One.

Copy the schemas to the appropriate location;

~$ sudo cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz /etc/ldap/schema/
~$ sudo gzip -d /etc/ldap/schema/samba.schema.gz

These schemas must be converted to the "ldif" format before we can use them.

Create a file called schema_convert.conf

~$ vi ~/schema_convert.conf

and paste in the following lines;

include /etc/ldap/schema/core.schema
include /etc/ldap/schema/collective.schema
include /etc/ldap/schema/corba.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/duaconf.schema
include /etc/ldap/schema/dyngroup.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/java.schema
include /etc/ldap/schema/misc.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/openldap.schema
include /etc/ldap/schema/ppolicy.schema
include /etc/ldap/schema/samba.schema

Next, use slapcat to convert the schemas;

~$ slapcat -f ~/schema_convert.conf -F ~ -n0 -s "cn={12}samba,cn=schema,cn=config" > ~/cn=samba.ldif

slapcat will generate a file "~/cn\=samba.ldif". Edit this file;

~$ vi ~/cn\=samba.ldif

and change the following attributes:

dn: cn={12}samba,cn=schema,cn=config
...
cn: {12}samba

to

dn: cn=samba,cn=schema,cn=config
...
cn: samba

Also, remove all these lines from the bottom of the file.

structuralObjectClass: olcSchemaConfig
entryUUID: 99e797a8-07cb-102f-8c5c-739a8467e607
creatorsName: cn=config
createTimestamp: 20100609043122Z
entryCSN: 20100609043122.188753Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20100609043122Z

Add the schema to the server;

~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f ~/cn\=samba.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=samba,cn=schema,cn=config"


You should see the following line with no errors reported.

adding new entry "cn=samba,cn=schema,cn=config"

Let's check how things are going with the following query (use an empty password);

~$ sudo ldapsearch -Y EXTERNAL -H ldapi:/// -D cn=admin,cn=config -b cn=config -W olcDatabase={1}hdb

You should see a metric shedload of output with this at the end;

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

If you see output like above then your LDAP server is working, but we still need to finish configuring samba.

Unpack the samba-ldap-tools (we downloaded this earlier)

~$ sudo gzip -d /usr/share/doc/smbldap-tools/configure.pl.gz

Now we are going to execute a perl script which will set up samba for us. For almost every prompt you should just press Enter. There are a few of exceptions however. When asked for "logon home" and "logon path" enter a "." (fullstop) and nothing else. When asked for a password (ldap master/slave bind password) use the password for the "admin" account that you entered earlier. Remember, leave the default value for everything else!

Run the script;

~$ sudo perl /usr/share/doc/smbldap-tools/configure.pl

Now that the script has created our configuration, we can use it to populate the server;

~$ sudo smbldap-populate
Populating LDAP directory for domain TUXNETWORKS (S-1-5-21-3403240416-131340500-4256605436)
(using builtin directory structure)

adding new entry: dc=tuxnetworks,dc=net
adding new entry: ou=Users,dc=tuxnetworks,dc=net
adding new entry: ou=Groups,dc=tuxnetworks,dc=net
adding new entry: ou=Computers,dc=tuxnetworks,dc=net
adding new entry: ou=Idmap,dc=tuxnetworks,dc=net
adding new entry: uid=root,ou=Users,dc=tuxnetworks,dc=net
adding new entry: uid=nobody,ou=Users,dc=tuxnetworks,dc=net
adding new entry: cn=Domain Admins,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Domain Users,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Domain Guests,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Domain Computers,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Administrators,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Account Operators,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Print Operators,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Backup Operators,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: cn=Replicators,ou=Groups,dc=tuxnetworks,dc=net
adding new entry: sambaDomainName=TUXNETWORKS,dc=tuxnetworks,dc=net

Please provide a password for the domain root:
Changing UNIX and samba passwords for root
New password:
Retype new password:


Note:

The "UNIX and samba passwords for root" can be anything, you don't need to use the LDAP admin password here.

The final touches;

~$ sudo /etc/init.d/slapd stop
~$ sudo slapindex

WARNING!
Runnig as root!
There's a fair chance slapd will fail to start.
Check file permissions!

Ignore the warning!

~$ sudo chown openldap:openldap /var/lib/ldap/*
~$ sudo /etc/init.d/slapd start

Make "root" the domain adminstrator;

~$ sudo smbldap-groupmod -m 'root' 'Administrators'
adding user root to group Administrators

If this returns;

adding user root to group Administrators

with no errors then you are looking good!

Now, we need to allow clients to authenticate via LDAP. To do this we need to install a package.

~$ sudo apt-get --yes install ldap-auth-client

During this process enter the following details;

ldapi:///127.0.0.1:389/

dc=tuxnetworks,dc=com

3

Yes

No

cn=admin,dc=tuxnetworks,dc=com

mypassword

We also need to tell PAM and the "Name Service Switch" (NSS) service to use LDAP for auth;

~$ sudo auth-client-config -t nss -p lac_ldap
~$ sudo pam-auth-update ldap

If all has gone well, you should now be able to add a user to the database;

~$ sudo smbldap-useradd -a -m -P brettg
Cannot confirm uidNumber 1000 is free: checking for the next one
Changing UNIX and samba passwords for brett
New password:
Retype new password:

Note:

You will notice the above command returns "Cannot confirm uidNumber 1000 is free: checking for the next one" and your LDAP user ends up with UID of 1001. If you are an OCD type like me and want all your users on LDAP and starting at 1000, then you might want to consider changing the UID of the default Ubuntu system user to a number below 1000 before issuing this command. If you do that, then make sure that you can log in and get sudo privileges before you go any further of course.

You can check your new user by issuing this command;

~$ ldapsearch -xLLL -b "dc=tuxnetworks,dc=com" uid=brettg
dn: uid=brett,ou=Users,dc=tuxnetworks,dc=net
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
cn: brett
sn: brett
givenName: brett
uid: brett
uidNumber: 1001
gidNumber: 513
homeDirectory: /home/brett
loginShell: /bin/bash
gecos: System User
sambaLogonTime: 0
sambaLogoffTime: 2147483647
sambaKickoffTime: 2147483647
sambaPwdCanChange: 0
displayName: brett
sambaSID: S-1-5-21-3403240416-131340500-4256605436-3002
sambaPrimaryGroupSID: S-1-5-21-3403240416-131340500-4256605436-513
sambaLogonScript: allusers.bat
sambaLMPassword: 157FBB24ACBE1A68AAD3B435B51404EE
sambaAcctFlags: [U]
sambaNTPassword: 8462E3FFE0BA1C8CED841873EC989A29
sambaPwdLastSet: 1308795478
sambaPwdMustChange: 1312683478
shadowLastChange: 15148
shadowMax: 45

If you get output like this then congratulations, you have successfully configured a combined Samba/LDAP server!

Next, you should go ahead and configure a client

Revisions:
13/7/2010- Karan Pratap Singh pointed me to another howto which does some things in a better way than mine did. I have merged the parts that I like into my document (see comments)

23/6/2011- Retested, confirmed the process still works. Some parts were cleaned up and extra output from some of the commands was added. Also I split the post into 2 parts as it was getting quite long.

HOWTO: phpLDAPadmin on 10.04 Lucid Lynx

PLATFORM:
* Ubuntu Server 10.04 LTS (Lucid)

PREREQUISITES:
* A vanilla Ubuntu 10.04 server install.
* You have successfully installed a working LDAP server

Network overview;
* domain name: example.com
* ldap-server 10.1.1.5

Currently, the version of phpLDAPadmin that is in the Lucid repositories is a relatively old version (v1.1.07) which is not compatible with the version of PHP that actually ships with Lucid (v5.3.2).

Doh!

What we need to do is use the current version (v1.2.0.5) from Launchpad

wget https://launchpad.net/~ubuntu-security-proposed/+archive/ppa/+build/1744905/+files/phpldapadmin_1.2.0.5-1ubuntu1.10.04.1_all.deb

Install dependancies

sudo apt-get install apache2 apache2-mpm-prefork apache2-utils apache2.2-bin apache2.2-common libapache2-mod-php5 libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap php5-common php5-ldap ssl-cert

Install the package

sudo dpkg -i phpldapadmin_1.2.0.5-1ubuntu1.10.04.1_all.deb

Make a softlink to the downloaded version of php

sudo ln -s /usr/share/phpldapadmin /var/www/phpldapadmin

Pointing phpldapadmin to your domain;

Edit config.php

sudo vi /etc/phpldapadmin/config.php

Find these lines;

$servers->setValue('server','base',array('dc=example,dc=com'));

$servers->setValue('login','bind_id','cn=admin,dc=example,dc=com');

Change the lines to suit your own network. In my case this would be like this;

$servers->setValue('login','bind_id','cn=admin,dc=tuxnetworks,dc=com');

Restart apache

sudo /etc/init.d/apache2 restart

Test it by browsing to your ldap server at;

http://10.1.1.5/phpldapadmin/

and login using;

USER: cn=admin,dc=example,dc=com
PASS: your_password

Once you have logged in, expand the tree & you should see something like this;

+--> dc=example,dc=com (3)
---> cn=admin
+--> ou=groups (1)
+--> ou=people (1)
---> Create new entry here

And that's it, you're done!

HOWTO: LDAP Server on 10.04 Lucid Lynx

In my previous LDAP server howto we used 8.04 Hardy Heron. Things have changed quite a bit since then, so I have updated my procedure. Most of this is ajust a reproduction of the Ubuntu Doc's page for LDAP (See references at the end of the article for a link)

PLATFORM:
* Ubuntu Server 10.04 LTS (Lucid)

PREREQUISITES:
* A standard vanilla Ubuntu 10.04 server install.
* An NFS server exporting the users home directorys

Network overview;
* domain name: example.com
* ldap-server 10.1.1.5

Install The Packages

We want to install the OpenLDAP server daemon slapd and ldap-utils, a package containing LDAP management utilities:

sudo apt-get install slapd ldap-utils

Notes:
By default slapd is configured with minimal options needed to run the slapd daemon.

The configuration example in the following sections will match the domain name of the server. For example, if the machine's Fully Qualified Domain Name (FQDN) is ldap.example.com, the default suffix will be dc=example,dc=com.

Populating the server

Notes:
OpenLDAP uses a separate directory which contains the cn=config Directory Information Tree (DIT). The cn=config DIT is used to dynamically configure the slapd daemon, allowing the modification of schema definitions, indexes, ACLs, etc without stopping the service.

The backend cn=config directory has only a minimal configuration and will need additional configuration options in order to populate the frontend directory. The frontend will be populated with a "classical" scheme that will be compatible with address book applications and with Unix Posix accounts. Posix accounts will allow authentication to various applications, such as web applications, email Mail Transfer Agent (MTA) applications, etc.

* For external applications to authenticate using LDAP they will each need to be specifically configured to do so. Refer to the individual application documentation for details.

* Remember to change dc=example,dc=com in the following examples to match your LDAP configuration.

First, some additional schema files need to be loaded. In a terminal enter:

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

Next, create an LDIF file

vi ~/backend.ldif

With the following contents;

# Load dynamic backend modules
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: back_hdb

# Database settings
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcSuffix: dc=tuxnetworks,dc=com
olcDbDirectory: /var/lib/ldap
olcRootDN: cn=admin,dc=tuxnetworks,dc=com
olcRootPW: mypassword
olcDbConfig: set_cachesize 0 2097152 0
olcDbConfig: set_lk_max_objects 1500
olcDbConfig: set_lk_max_locks 1500
olcDbConfig: set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcLastMod: TRUE
olcDbCheckpoint: 512 30
olcAccess: to attrs=userPassword by dn="cn=admin,dc=tuxnetworks,dc=com" write by anonymous auth by self write by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=admin,dc=tuxnetworks,dc=com" write by * read


* Change olcRootPW: mypassword to a password of your choosing.

* Change dc=example,dc=com to suit your own domain details.

Now add the LDIF to the directory:

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend.ldif

The frontend directory is now ready to be populated. Create a frontend.ldif file

vi ~/frontend.ldif

Enter the following contents, once again making the necessary changes to suit your own network:

# Create top-level object in domain
dn: dc=tuxnetworks,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: Tuxnetworks
dc: Tuxnetworks
description: LDAP Server

# Admin user.
dn: cn=admin,dc=tuxnetworks,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword: mypassword

dn: ou=people,dc=tuxnetworks,dc=com
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=tuxnetworks,dc=com
objectClass: organizationalUnit
ou: groups

dn: uid=brettg,ou=people,dc=tuxnetworks,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: brettg
sn: Glasson
givenName: Brett
cn: Brett Glasson
displayName: Brett Glasson
uidNumber: 1000
gidNumber: 10000
userPassword: mypassword
gecos: Brett Glasson
loginShell: /bin/bash
homeDirectory: /home/brettg
shadowExpire: -1
shadowFlag: 0
shadowWarning: 7
shadowMin: 8
shadowMax: 999999
shadowLastChange: 10877
mail: brett.glasson@tuxnetworks.com
postalCode: 31000
l: Melbourne
o: tuxnetworks
mobile: +33 (0)6 xx xx xx xx
homePhone: +33 (0)5 xx xx xx xx
title: System Administrator
postalAddress:
initials: BG

dn: cn=users,ou=groups,dc=tuxnetworks,dc=com
objectClass: posixGroup
cn: users
gidNumber: 10000

Notes:
In this example the directory structure, a user, and a group have been setup. In other examples you might see the objectClass: top added in every entry, but that is the default behaviour so you do not have to add it explicitly.

Add the entries to the LDAP directory:

sudo ldapadd -x -D cn=admin,dc=tuxnetworks,dc=com -W -f frontend.ldif

We can check that the content has been correctly added with the ldapsearch utility. Execute a search of the LDAP directory:

ldapsearch -xLLL -b "dc=tuxnetworks,dc=com" uid=brettg sn givenName cn

Which should return something like this;

dn: uid=brettg,ou=people,dc=,dc=com
cn: Brett Glasson
sn: Glasson
givenName: Brett

Next, you should go ahead and install phpLDAPadmin, add Samba support or configure a client

References:
Ubuntu Docs

USB Devices in VirtualBox guests

Prerequisites:
    Oracle version of Virtualbox (The OSE version found in the standard repository does not support USB)
    Virtualbox extension pack
    Virtualbox guest tools
    Member of the vboxusers group

Note: It is usually not necessary to add the USB device from the command line as described here. As long as the above prerequisites are met you can usually use the gui to add device filters.

I want to connect an external HDD to a virtualbox guest. The unit is a WD "My Book" and the guest is named "Windows". Make sure your VM is powered off before you start!

First, check that your user is a member of the vboxusers group:

groups | grep vboxusers
myuser adm disk cdrom sudo dip plugdev lpadmin sambashare vboxusers libvirt

Note: If you aren't a member of the vboxusers group you must add yourself, logout and login again for the changes to take.

On the host running VirtualBox run the following command:

sudo VBoxManage list usbhost

Find the section that relates to the device you want to use. In my case it looks like this:

UUID:               f61de8f1-9c92-4781-92c5-d091705a0b79
VendorId:           0x1058 (1058)
ProductId:          0x1100 (1100)
Revision:           1.117 (01117)
Manufacturer:       Western Digital 
Product:            My Book         
SerialNumber:       57442D574341565930303934373837
Address:            sysfs:/sys/devices/pci0000:00/0000:00:1d.7/usb1/1-4//device:/dev/bus/usb/001/003
Current State:      Busy

Add a usb filter using the device details gleaned from the previous command:

VBoxManage usbfilter add 0 --target Windows --vendorid 1058 --productid 1100 --name "2TbExt" --active yes

The number after the "add" is the index number, if this is not the first device on the guest then adjust to the next "free" index. You can see the devices currently associated with a guest using this command:

VBoxManage showvminfo Windows

Finally enable usb for the guest:

VBoxManage modifyvm Windows --usb on

Now, after starting your VM, you should be able to see that the usb device is present in the virtual machine.

Note: If you have this working and it suddenly stops working, possibly after an update check that you still belong to the vboxusers group. If you don't belong to that group then no devices will show but there will be no "permisison denied" errors that might help to explain why.

UPDATED: November 2018

IT Industry Fights over Internet Video Standards

The fight:
How should online videos be delivered to users over the internet.

The Status Quo:
Currently, Adobe Flash is the defacto standard. However, this is not an ideal situation because users need to download a browser plugin from Adobe, and that plugin is widely considered to be bloated, buggy, a CPU hog and a battery killer. Also, if Adobe cannot or will not provide a plugin for a particular platform then that platform will be unable to access vast amounts of content on the internet. Apple are currently refusing to support Flash on their iProducts which has led to an amusing round of name calling between the two. Of course, there may be other reasons that Apple may not want to let Adobe play in their sandpit though.

The Solution:
What is needed is a native, standardised, open video that can be built into all browsers. This will negate the need for a multitude of proprietary plugins. This standard is intended to be defined in the upcoming specification for HTML 5.

The Fly In The Ointment:
A group of the usual suspects are pushing for their own format, while the open source crowd lead by Google are pushing for another.

The Fighters:
In the Red Corner, we have the MPEG-LA who own a bunch of video codec patents and are pushing their H.264 codec at the W3C. The w3c are the organisation that is responsible for defining standards on the internet. The group includes Apple and Microsoft along with almost every major Consumer Electronics manufacturer on the planet. Between them, this group owns a "patent pool" and license the use of the H.264 codec to every one else. H.264 is currently available under a "free" (gratis) license although this position is to be "reviewed" in a few years. Open sourcers fear that the MPEG-LA are waiting for the time that H.264 becomes an essential part of the internet before they jack up the prices in a classic bait and switch maneuver. They are concerned that once there is a price attached to use of the codec, open source people will no longer be able to use it.

In the Blue Corner is basically everyone who is not a member of the MPEG-LA. This includes Mozilla, Opera and Google. Google has just spent $125 million purchasing a company that makes another video codec called VP8. They then open sourced that codec effectively giving free access to anyone who wants to use it. Of course it is in Googles interests for as many people as possible to access Googles services with as few encumbrances as possible. The Big G are afraid that if MS and Apple were to have effective control over where and how video is delivered on the internet then they could use that to control how users get access to Googles servers and limit that access to only the people who buy their own products along with demanding royalty payments from Google as well.

So, the current situation sees the MPEG-LA making noises about demanding royalties from VP8 users based on alleged "patent violations" in attempt to close it down.

It is a good thing for this all to come to a head and Google is one of the few players in the industry with deep enough pockets to fight a drawn out legal battle with the entrenched industry incumbents.

The sooner this is all brought out in the open and into the courts the sooner we can put all the FUD regarding HTML 5 video codecs behind us.

Ain't corporate greed a wonderful thing?