Information Technology Enthusiast

Moving the blog to a new home!

2010-04-07T17:28:00.000-04:00

Blogger is a great platform and worked well for me over the past few months; but recently I have been given the opportunity to be apart of http://securegossip.com/about/ and I humbly accepted it. In short, SecureGossip was created to unite all security & IT[secure coding, system administration, etc. that leads to complete security] blogs under one roof.

I hope all my readers will join me and subscribe to the new feeds, leave comments and just make http://infolookup.securegossip.com/ your new home.

Thank you to all the current readers and I hope to be exposed to more readers on this new platform, I will keep this blog up for a while before taking it down, but all new posting will be on the new site.

Again Thank you all!

Who do you trust to find your ADS?

2010-04-01T17:30:00.007-04:00

What are ADS or Alternative data streams?

Alternate data streams allow more than one data stream to be associated with a filename, using the filename format "filename:streamname" (e.g., "text.txt:extrastream"). Alternate streams are not listed in Windows Explorer, and their size is not included in the file's size. Only the main stream of a file is preserved when it is copied to a FAT-formatted USB drive, attached to an e-mail, or uploaded to a website. As a result, using alternate streams for critical data may cause problems.

Why you should care about ADS?

One reason you should care is even though this has been around for quite some time now its still has a very high rate of success when implemented in a piece of malware. The ability to hide behind a know system file without changing the file size can be very deceiving.

Another important reason as stated by http://www.rootkitanalytics.com/, is due to this hidden nature of ADS, hackers have been exploiting this method to secretly store their Rootkit components on the compromised system without being detected. For example, the infamous Rootkit named 'Mailbot.AZ' aka 'Backdoor.Rustock.A' used to hide its driver file into system32 folder (C:\Windows\system32) as a stream '18467'.

Below is a brief illustration of what this looks like:

Now before you start worrying yourself there is hope on the horizon thanks to tools like "StreamArmor" .

What is Stream Armor you might ask?

StreamArmor is the sophisticated tool for discovering hidden alternate data streams (ADS) as well as clean them completely from the system. It's advanced auto analysis coupled with online threat verification mechanism makes it the best tool available in the market for eradicating the evil streams. StreamArmor comes with fast multi threaded ADS scanner which can recursively scan over entire system and quickly uncover all hidden streams. All such discovered streams are represented using specific color patten based on threat level which makes it easy for human eye to distinguish between suspicious and normal streams.

Or as I prefer to call it, the first step in the first direction... Don't get me wrong the are other great tools out there like streams from Microsoft or Gmer but after using StreamArmor recently I don't see how I could go back to those tools.

I decided to see how StreamArmor would performs when compared to two of their competitors (Streams and Gmer ). I created several ADS samples and split them up into two folders on my C drive, then scanned both folders with each program twice.

My sample streams included the following:

12 streams in total
I placed various files (exe, png, and avi) behind a few .txt, .doc, bmp and .pub documents.
I then encrypted one of those files, zipped two of them (one with Windows 7 build in compression and the other with winrar).

Microsoft Streams Results 9 out of 12

Gmer scan results: 5 out of 12

StreamArmor results: 9 out of 12

In the end both StreamArmor and MS Streams found 9 out of 12, none of them found the ADS that were zipped or the one that was encrypted (not that I expected the encrypted files to be discovered). At this point I am as confident as when I started writing this post "StreamArmor is my preferred choice". The ability to export great reports, easy to do run customize scans, and overall the results are not difficult to interpret.

For more further reading and examples visit the below links:

http://www.auscert.org.au/render.html?it=7967

http://www.irongeek.com/i.php?page=security/altds

http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx

http://www.gmer.net/

http://www.rootkitanalytics.com/tools/streamarmor.php

[Guest Post]Technology replaces the Technician

2010-03-30T06:58:00.000-04:00

This posting initially started off as a discussion on the "Yahoo Computer Business group" by Hank Cranmore from http://www.mobitech4u.com/corporateservices.html . The discussion was surrounding cloud commuting and the damaging effects it will soon have on most computer technicians businesses. This is due in part to how affordable it is to run your small business virtually from the cloud and drastically reduce the need for support contracts or better yet on site technical support.

Technicians are people skilled in a particular area. They serve their purpose in the strategic sense of demand and need until eventually, as with all things like this before, down thru history, technology replaces the technician.

Let me repeat that, "Technology replaces the technicians".

To make it worse, technicians are historically weak during periods of economic downturns or other disasters that destabilize their ability to continue to do what they do in the face of a more efficient and cheaper competitor.

Here are some favorite examples of mine from history of when technology replaces technicians in the past.

Example #1 - Spinning thread. In today's terminology a person who is skilled at spinning fibers by hand into thread or yarn would be labeled a Spinning Tech. They were replaced by a series of rapidly evolving technology. But not to fear, those that did not starve to death got jobs by the thousands working 12 hour shifts tending to the machines of the textile factories that replaced them.

Example #2 - Computer. Not our modern day computers, but people who in a time of great illiteracy could perform math computations with great skill. The word computer has existed since at least 300 AD. Up until the point in time they were replaced by machines, human computers were employed wide and far. They were the first computer techs. The first computer business was similar to a CPA but was not limited to money. A business could send a batch of calculations to the corner computer shop and it would be processed by hand, by computer techs into final numbers. One of the largest calculations in history processed by human computers was 21,000 pages long and took 7 years to complete. Something had to change. The first computer techs were put out of business by machines set in motion by Charles Babbage. Not sure what happen to those techs, but it was just in time for WW I, the great depression labor camps (CCC), WW II and the growth of Corporations.

What will replace the computer tech? Technology!

Ever hear of a calculator tech lately? Nope!

The calculator on my desk is cheap, disposable and now that I think of it, I dont even need to change the battery. It could run forever! If I break it, I replace it. All I need to do is to buy it and operate it.

If I did break it and did not have time to go buy another one, I would just turn to a virtual calculator on my computer or a calculator app out on the internet, or "The Cloud".

But what if that little calculator could also be any business machine I needed it to be? An internet interface?

The ultimate end of computer techs will be the "Walmart" scenario. When replacing your internet interface is as cheap and easy as going to the corner Walmart, picking the color and style of your choice and paying less than a new shirt to replace the shirt you lost as a computer tech.

Prior to that, as the work and demand goes away, former techs will work by the thousands for tech mills such as central repair depots, remote support centers and Onforce type dispatch services. Again awaiting the final "Walmart" stage.

Freelance techs can evolve into Technology Consultants and then Technology Consultants can evolve into Business Consultants.

Eventually, virtual hardware and software activation cards hanging on hooks at Walmart like gift cards will replace most technology consultants and then preconfigured activation "suites/packages" cards will threaten most business consultants.

But do not worry. History has proven that techs will be taken care of one way or the other after they are replaced.

Independence? Many weavers and spinners enjoyed great independence while it lasted. When it ended, it was bad. Ironically, it was only when weavers were without work did the last "die hards" focus on becoming experts at marketing and sales as a last resort to bring in more business. Eventually the need to support a family forced them to join the ranks of employees again.

So bottom line, technology replaces technicians.

Troubleshooting Configuration Management NetMRI

2010-03-18T13:37:00.032-04:00

Problem: While configuring our NetMRI appliance I notice that I was unable to view the configuration for serveral of our Routers and Switches, if I looked under Network Explorer --> Devices à Entire Netork I can see I have 20 devices but under the "Configuration Management" tab I am only able to see 6 devices.

Fig 1

Fig2

After clicking on one of the devices from within the "Network Configuration" tab, and selecting the "Errors" option I was greeted with the below message:

Fig 3
Solution:
After receiving the above error I knew it was time to log into this Switch and re-configure the SSH RSA key.

Switch Commands to delete the SSH rsa key then recreate a new one:

config t
no crypto key rsa (naturally you would think this is the command, but it's not instead it tells you the correct command)
crypto key zeroize rsa
crypto key generate rsa
1024 (when ask for the RSA key bit)
wr mem

Once that's done the next step is the log into the NetMRI appliance to reset the authentication information and update the device. This will occur automatically after 24 hours, or you can do it manually but navigating to Network Explorer --> Devices
then click on the device in question and go to the "Settings" tab -->"Config File Collection" and click "Reset Authentication info" then "Update" and lastly "Get Configs".

Check your error tab again for good measure if all goes well look under the config tab and you should now be able to manage the configuration on this device.

All Things SNMP

2010-03-15T17:14:00.002-04:00

I am working on a project whereby I have to configure our entire Network Infrastructure and a few high profile servers to be monitors by NetMRI and our Orion. Now since most of our devices are already being monitored by several other devices in the pass, I will try to illustrate the approach I took while doing this project.

Phase 1 (Backup and Cleanup)

It’s extremely important to make sure you backup your current running configuration before making any changes, and if you do have to make changes try to do them off hours so if something does goes wrong you wouldn’t get a million calls coming into the HelpDesk from angry workers. Before attempting the below you will need to first setup a TFTP server on your computer, here is a link to one of my favorites à http://tftpd32.jounin.net/.

Use a TFTP Server to Backup and Restore a Configuration

At the Router> prompt, issue the enable command, and provide the required password when prompted.

The prompt changes to Router#, which indicates that the router is now in privileged mode.

Copy the running configuration file to the TFTP server:

3. CE_2#copy running-config tftp:

4. Address or name of remote host []? 64.104.207.171

5. Destination filename [ce_2-confg]? backup_cfg_for_my_router

6. !!

7. 1030 bytes copied in 2.489 secs (395 bytes/sec)

CE_2#

Open the configuration file with a text editor. Search for and remove any line that starts with "AAA".

Note: This step is to remove any security commands that can lock you out of the router.

Copy the configuration file from the TFTP server to a new router in privileged (enable) mode which has a basic configuration.

10.Router#copy tftp: running-config

11.Address or name of remote host []? 64.104.207.171

12.Source filename []? backup_cfg_for_my_router

13.Destination filename [running-config]?

14.Accessing tftp://10.66.64.10/backup_cfg_for_my_router...

15.Loading backup_cfg_for_router from 64.104.207.171 (via FastEthernet0/0): !

16.[OK - 1030 bytes]

17.

18.1030 bytes copied in 9.612 secs (107 bytes/sec)

CE_2#

Phase 2 (Configuring Routers/Switches/WLAN Controller)

During this phase, I first logged into each appliance and run the following commands just to get a quick idea of what user accounts are configured on the device, and what are the SNMP settings.

sh run | inc snmp

sh run | inc user

Once I have gotten the above information I can build my configuration file. In our case we are removing old community strings and SNMP host while at the same thing updating the devices with the new information.

=============================
Updating Configuration on Cisco 3560
==============================
Config t
no snmp-server community public RO
no snmp-server community private RW
no snmp-server user pubic pubic v1
no snmp-server user pubic pubic v2c
snmp-server community $y$10g
username L0gg3r password P@$$\/\/0rd
snmp-server host 192.168.3.6 $y$10g

===================================
Configuring SNMP on Cisco WLAN
====================================

SSH into

config snmp version v2c enable
config snmp community create $y$10g
config logging syslog host 192.168.3.6 (maximum number of host this controller supports is one)
save config (answer Y)
you are set!

Once that’s all setup its time to log back into both Orion, and the NetMRI appliance and verify it configured correctly but triggering a few test alerts.

Additional Information

I came across this useful script if you need to install and configure SNMP remotely on a Windows Server à http://www.petri.co.il/forums/showthread.php?t=32269
Information on configuring Cisco call manager 5.X and 6.X to work with NetMRI à http://www.netcordia.com/community/forums/t/407.aspx
Excellent blog post on how to configure SNMP on a ESX 3.5 server which I plan on using à http://blog.lewan.com/2009/02/23/how-to-setup-snmp-on-esx-35-servers/

In the end your logs are only as useful to you if someone looks at it!

You Cannot Copy or Move Messages to Public Folders

2010-03-09T13:20:00.001-05:00

Yesterday I received a call from a user who was unable to do the following, "Use the Mark Complete flag" in Outlook or "Copy message from their inbox to a share public folder". After researching the issue I came across this article from Microsoft that solved the issue.

Solution:

To resolve this issue, remove the explicit Deny for the Everyone group on these permissions:

1. Start Exchange System Manager.
2. Under the Folders object, right-click the Public Folders object, and then click Properties.

Fig1

3. Click the Security tab, and then click the Everyone group.

4. Click to de-select the Deny check box for the three following permissions:

     * Create public folder
     * Create top level public folder
     * Create named properties in the information store

Fig2 Fig3

5. Click Apply, and then lick OK to close the properties.

Now you can go back to organizing your emails!

VMware IP Address Already Assigned to Another Adapter

2010-02-25T18:27:00.001-05:00

I got the following message when I was attempting to change the DNS address on a few of my VMware Servers today.

The IP address XXX.XXX.XXX.XXX you have entered for this network adapter is already assigned to another adapter Name of adapter. Name of adapter is hidden from the network and Dial-up Connections folder because it is not physically in the computer or is a legacy adapter that is not working. If the same address is assigned to both adapters and they become active, only one of them will use this address. This may result in incorrect system configuration. Do you want to enter a different IP address for this adapter in the list of IP addresses in the advanced dialog box?
In this message, XXX.XXX.XXX.XXX is an IP address that you are trying to set and Name of adapter is the name of a network adapter that is present in the registry but hidden in Device Manager.

I tried Microsoft's suggestion in this article "http://support.microsoft.com/?kbid=269155" however it didn't work for me. I had to create a "system environment variable" and give it the value of "1". Once that was completed I was able to follow the rest of the article. I removed all hidden adapters except for the "RAS Adapter" and I was then able to add the new IP address.

How to create a system variable:

On a Windows machine right click "My Computer" --> Properties --> Advanced tab--> Environment Variables--> System variables -->Click new --> Specify a "Variable name" (devmgr_show_nonpresent_devices) and the "Variable value" which is 1

Enjoy now you can rest easy!

Reference Links:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1179

http://support.microsoft.com/?kbid=269155

Troubleshooting VMware ESX Networking

2010-02-24T10:25:00.000-05:00

Troubleshooting ESX 4.0 Networking Issues

Phase one: Verification

If you installed the ESX software and you are unable to ping the host after installation try the following steps.

1. Verify that the required network interface cards are up and the switch port is up and configure correctly.
ESX Command to check network cards:

esxcfg-nics –l

Once you confirmed that your NICS are up verify the duplex setting on both your network switch and your ESX host.

ESX Command to set the speed to 1 Gig / Full duplex to full for NIC 0
esxcfg-nics –s 1000 –d full vmnic0

2. Verify that you have the correct network addressing configuration:
less /etc/sysconfig/network

3. Verify your vSwitch configuration.
esxcfg-vswitch –l
This command is also use to create and update a virtual machine (vswitch) network settings as you will see later one. Here you can see that NIC 0 and 2 are both assigned to vSwitch0

Verify your service console network setting.
esxcfg-vswif –l
This command is also used to create and update the service console network settings. This command is used if you cannot manage the ESX Server host through the VI Client because of network configuration issues

You can also use this command to create and update the virtual machine (vswitch) network settings.

If you are still unable to establish connectivity to the hosts, by this time, you can use the following commands to delete and recreate the vSwitch.

Phase two: ChangesAt this point if after verifying the following settings you don’t see anything unusual, you would take note of the above settings, delete them and recreate it.

esxcfg-vswitch –d vSwitch0 --> To remove virtual switch
esxcfg-vswitch –a vSwitch0 --> To re-add a virtual switch
esxcfg-vswitch -L vmnic0 vSwitch0 --> To assign physical nic0 (repeat and add additional nics)
esxcfg-vswif -d vswif0 --> To remove the service console network.

esxcfg-vswif -a vswif0 -p "Service Console" -i 10.100.0.114 -n 255.255.255.128 --> Add a Service Console (vswif0)
esxcfg-vswitch -v 69 -p "Service Console" vSwitch0 --> Add Vlan 69 to service console on vSwitch0

After these steps its important to restart the network service with the "service network restart" command.

Metadata analysis is cewl!

2010-02-14T23:44:00.015-05:00

The idea of this post came about while using the program "cewl" that was created by Robin Wood aka @digininja. I initially started using this application to harvest the email addresses on my company's website so I can compare to a know list of exchange public folders and correct any discrepancy. If you would like to give cewl a try you can find a nice install guide over at @joswr1ght website.
However after utilizing some of cewl's functions to download documents while analyzing the email addresses, I then went a step further and used Larry's paper as a guide to analyze some of those documents and the results were shocking. This brought on the realization that a lot of companies just post PDF's/ Word documents online without thinking about sanitizing them first, and thats just making it easy for the bad guys. I am not going to get into all the details of my findings but I would say if you haven't used cewl or read Larry's paper you are doing yourself a great injustice.

Now before you start panicking the are a few things you can do to limit the exposure of personal data your company might inadvertently leak on the internet. The National Security Agency published a paper back in 2008 which I believe is still very useful today. You can use this paper as a guide for sanitizing your PDF's and other documents before publishing them online.
I decided to do something new this time, and ask both Authors a few questions:

Robin Wood Q&A:

What prompted you to create cewl?
Cewl is based on a blog post by Larry "HaxorTheMatrix" Pesce from http://www.pauldotcom.com/. He used command line tools,and I put it all in one place.

Do you think that the area of metadata research is not getting a lot of attention?
I think there is a bit of research going on, Larry does some and foca is a great app. It is defense that is lacking.

What was the main usage you had in mind for this tool and is that goal being meet?
The main usage was creating dictionaries for dictionary attacks and it seems to be working from the feedback I've been getting.

What other meta data analysis tools are you working on?
I'm currently not working on any meta data projects at the moment, however I tend to be a spur of the moment developer so if I have an idea you might see a tool the next day.

How can someone contribute or help out with this tools or any other of your projects?
If anyone wants to contribute they can mail me ideas or send code patches. I'm always happy to listen to ideas.

Where can people follow your work and find out more about what you are doing?
For more details on my projects visit http://www.digininja.org/ or follow me on twitter @digininja.

Larry Pesce Q&A:

What made you decided to focus your research and write a paper on the evils of meta data?
It started with they myspace 1.6 gig picture leak, I wanted to see if any of the images contained GPS info so that I could tie the picture to a location.

Do you think everyone is doing their part to bring awareness to this issue?
I think that folks are just starting to come around on the whole "detailed recon" aspect of a test and are starting to educate themselves.

Would you say every company that publishes documents on the web should have a policy in place that addresses sanitizing documents?
I would not say that every company needs to have a policy on it.I know shocking! For some, the effort put forth to sanitize the public documents has no reward in reducing risk. But I think that if you do the analysis, any mid sized or larger company can easily and adequately address the risk that it introduces.

Since the paper have you done any additional work or research in this area?
I have done some, such as looking at some other common stuff for information gathering and recon. I have looked at simcards, and other document types; such as streaming video, stuff like YouTube for GPS tagged videos, and of course automating a lot of the work.

Do you think that more people should be doing research in this field?
Yes, in as much as the attackers are doing the same thing. I think that most of us don't realize how much info is out there with a little bit of digging

I would like to end with a quote which I am sure I have picked up from the PDC crew “no need for a zero day, when all your personal information is in the wild".

Reference links:

http://www.digininja.org/
http://pauldotcom.com/wiki/index.php/Episode129
http://pentestit.com/2009/05/16/foca-fingerprinting-organisation-collected-archives/
http://www.sans.org/reading_room/whitepapers/privacy/document_metadata_the_silent_killer_32974
http://www.willhackforsushi.com/?p=410
http://www.fas.org/sgp/othergov/dod/nsa-redact.pdf
http://www.nsa.gov/ia/_files/app/pdf_risks.pdf

Configuring a NetMRI Appliance

2010-02-05T15:57:00.000-05:00

I am currently in the middle of working on a project that involves configuring a NetMRI appliance and a accompanying event collector. So far I am finish configuring the appliance along with a test switch "Cisco 3560".This blog posting will briefly go over some of the steps I took to accomplish this task.

What is NetMRI?

NetMRI enables organizations to take control of network configurations and changes–making it easy to identify hard-to-find configuration problems that are lurking in the network and meet internal standards and external compliance requirements. Instead of just logging changes, NetMRI utilizes built-in subject matter expertise to audit, analyze and automate network change.

Prior to starting the configuration process for the NetMRI appliance you need to install an SSH client and have a cross over cable, or a switch with the correct VLAN configured. NetMRI always listens on the private IP address 169.254.1.1,with subnet 255.255.255.0. Simply configure your machine to 169.254.1.3 or any address in that range within this range that’s lower than .254 with a subnet of 255.255.255.0.

Once you are finish try to ping 169.254.1.1 if you are able to communicate with the appliance you can use your favorite SSH client and connect to the appliance on port 22 using the following credentials admin/admin and from there run the “configure server” command.

During this process you will be asked several questions:

· Network , Server and Domain name

· Two DNS address

· Time server/ time zone

· Management port IP address and gateway

· Scanning port IP address an gateway if you choose to use both ports

Once you are finish you can now login into the appliance using the newly assigned IP address that was selected during the setup above. Ex http://172.29.19.4

Select next to continue.

Step 1: Chose a new admin password.
Choose a difficult password, since the username cant be changed its advisable to use a password that's not easily guessed.

Step 2: License file
Browse to the location on your computer where you have the file and click next.

Step 3: IP Addresses/CIDR Blocks
You can either add a whole subnet or individual IP addresses using a /32 at the end of the IP address.

Setp 4: Community Strings
Here is where you will enter the string that you will be configuring on your router and switches.

Step 5: CLI Credentials

Here is where you need to enter the user name and password that the NetMRI appliance is going to be using to access your infrastructure devices; you will also need to enter your Enable password here to.

Once you are done click finish.

After the NetMRI setup process has been completed, review the Network Explorer tab > Inventory tab > Devices / Interfaces section > Devices page. If the Default Gateway, CIDR blocks, SNMP credentials and Telnet/SSH credentials were entered correctly, you should start to see devices listed in this table within a few minutes. Periodically refresh your browser to see the progress of the discovery process.

Troubleshooting

If you don’t see any devices within a few minutes, you should verify the accuracy of the network information added during the configuration process as follows:

1. In the NetMRI header panel, click the Settings button. In the menu along the right side of the Settings window, click the Setup section, then click Discovery Settings. Ensure that the given CIDR blocks cover the desired parts of your network. Also, ensure that the Default Gateway is covered by one of the Included CIDR blocks, but not by one of the Excluded CIDR blocks.

2. In the menu along the right side of the Settings window, click Collectors and Groups (just above Discovery Settings). Ensure that SNMP collection is Enabled. In the Settings window, click SNMP Credentials and verify that the community strings for your network devices are entered properly (e.g., check spelling and case-sensitivity).

3. If NetMRI was configured using a crossover Ethernet cable and NetMRI was not on the network following completion of the configuration process, then NetMRI may not have been successful in its initial probes of the network. Navigate to Settings > Settings section > Discovery Settings page and click the Reset Discovery Counters button (below the table) to kick off the initial network probes again, then continue to monitor the discovery process as before.

Any changes made using the forms described above will be automatically used by the discovery process. If the new information is correct, you should start to see devices appearing in the table at Network Explorer tab > Inventory tab > Devices / Interfaces section > Devices

Cisco Device Configuration

Create Username on the Cisco 3560 switch

======================================

username mriuser password 7

aaa new-model

aaa authentication login default local

Configure SNMP Cisco Catalysis 3560

===================================

config t

snmp-server group nmri v2c read mrigp

snmp-server community mr131 RO

snmp-server user mriuser nmri v2c

snmp-server enable traps syslog

Doing an SNMP Walk

In order to do a SNMP walk you need to replace the Root OID system with 1.3.6.1.2.1.1.

Reference links:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_20_se/configuration/guide/swsnmp.html

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=system&translate=Translate&submitValue=SUBMIT&submitClicked=true

Citrix XenServer or VMware ESXI

2010-01-27T10:23:00.002-05:00

As stated in a post back in December I am working on rebuilding my home network, I looking to go “Green” and cut down on some of the excess energy. So what better way to do that than to virtualized my network. However with virtualization come decisions such as XenServer or VMware. So the purpose of this post is to go through my thought pattern as to why I want to leave WMware and migrate to XenServer.

Just for the record I am still using both ESXi and ESX enterprise at work, and soon going to be upgrading to Vsphere, so from time to time I will still be posting information about VMware. Now using the above chart you can clearly see lots of good reasons why you should give XenServer a try and not be too quick to choose ESXi. I will highlight some reasons for wanting to go the Xen side of things.

Reason one: Hardware

I have an HP DL 380 G4, and a DL360 G3 that I am planning on using for this project, now by default this Server‘s architecture does not natively support VMware’s new Vsphere. So instead of installing ESXi 3.5 and being locked into a product with a limited life cycle I started thinking of an alternative virtual solution hence Citrix XenServer.

Reason two: Ease of management

As stated above “centralized multi-server management”, currently at work we have several ESXi installations across the network and managing them at times can be a pain. VMware offers a solution for there paid product called “Virtual Center” however the free product does not have this function. So instead you have to log into each machine individually to apply patches or make system changes. After a while even if you have six ESXi servers this can easily become a hassle.

Reason three: Innovation

XenServer was the first solution on the market to employ paravirtualization, which allows a guest OS to be fully aware that it is being run on virtualized hardware. This collaboration between the OS and the virtualization platform enables the development of a simpler, leaner hypervisor, as well as highly optimized performance.

Reason four: System Maintenance

The VMware VI 3.5 updates site lists hundreds of patches that have been issued since the product was launched in December 2007 and the automated update process is touted by VMware as a way of managing the application of these updates. By contrast, Citrix has issued just five hotfixes for XenServer 4.0 since its release in August 2007 and includes automated update features in XenCenter for applying system updates.

Reason five: Budgetary Concerns

If you are a small to mid size business that's now getting into virtualization your managment will want to first see how much return on invest (ROI) the can get on any solution before putting extra funding into it. With the enterprise level solution offered by Citrix you are able to do this at 3X less than the cost of using Vmware.

In conclusion I am not saying that VMware is any less superior than ZenServer I am mainly tring to encourage others to not only lean towards the popular product in the marketplace but always try other options.

Reference links

http://www.citrix.com/site/resources/dynamic/salesdocs/XS_vs_VMware_comparison.pdf

Installing and Configuring Archivists’ Toolkit

2010-01-23T14:42:00.005-05:00

While working on an AT installation and following the manual as well as calling support I was unable to resolve an issue that I was encountering, so I decided to research and document the fix.

What is Archivists’ Toolkit?

The Archivists’ Toolkit™, or the AT, is the first open source archival data management system to provide broad, integrated support for the management of archives. It is intended for a wide range of archival repositories. The main goals of the AT are to support archival processing and production of access instruments, promote data standardization, promote efficiency, and lower training costs.

Installation

This is just a brief overview of the installation steps since there is already an official manual that covers most of these steps.

You first need to create a blank database using either MYSQL or Microsoft SQL server; in our case I used MS SQL.
Once the database has been created, you then need to install the a Archivists’ toolkit
application on the client machine, after the installation you need to browse to the %install directory%\Program Files\Archivists’ Toolkit 2.0\ and launch the “Maintenance Program 2.0.exe”
- This program is used to prep the Db and create all the necessary tables.

Now here is where things got out of hand for me, based on the specified documentation I needed to select my DB type, enter the connection URL, then my username and password.

Connection URL:

Jdbd:sqlserver://[ip address]:[port];databaseName=[name]

e.g: Jdbc:sqlserver://127.133.68.55:1059;databaseName=OurArchives

However that didn’t seem to work. I did further research and discovered I needed to first have the following in place ;

SQL Server 2005 JDBC driver, and a CLASSPATH configured
Create a ODBC connection to the DB Server

Steps to create a Java CLASSPATH

1-- Download sqljdbc__enu.exe driver and extra it to a temporary directory (link provided below).

2-- Run sqljdbc__enu.exe.

3-- Enter an installation directory when prompted. We recommend that you unpack this zip file in %ProgramFiles% with the default directory: "Microsoft SQL Server 2005 JDBC Driver".

Once you have followed the above information the next step is to setup your classpath on the client machine.

On a Windows machine right click "My Computer" --> Properties --> Advanced tab--> Environment Variables--> User variables for user name -->Click new --> Specify a "Variable name" and the "Variable value" which is path you created above in step 3.

Image of a configured classpath on my Windows 7 PC:

And finally instead of following the format;

Jdbd:sqlserver://[ip address]:[port];databaseName=[name]

I used Jdbd:sqlserver://[ip address], typed in my User and Password went on to the next screen and enter in my repository name as the DB name and all was well.

Hopefully this can help someone and save you the back and forth effort of trying to set this up.

73 Reasons why you dont need money to start a Tech repair business!

2010-01-18T19:22:00.090-05:00

Navisphere Express (AX4-5i) and VMWare ESX 3.5 preparation

2010-01-14T17:07:00.004-05:00

In this post I will be documenting the steps I I took I prep our SAN and Virtual infrastructure prior to the creation of several VM's for a project.

Creating a Disk Pool

1. Log into your SAN URL in my case it was a Navisphere https://SAN-01
2. Click on Disk Pools (1) -->Select available drives (2) type of Raid configuration then
create Disk Pool.

Creating Virtual Disks

Log into https://SAN-01

2. Click on Virtual Disks (1) Create New Virtual Disk(2)

Click on the Disk Pool tab -->(1) Select a Disk pool with free space -->(2) Type in your Virtual Disk name -->(3) Choose virtual disk size -->(4)Optionally you can pick a Server to apply this Disk too -->(5) Select apply to complete

Presenting the Virtual disk to a VMware Blade Server
1. First click on Virtual Disks

2. Then select you disk you want to present to the Server

3. Click on "Assign Server"

4. Select only one Servers so you can present the VDisk to be formatted--> apply OK.

5. Once you have selected the Server to apply this virtual disk too, log into Virtual Center with your VM client --> select that Server (1) -->Go to the configuration tab and right
click the ISCSI software Adapter then choose “Rescan”.Once this is completed
you should see the drive appear below and you are now able to add the drive and
format it.

6. Select the Server you assigned the virtual disk too -->Once you can see your newly presented virtual disk -->select Configuration tab of that Server-->Under hardware click Storage -->Then proceed by clicking “Add storage” on the upper right hand corner

7. Once the new windows pops up select “Disk/Lun” --> click next choose the virtual disk you just presented -->Click next twice -->Give it the same name as it appears when you log into https://SAN-01 (Navisphere )

8. When prompted to choose a block size, choose the maximum file size of the drive for example if the drive is formatted for 1 TB choose a block size of 1024 GB, if its formatted for 2 TB choose 2048 GB and so forth --> Select finish and you are done.

Now you can log back into https://SAN-01

(Navisphere ) and assign the Virtual Disk to the remaining Servers that needs to access it.

Goodbye Smoothwall, Hello pfSense!

2010-01-09T23:28:00.000-05:00

I have been a faithful Smoothwall user for many years.After the first time I got hacked I started to look into firewalls and was pointed to smoothwall by my co-blogger Dre Day.

Now years later I have decided to leave Smoothwall in 2009 and start the year a fresh with pfSense. Why you might ask, I will attempt to answer this question but putting the facts in front of you and hopefully you can see why.

I have take information from both projects website and narrowed it down to a few features of interest to me.

Smoothwall Express features of interest to me

Firewalling:

* Supports LAN, DMZ, and Wireless networks, plus Extrnal.
*External connectivity via: Static Ethernet, DHCP Ethernet, PPPoE,PPPoA using various USB and PCI DSL modems.
* Portforwards, DMZpin-holes
* Outbound filtering
* Timed access
* Simple touse Quality-of-Service (QoS)
* Traffic stats, including perinterface and per IP totals for weeks and months
* IDS viaautomatically updated Snort rules
* UPnP support
* List of badIP addresses to block

Proxies:

* Web proxy for accelerated browsing
* POP3 email proxy withAnti-Virus
* IM proxy with realtime log viewing

Maintenance:

Backup config
* Easy single-click application of all pending updates
* Shutdown and Reboot from UI

pfSense features of interest to me

Firewall

Filtering by source and destination IP, IP protocol, source and destination port for TCP and UDP traffic
Able to limit simultaneous connections on a per-rule basis
pfSense utilizes p0f, an advanced passive OS/network fingerprinting utility to allow you to filter by the Operating System initiating the connection. Want to allow FreeBSD and Linux machines to the Internet, but block Windows machines? pfSense can do so (amongst many other possibilities) by passively detecting the Operating System in use.
Option to log or not log traffic matching each rule.
Highly flexible policy routing possible by selecting gateway on a per-rule basis (for load balancing, failover, multiple WAN, etc.)
Aliases allow grouping and naming of IPs, networks and ports. This helps keep your firewall ruleset clean and easy to understand, especially in environments with multiple public IPs and numerous servers.
Transparent layer 2 firewalling capable - can bridge interfaces and filter traffic between them, even allowing for an IP-less firewall (though you probably want an IP for management purposes).
Packet normalization - Description from the pf scrub documentation - "'Scrubbing' is the normalization of packets so there are no ambiguities in interpretation by the ultimate destination of the packet. The scrub directive also reassembles fragmented packets, protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations."
- Enabled in pfSense by default
- Can disable if necessary. This option causes problems for some NFS implementations, but is safe and should be left enabled on most installations.
Disable filter - you can turn off the firewall filter entirely if you wish to turn pfSense into a pure router.
VPN
IPSec
Reporting and Monitoring RRD Graphs
Dynamic DNS support
Network Address Translation (NAT)
Real Time Information
State Table

Redundancy

CARPfrom OpenBSD allows for hardware failover. Two or more firewalls canbe configured as a failover group. If one interface fails on theprimary or the primary goes offline entirely, the secondary becomesactive. pfSense also includes configuration synchronizationcapabilities, so you make your configuration changes on the primaryand they automatically synchronize to the secondary firewall

Captive Portal

Captive portal allows you to force authentication, or redirectionto a click through page for network access. This is commonly used onhot spot networks, but is also widely used in corporate networks foran additional layer of security on wireless or Internet access. Formore information on captive portal technology in general, see theWikipediaarticle on the topic. The following is a list of features in thepfSense Captive Portal.

In the end pfSense was the best fit for what I was looking for in a Firewall.

Windows 7 GodModes

2010-01-08T14:15:00.002-05:00

A friend of mine sent me a message yesterday asking me to create a folder on my Windows 7 desktop and name it "GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}" without the quotes of course.

Now being the skeptic that I am I delayed and then he proceeded to tell me that its not going to mess my system up, knowing that he is not the type to do that I took a chance :). To my surprise it really was a GodMode with lots of undocumented features.

Quote from CNET news in repose to this feature "Intended for developers as a shortcut to various internal settings,such features have been around since Vista and even before, according to the head of Microsoft's Windows division, who tells CNET that theso-called GodMode settings folder uncovered by bloggers is just one ofmany undocumented developer features included in Windows.

To make it work, create a new folder with any name, then a period, then one of the text strings below, example test.{00C6D95F-329C-409a-81D7-C46C66EA7F33} will give you the following

Additional strings to test with:

{00C6D95F-329C-409a-81D7-C46C66EA7F33}
{0142e4d0-fb7a-11dc-ba4a-000ffe7ab428}
{025A5937-A6BE-4686-A844-36FE4BEC8B6D}
{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}
{1206F5F1-0569-412C-8FEC-3204630DFB70}
{15eae92e-f17a-4431-9f28-805e482dafd4}
{17cd9488-1228-4b2f-88ce-4298e93e0966}
{1D2680C9-0E2A-469d-B787-065558BC7D43}
{1FA9085F-25A2-489B-85D4-86326EEDCD87}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
{2227A280-3AEA-1069-A2DE-08002B30309D}
{241D7C96-F8BF-4F85-B01F-E2B043341A4B}
{4026492F-2F69-46B8-B9BF-5654FC07E423}
{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}
{78F3955E-3B90-4184-BD14-5397C15F1EFC}

And, as a reminder, to create the Godmode folder itself, use this string:

{ED7BA470-8E54-465E-825C-99712043E01C}

Screen shot of a protion of the GodMode admin interface:

I started testing a few options and the first one that I can see myself using on a daily basis is the "Record steps to reproduce a problem". This little screen capture program can also be called from the command prompt by typing PSR, this can be very useful when troubleshooting an issue, or for documentation.

I have tested this on Windows Server 2008 and it works but apprently this feature is not supported in on Windows 2003.

Guest Post: Microsoft Security Essentials Command Line Tip

2010-01-08T02:11:00.001-05:00

The is a guest post courtesy of Matt Burian an IT Consultan, you can find out more about him over at www.burianit.com.

Something I found while trying to find a way to update MicrosoftSecurity Essentials automatically on my home testing domain. Some command line parameters for working with MSE:

http://www.winhelponline.com/blog/updating-microsoft-security-essentials-using-command-line/

Especially useful is this line:

"%ProgramFiles%\Microsoft Security Essentials\MpCmdRun.exe" -SignatureUpdate

This is used to update the MSE definition files. I have automatic windows updatesdisabled on my client machines, so I push this command in a login
script via group policy, and know that my definition files are up to date on all machines every time a user logs in.

Obviously, this is just for my personal windows domain, and would not be appropriate for a real business or enterprise environment as MSE is designed for homeuse, and provides no management features.

However this could still be useful if you wish to disable windows automatic updates, and still update your MSE definitions, either on a network, or just a local machine by running this command at startup of the machine.

Troubleshooting tips and other useful information

2010-01-02T15:10:00.005-05:00

First let me start by saying I wish everyone a Healthy and Prosperous 2010. While reading through my emails this morning I came across an email from http://techrepublic.com.com/ that had several wonderful articles, and out of those I pulled out a few useful gems that I believe can benefit anyone starting out in IT.

How Does Ping Really Works?

http://images.globalknowledge.com/wwwimages/whitepaperpdf/WP_Mays_Ping.pdf

The OSI Model Understanding the Seven Layers of Computer Networks

http://images.globalknowledge.com/wwwimages/whitepaperpdf/WP_Simoneau_OSIModel.pdf

IP Addressing and Subnetting for New Users

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800a67f5.shtml

12 Things to know when troubleshooting your network

http://images.globalknowledge.com/wwwimages/whitepaperpdf/WP_Tolani_12TipsTroubleshooting_P1.pdf

TCP/IP Sluething Troubleshooting TCP/IP Using Your Toolbox

http://images.globalknowledge.com/wwwimages/whitepaperpdf/WP_Rohling_TCP-IP.pdf

Router Essentials

http://images.globalknowledge.com/wwwimages/whitepaperpdf/WP_Tolani_RouterEssentials_P1.pdf

Network Security Checklist

http://www.dell.com/downloads/global/solutions/network_sec_checklist.pdf

VMware ESX Corrupt --redo log--

2009-12-21T15:24:00.029-05:00

I was recently faced with a VMware ESX issue and while researching a solution I found an useful article in the VMware knowledge base.

Issue:

I notice one of the Servers weren't functioning correctly and after further investigation of the logs I notice this following error message "The Redo Log on Srvr01-0000001.vmdk has detected to be corrupt. The virtual machine needs to be powered down. If the problem still persists, you need to discard the redo log". After attempting a few times to restart the guest OS and failing, I use VMware article which resolved this issues for me.

The article is well written so the only thing I would like to add is the followings steps for creating a local user account on the VMware host. This account is needed to ssh into the host and perform the steps necessary to resolve this issue. In addition Root login via SSH is disabled by default so these steps are necessary.

Steps to create a local user with shell access on a VMware ESX host:

Step One:

Launch your VMware infrastructure client and connect to the ESX server that’s hosting the problematic guest OS, if you connect to your virtual center server you wouldn’t get the option to create a local user. Login with your Root user and and password.

Step two:

Once you are logged in click on the "Users and Groups" tab, insure that you are in the "users view", then right click a user account from the list select add and fill in requested information (username and password).

***note** Check off the box that says "Grant shell access to this user"

You can now ssh to the ESX server using your newly created credentials. Once you log in issue the "su -" command, you will be prompted for your root password enter it and you are ready to continue with the rest of the article.

Excerpt from the article:

To terminate the Master World and User Worlds for the virtual machine:

1. Run the following command to list the running virtual machines to determine the virtual machine ID for the affected virtual machine:

#cat /proc/vmware/vm/*/names

The output appears similar to:

vmid=1076 pid=-1 cfgFile="/vmfs/volumes/50823edc-d9110dd9-8994-9ee0ad055a68/VMNAME/VMNAME.vmx" uuid="50 28 4e 99 3d 2b 8d a0-a4 c0 87 c9 8a 60 d2 31" displayName="VMNAME-192.168.1.10"

Note: vmid='1076' is used as an example in this article.

2. Run the following command to identify the Master World ID:

# less -S /proc/vmware/vm/1076/cpu/status

Expand the terminal or scroll until you can see the right-most column labeled 'group'. In this column you find the vm.####

In this example, '1092' is the ID of the Master World.

3. Run the following command to terminate the Master World and the virtual machine running in it:

/usr/lib/vmware/bin/vmkload_app -k9 1092

4. The virtual machine's User Worlds and the virtual machine's processes are stopped.
If the command is successful, you see output similar to:

# /usr/lib/vmware/bin/vmkload_app --kill 9 1070 Warning: Jul 12 07:24:06.303: Sending signal '9' to world 1070.

If the Master World ID is wrong, you see the error:

# /usr/lib/vmware/bin/vmkload_app --kill 9 1071

Warning: Jul 12 07:21:05.407: Sending signal '9' to world 1071.
Warning: Jul 12 07:21:05.407: Failed to forward signal 9 to cartel 1071: 0xbad0061

The virtual machine is now powered off. Power on the virtual machine. Verify that it is able to boot properly and that the message error no longer occurs.

Here is the link to the article --> http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1006585.

Winter Cleaning "Rebuilding my HackLab"

2009-12-19T00:15:00.009-05:00

Its that time of year again as a Tech when you have to take a look around and figure out which junk you are going to keep and which ones you are going to throw away. I have been meaning to rebuild my home network and make it half "HackLab" and half productions.

In doing so I started to ask myself if I wanted to keep VMWare or move on to Citrix XenServer, I will do a full blog post later with the details of that decision. I will also include some information on my setup once its complete, for now here is some pics of my old "hacklab"

My Command Center

1 HP DL 380 G4, 1 SupperMicro,2 HP DL 360 G3 servers

7 Cisco 2600 Routers, 1 Catalyst 2900 and 1 Catalyst 3500 switch

Laptops and PC spare parts

Once I have my lab in order I need to figure out which items to put on Ebay :)

Free Malware Analysis Services

2009-12-16T18:02:00.006-05:00

While analyzing an infected machine today I retrieved a sample that needed further analysis. I would normally start by scanning these files with my Anti-virus software,however since the Anti-virus was disabled by the virus that wouldn’t have been too helpful. I currently don’t have a test lab to analyze these samples so the following services below came in handy.

Some of them are only capable of analyzing potentially infected files, while others can also analyze a URL. The reports are pretty details and saved me a lot of time.

http://scanner.novirusthanks.org/ (file scanner and URL scanner)

http://www.virustotal.com (file scanner)

http://anubis.iseclab.org/ (file scanner and URL scanner)

http://virusscan.jotti.org/ (file scanner)

http://filterbit.com/ (file scanner)

http://camas.comodo.com/ (file scanner)

http://www.cwsandbox.org/?page=submit (file scanner)

http://eureka.cyber-ta.org/ (file scanner)

http://www.joebox.org/submit.php (file scanner and URL scanner)

http://www.norman.com/security_center/security_tools/submit_file/en (file scanner)

http://www.threatexpert.com/submit.aspx (file scanner)

http://xandora.security.net.my/?page_id=332 (file scanner)

Omeka Install issue & resolution

2009-12-14T13:18:00.000-05:00

I was tasked with setting up a test Omeka Server for our Library Archivist, based on the installation section on the site this should take about “five-minutes” give or take.

What is Omeka

Omeka is a free and open source collections based web-based publishing platform for scholars, librarians, archivists, museum professionals, educators, and cultural enthusiasts. Its “five-minute setup” makes launching an online exhibition as easy as launching a blog. Omeka is designed with non-IT specialists in mind, allowing users to focus on content and interpretation rather than programming. It brings Web 2.0 technologies and approaches to academic and cultural websites to foster user interaction and participation. It makes top-shelf design easy with a simple and flexible templating system. Its robust open-source developer and user communities underwrite Omeka’s stability and sustainability.

What are the minimum and the recommended specifications?

• Linux operating system
• Apache HTTP server (with mod_rewrite enabled)
• MySQL version 5.0 or greater
• PHP scripting language version 5.2.4 or greater (with mysqli and exif extensions installed)
• ImageMagick image manipulation software (for resizing images in Omeka)

Direct Link to Omeka Documentation
http://omeka.org/codex/Documentation

Omeka Plugins
http://omeka.org/add-ons/plugins

Installation
http://omeka.org/codex/Installation

http://digin.arizona.edu/files/omeka.pdf

The above instruction goes under the assumption that you already have a LAMP environment in place. Since I haven’t done a LAMP setup in quite some time I did a google.com search and landed on one of my favorite tutorial site http://www.howtoforge.com/ubuntu_lamp_for_newbies.

One small issue I encountered and how I resolved it

After doing the LAMP setup and following both guides under the installation section, I connected to the web server URL http://server and instead of displaying, I was prompted to download a file “index.php”.

Back to google.com…After searching going through the various Apache configuration folders and directories, I realize that I needed to add the below configuration to the bottom of the mime.conf file just above the last "<\IfModule>" closing tag.

Steps taken:

Logged into the Linux Web Server and made the following changes;

ituser@TestSrvr:/$ cd /etc/apache2/mods-enabled
ituser@TestSrvr:/$ sudo nano ./mime.conf

Open IfModule mod_mime.c

AddType application/x-httpd-php .php

AddType application/x-httpd-php .phtml
AddType application/x-httpd-php .php3
AddType application/x-httpd-php .php4
AddType application/x-httpd-php .html
AddType application/x-httpd-php-source .phps
Close IfModule

Reference --> http://forums.digitalpoint.com/showthread.php?t=7584

Restarted apache “sudo /etc/init.d/apache2 restart” and I was ready to rock-n-roll!

Self Introduction

2009-12-14T11:46:00.001-05:00

Being that this is my first post I figure I should start off by introducing myself. I am a Jr. Network Admin at a College, Husband, father, and I also run my own IT consulting business on the side. I have a strong interest in Information Security but I am currently not in that field as yet.

The reason I decided to start this blog is to basically keep track of projects I am working on, things of interest to me, and of course all of those wonderful links and how-to's that you come across when troubleshooting an issue but two months later can’t find.

The type of posting you can look forward too could include topics such as, “the steps I took to deploy a Linux web Server at work", "various topics on VMware deployment and upgrades", "setting up a small office network and securing it”. Or just things I came across while on site at a client.

Hope you keep reading and of course comments are always welcome!