Konrads's questions

I am documenting this for posterity. After a period of IPSEC tunnel being succesfully up and working beteen Azure VPN Gateway and Fortigate 200 E firewall running FortiOS v6.4.4 build1803 (GA), the tunnel drops and does not re-establish itself for a while (in my case about an hour) and then resume again as if nothing happened.

Fortigate log file contains the following useful entries of which the error "peer SA proposal not match local policy" is indicative:

date=2021-01-03 time=04:22:03 eventtime=1609618924346452242 tz="+0800" logid="0101037129" type="event" subtype="vpn" level="notice" vd="root" logdesc="Progress IPsec phase 2" msg="progress IPsec phase 2" action="negotiate" remip=1.2.3.4 locip=5.6.7.8 remport=500 locport=500 outintf="wan1" cookies="xxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxx" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="AZURE-XYZ" status="success" init="remote" exch="CREATE_CHILD" dir="outbound" role="responder" result="DONE" version="IKEv2"
date=2021-01-03 time=04:22:03 eventtime=1609618924346420462 tz="+0800" logid="0101037125" type="event" subtype="vpn" level="error" vd="root" logdesc="IPsec phase 2 error" msg="IPsec phase 2 error" action="negotiate" remip=1.2.3.4 locip=5.6.7.8 remport=500 locport=500 outintf="wan1" cookies="xxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxx" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="AZURE-XYZ" status="negotiate_error" reason="peer SA proposal not match local policy"
date=2021-01-03 time=04:22:03 eventtime=1609618924346376500 tz="+0800" logid="0101037120" type="event" subtype="vpn" level="notice" vd="root" logdesc="Negotiate IPsec phase 1" msg="negotiate IPsec phase 1" action="negotiate" remip=1.2.3.4 locip=5.6.7.8 remport=500 locport=500 outintf="wan1" cookies="xxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxx" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="AZURE-XYZ" status="success" result="N/A" peer_notif="N/A"

Azure VPN gateway contains no useful diagnostics.

I would like to back up some on-prem system (SRV1) using Microsoft Azure Backup Server (MABS1), but I would like to host the MABS1 server itself on Azure as a VM and use an on-premises storage for cache/scratch (NAS1). I want to backup for Bare Metal Recovery (BMR) and that requires a MABS.

Will the traffic flow like this:

(A) SRV1->NAS1->MABS1->Site recovery Vault? Or (B) SRV1->MABS1->NAS1->MABS1->Site Recovery Vault?

Given full admin access to vSphere, how can I translate that access to the ability to login via SSH to invididual ESXi systems to do some low level maintenance? Can I log in with the vSphere credentials (they are AD integrated) to a managed ESXi system for which I don't have any local credentials?

I want to set a specific ethernet MAC address for an interface using UDEV rules. I have the following rule: SUBSYSTEM=="net", ACTION=="add", ATTRS{serial}=="50B123", ATTR{address}="00:22:33:44:55:AA", NAME="yolo0"

The rule matches and the interface is renamed to "yolo0" however the hw ether address remains unchanged from the one pre-set by the manufacturer. I can change the mac address manually of course using:

ifconfig yolo0 hw ether ..00:22:33:44:55:AA

In a 200 Windows server estate there are years of missing patches. What is the quickest way to patch those? Is WSUS smart enough to batch-install maximum patches to minimise reboots? Servers are mostly "generic" so there is somewhat less of a concern about patching breaking things.

I am trying to use a simple Android 4.4.4 VPN connection to openswan/xl2tpd/pppd combo. the IPSec SA works, but xl2tpd at one point terminates the pppd and this shows up in logs:

xl2tpd[17990]: handle_avps: handling avp's for tunnel 46247, call 0
xl2tpd[17990]: message_type_avp: message type 4 (Stop-Control-Connection-Notification)
xl2tpd[17990]: assigned_tunnel_avp: using peer's tunnel 54725
xl2tpd[17990]: result_code_avp: avp is incorrect size.  8 < 10
xl2tpd[17990]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
xl2tpd[17990]: handle_packet: bad AVP handling!
xl2tpd[17990]: network_thread: bad packet
xl2tpd[17990]: build_fdset: closing down tunnel 46247
xl2tpd[17990]: Terminating pppd: sending TERM signal to pid 17991
xl2tpd[17990]: Connection 54725 closed to 87.114.120.198, port 50027 (Result Code: expected at least 10, got 8)

There are many pleas for help online, but to no avail:

My xl2tpd configuration:

 cat /etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
port = 1701
debug avp = yes
debug tunnel = yes
debug avp = yes
debug packet = no
debug network = yes
debug state = yes
[lns default]
ip range = 10.152.2.2-10.152.2.254
local ip = 10.152.2.1
require chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
unix authentication = no

CLARIFICATION: The existing setup works just fine with iOS 7 on iPad

I would like to "pin" the certificate or at least the certificate authority for AnyConnect connections. Given the amount of SSL mitm'ing and compromised CA's, I want to ensure that only certificates signed by a certain CA are accepted as valid by the AnyConnect client when establishing connection to the VPN.

How to do it on ASA 5510?

A content inspection system wants to inspect every e-mail that is sent or received outside organization's boundary (e.g. from/to Internet). I do not want to put the inspection system in-line as an SMTP gateway for availability reasons, I would much rather have every such email BCC'd to the content inspection system.

Can it be done on Exchange?

Is it possible using Windows standard tools to create such a permission model where a user can create a file in a directory, but once the file has been created (file handle closed), the user can not modify that file or any other files in the directory?

The use case is that a user submits a file for review, but should not be allowed to modify it after submission.

I have a Cisco AnyConnect accessing ASA 5510. The AnyConnect connection correctly authenticates and then hangs of "Checking for profile updates...".

The client (Vista64) is behind a firewall and can connect outside only via HTTP proxy. Wireshark shows that the authentication and initial setup correctly uses the system wide proxy, however, profile update does a direct tcp connection and of course - fails.

How to fix it?

I am looking into building a syslog / logging infrastructure and am pondering about some architecture best practices. Essentially, I see that a syslog system needs to support two conflicting workloads:

• log collection. Potentially massive streams of data need to be written quickly to disks and indexed.
• log querying. logs will be queried by both fixed fields such as date and source as well as text search.

What is the best disk/system setup assuming I'd like to keep it to a single server for now? Should I use SSDs or ramdisk to off-load some processing? some disks in stripe and some in raid5?

I am particularly eyeing Graylog2 with ElasticSearch/MongoDB

I have a server that runs two different workloads:

• heavy, linear write (stores all network traffic as pcaps); and
• a transactional DB workload where IDS alerts are written to (frequent inserts) and then analysed (queries with limits, no massive reporting).

At the moment, the disk performance seems to be really poor. Specifically, the pcaps and alerts are written, but DB querying is unacceptably slow.

How to "partition" disk I/O in such way as to give priority to the DB workload while monitoring if any writes are "falling behind".

The server has quite a bit of ram for caching if it helps.

A domain in an AD Forest has a trustAttributes value set to 0x800000. Microsoft documentation lists this as reserved, but it appears that Microsoft themselves use it for something. My question is: What does domain trust attribute 0x800000 mean?

My users are mostly road warriors who work on their Windows laptops. I would like to have a backup solution that would copy data to a corporate server over VPN. Could is absolutely out of question. It has to:

• support flaky connections and interrupted syncs gracefully
• user should be able to throttle transfer
• Ideally, it should support multiple backup partnerships - some directories get backed up to server A, and some to server B.

I don't really need any sync, just a way not to lose data. Something simple and robust is preferred to very complex and enterprisy - I can achieve versioning with server snapshots.

I don't mind paying as long as it isn't a lot (ZManda's $150/y per client is a lot)

Sometimes (e.g. when inspecting malware infested machines) it is very useful to be able to log in as a domain user without knowing the user's password with the computer off-line. How to do it? In every case, a local computer administrator account is available.

One option I am aware of involves dumping the cached domain credentials and then cracking them, but that means that password is no longer secret and sometimes is simply not practicable. In linux/unix, I would just do sudo -u 'johndoe' and be done. What's the equivalent in Windows XP/Vista/7?

Edit: just to provide context. This is for inspecting malware infected machines. Some malware will only start if you log on as the originally infected user. I can't put it back on the network to reset the password as it would be too risky. So, the box is off-line and I have a local admin account which is created at install time for troubleshooting.

OSX box has remote management enabled (AppleVNCServer) and port 5900 open. Using tightvnc/ultravnc/realvnc can't connect because of "security protocol mismatch" (don't have the exact phrase). Googling yields only to posts that say "use OSXVnc" or other remote desktop solutions.

How do I connect to apple's default remote management using Linux / Windows?

I want to enable file sharing between servers and clients, both linux. I don't want to rely on machine trust like in NFSv4 because client users will have root privileges. What are my options besides SMB (SAMBA)? Does OpenAFS support user level authentication & access? Using mounted WebDAV/ftp/sshfs seems silly for LAN.

I need to set up a linux network: central authentication server and laptops (maybe desktops). Laptops must cache credentials. What is the current best way to do that? Can kerberos be coerced into doing that? Should I install Samba WAD equivalent and use likewise?

As it happens, windows workstations get slow over time. Notably, users complain about slow start-up times. What is the scientific approach to identifying what impact what service/operation on start-up has on boot time or resource usage?

An Ubuntu LTS server runs xen with dom0 and one virtual machine. The server is freezing permanently on a number of seemingly unrelated operations, such as:

• Creation of a new file system with mkfs.ext3 on a LVM device. (this is consistent).
• Restart of xend via /etc/init.d/xend restart
• apt-get dist-upgrade on configuration phase of some fairly innocent stuff.

Also, yesterday I noticed that virtualized imagine had lost time synch and complained about backwards clock in dmesg.

Unfortunately, I don't have the screen shots on what happens actually on the console of the server (it is co-located).

I want to blame ram, but do You have other suggestions?

UPDATE: After further investigation, it appears that all those actions only kill network. When I visited the server in data center and logged onto console, I wasn't able to reach my router/gateway. How bizare.