I have read Why use a print server? and it does not indicate the location of print job data.
When I restarted the local printer service today to fix a problem with a stuck job, all jobs disappeared (not only the stuck job). I assume that documents are stored in a local file and wait there for processing. Is this correct?
We have a public web server which needs to receive HTTPS requests from a customer system over HTTPS:
Our system <--- HTTPS Reverse Proxy <-- Customer system
Unfortunately the Customer requires specific firewall setting which our reverse proxy can only provide with considerable effort and costs.
Question: could we use a second HTTPS Reverye Proxy as an "adapter"
Our system <--- HTTPS Reverse Proxy <--- "compatible" HTTPS Reverse Proxy <-- Customer system
or is this definitely impossible for HTTPS connections?
Our company network uses a Sophos firewall with an Apache reverse-proxy, which is configured to allow HTTPS connections.
After we realized that some of our clients can not connect over HTTPS, our internal network department told us that the OpenSSL settings of the Apache reverse proxy may be adjusted to our specific needs, but the settings might get overwritten with every Sophos firewall update.
Is there a way to protect the OpenSSL configuration so that Sophos updates will not be able to change it?
'Bonus' questions: is it a common feature of commercial firewall products to override customer configuration? ;)
Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH parameters > 1024 bits".
ssltest reports with 'A' rating for other sites (e.g. https://bsi.de) prove that there are ways to configure a HTTPS firewall so that Java 6 clients are able to connect.
We contacted Sophos support. Their answer was that we should not lower our security settings. Instead, our client should consider a Java upgrade.
Both answers certainly sound reasonable. However we have no influence on the IT configuration of our client.
Question: is it possible to configure a Apache reverse proxy so that incoming Java 6 HTTPS connections are possible, without lowering security?
If I compare our server cipher suites with a server who supports Java 6 HTTPS connections, I can see that we have more ciphers enabled, so I guess that the reason for Java 6 connectivity problems is one of the extra ciphers. However I guess that removing some of DH ciphers could introduce connectivity problems with other clients.
Our client asked us to remove all DHE ciphers. These are:
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
We have several TLS_ECDHE_ ciphers installed.
A related article at https://security.stackexchange.com/questions/97750/usage-of-ephemeral-diffie-hellman-ciphers-in-2015-and-beyond says that
TLS_DHE_xxx cipher suites are not used much in the wild - Only one site (Wikipedia.org) in the top ten sites on Alexa.com actually uses them. None of the others do, instead relying on TLS_ECDHE_xxx or TLS_RSA_xxx ciphers. From this, I can only deduce that there are not many browsers out there that are affected by not using these ciphers, otherwise these large sites would be cutting people off.
So I guess it is safe to remove these ciphers if we know that no clients are require them, and see what happens.
What could cause a Could not generate DH key pair on the destination URL error?
A EDI partner company tries to connect to our HTTPS server and encounters the above message.
Or system uses a commercial firewall and reverse proxy (Apache based) with a high security ranking ('A' at qualsys ssltest). I suspect that our security level is higher than the capabilities of our EDI partner company, however they claim to have working connections with other HTTPS partners, and they say that they support '2048 bits'.
Unfortunately we can not lower the security level in our system for test purposes. Are there standard diagnostics tools which we can recommend our EDI partner so that they can analyze the connection failure?
Update: I used the Qualsys diagnostics tool for SSL and found that for Java (Sun JRE) 6 clients no connection is possible because
Java 6u45 - Client does not support DH parameters > 1024 bits.
For other A-rated servers however, Java 6 clients can connect, and it seems that they just do not use DH:
Java 6u45 - TLS 1.0 - TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)
So if I put these pieces together, I assume that our server insists on DH key exchange (which is not supported for Java 6 clients), while other servers are able to negotiate a different cipher so that Java 6 clients can connect. However I am not an expert in this area, so please let me know if I am chasing a red herring :)
I have installed (and registered) a DCOM application on a W2K8R2 machine, and its GUID can be found in the DCOM list shown by dcomcnfg.
I can also use Powershell to find a Win32_DCOMApplication or Win32_DCOMApplicationSetting object for its GUID:
PS C:\Windows\system32> Get-WMIObject Win32_DCOMApplicationSetting -Filter "AppID='{1CECFD4D-2CFB-4626-95C7-0266C26960FA
}'"
__GENUS : 2
__CLASS : Win32_DCOMApplicationSetting
__SUPERCLASS : Win32_COMSetting
__DYNASTY : CIM_Setting
__RELPATH : Win32_DCOMApplicationSetting.AppID="{1CECFD4D-2CFB-4626-95C7-0266C26960FA}"
__PROPERTY_COUNT : 12
__DERIVATION : {Win32_COMSetting, CIM_Setting}
__SERVER : MYSRV
__NAMESPACE : root\cimv2
__PATH : \\MYSRV\root\cimv2:Win32_DCOMApplicationSetting.AppID="{1CECFD4D-2CFB-4626-95C7-0266C269
60FA}"
AppID : {1CECFD4D-2CFB-4626-95C7-0266C26960FA}
AuthenticationLevel :
Caption :
CustomSurrogate :
Description :
EnableAtStorageActivation : False
LocalService :
RemoteServerName :
RunAsUser :
ServiceParameters :
SettingID :
UseSurrogate : False
The output shows that there is a DCOM application entry for my GUID. However it does not show the path to the executable. Is there a way to retrieve the application executable's full path with WMI?
we use InterBase on a Windows 2003 server, and in random intervals the client connection to the server takes 180 seconds (three minute) longer than usual. The application does not "hang" with the normal Windows warning in the title bar and continues happily after the delay.
Now the rate seems to have increased since some Windows 2008 servers have been added to the network.
As other applications in the network do not have similar "hangs" I suspect the (virtual) machine or the server process itself. We use the same InterBase database client and server software version in a different network without problems, so my first area of interest is the network (TCP/IP) of the machine. For the same reason I do not think it is a DNS problem, or is this a another candidate?
Are there possible technical explanations for such a delay, for example as a consequence of a full network buffer queue, for such a delay?
netstat -s shows unusccessful connection attempts, zero dropped datagrams received.
IPv4-Statistik
Empfangene Pakete = 1267651308
Empfangene Vorspannfehler = 0
Empfangene Adressfehler = 44827
Weitergeleitete Datagramme = 0
Empfangene unbekannte Protokolle = 0
Empfangene verworfene Pakete = 0
Empfangene übermittelte Pakete = 1267651006
Ausgabeanforderungen = 1097296840
Verworfene Routingpakete = 0
Verworfene Ausgabepakete = 0
Ausgabepakete ohne Routing = 0
Reassemblierung erforderlich = 14
Reassemblierung erfolgreich = 7
Reassemblierung erfolglos = 0
Erfolgreiche Datagrammfragmentierung = 7
Erfolglose Datagrammfragmentierung = 0
Erzeugte Fragmente = 14
ICMPv4-Statistik
Empfangen Gesendet
Meldungen 26579 26678
Fehler 0 0
Ziel nicht erreichbar 0 95
Zeitüberschreitung 0 0
Parameterprobleme 0 0
Quelldrosselung 0 0
Umleitungen 0 0
Echos 60 26523
Echoantworten 26519 60
Zeiteinträge 0 0
Zeiteintragantworten 0 0
Adressmasken 0 0
Adressmaskenantworten 0 0
TCP-Statistik für IPv4
Aktiv geöffnet = 69080
Passiv geöffnet = 16751143
Erfolglose Verbindungsversuche = 363
Zurückgesetzte Verbindungen = 633
Aktuelle Verbindungen = 11
Empfangene Segmente = 1265427823
Gesendete Segmente = 1096717835
Erneut übertragene Segmente = 570293
UDP-Statistik für IPv4
Empfangene Datagramme = 2136945
Keine Anschlüsse = 98648
Empfangsfehler = 2680
Gesendete Datagramme = 50088
We have a network with Windows 2008 R2 Terminal Servers and a print server, and experience printing problems every morning which disappear after a while. The IT department seems to have no idea what the reason could be.
The users connect using RDP and configure their printers using \\domain\printerId.
Is it recommended to use the FQDN instead? (\\my.domain.local\printerId)?
Is there a way to dump the DCOM settings for a given DCOM object on the command line, if the GUID is known? (Maybe using PowerShell)
Is there a simple way to filter out only errors and warnings in a Windows event log, and apply aggregate functions like 'count and group by error type', 'message' or 'code'?
Consider this basic network setup:
Client -> Router -> "Internet" -> Router -> Server
Problem: the client can open a connection to the server and send data ("request"), but the server data packets ("response") can not be sent to the client.
It looks like a firewall problem. I assume that a packet filter could be the reason, filtering out only the response packets. Is there a technical term for this filter type?
Possible Duplicate:
Can you help me with my software licensing question?
For web applications I would like to run a JBoss AS on a 64 Bit Windows Server 2008 R2 Standard system. Does the Microsoft server license allow external users to connect to this server without a CAL?
From http://www.microsoft.com/windowsserver2008/en/us/licensing-r2.aspx
"A Windows Server 2008 Client Access License (CAL) must be purchased for every user or device that accesses or uses the Windows Server 2008 or Windows Server 2008 R2 server software, except under the following circumstances:
So this sounds like anonymous browsing on a web page served by JBoss is an exception, but if users access web pages which requires some kind of log in / password, a CAL is required.
On a VMware virtual machine which has severe performance problems I can see a constant average of 20+ percent CPU load for the TASKMGR.EXE (task manager) process. The apps running on this server have lower load, around 4 to 10 percent average. The VM is running Windows 2003 Server Standard with 3.75 GB assigned RAM. I suspect that the task manager CPU load has something to do with other VM instances on the VMWare server but could not see a similar value on internal ESXi systems (the problematic VM runs in the customers IT).
I am analyzing software performance problems on a VMWare virtual machine running Windows 2003 Server Standard Edition.
I can see that the assigned memory is 3.75 GB in the computer properties dialog. Is it possible that the VM RAM configuration causes performance problems? )The installed applications would normally run fine with much less, 2 GB or so, as I can see that average memory usage is quite low).
Update: the entire server is performing badly - task manager shows quite low average CPU load for a running database server and some background apps and a virus scanner, but opening Explorer Windows, starting applications ans switching between windows takes a very long time, often more than 20 seconds.
The Server OS is a 32 Bit System. The VM runs in the remote customers IT environment, we are connected over RDP and Internet VPN client. (Performance is bad regardless of connection through external RDP or Intranet VM Console)
It is a VMWare ESX(i) 3.5 installation and the VM was not created by conversion from a physical system.
One strange performance value is the CPU load of the taskmgr.exe application - if it runs, it has a constant CPU load of around 20-25%. The Windows Performance Monitor diagram shows the same value, if I close the task manager, the Performance Monitor also drops to almost zero percent.
I have a problem with a scheduled task which uses a mapped network drive. On some days the task does not get executed without any traces in the event log. The task launches an application on a mapped network drive. Most of the time a remote desktop session is active on the computer.
Could it be that when no user is logged in the drive mapping is not available so that the task simply does not find the executable?
We are in a migration process of a group of related computers (Intranet servers, SQL, application servers of one application) to a new domain. In the past we used one domain user account for every computer (web1, web2, appserver1, appserver2, sql1, sqlbackup ...) to access central Windows resources like network shares. Every computer also has a local user account with the same name.
I am not sure if this is necessary, or if it would be easier to configure and maintain to use one domain user account.
Are there key advantages / disadvantages of having one single user account vs. dedicated accounts per computer for this group of background servers? If I am not wrong, one advantage besides easier administration of the user account could be that moving installed applications and services around between the computers does not require a check of the access rights anymore. (Except where IP addresses or ports are used)
We have some servers which will move to a new Windows 2008 domain, and some Windows 2000 servers which I would prefer to keep in their current domain for a while (until we have the resources to test and reinstall them as Windows 2008 systems in the new domain too).
Can UNC still be used to connect to file server resources on the new system from the old servers? Or is UNC limited to work only within one domain? I'll do tests on Monday but every feedback would be very welcome.
For Linux, this command should return the DNS record for the LDAP server
host -t srv _ldap._tcp.DOMAINNAME
(found at Authenticating from Java (Linux) to Active Directory using LDAP WITHOUT servername)
How could I get the same on the Windows command line using nslookup?
I tried
nslookup -type srv _ldap._tcp.DOMAINNAME
(following http://support.microsoft.com/kb/200525), would this be correct?
For Linux, sed and find are an easy option to search and replace in many files including subdirectories. Is there a way to do the same in Windows (with or without PowerShell)?
For EDI files which need to be archived, I would like to use a compression utility (like 7Zip) which collects and compresses files based on their file date. For example, a weekly archive (incoming-2009-01.7z for week 1) needs to be updated with all incoming files whose file date is in this week.
Is there a command line utility which can be used to invoke a compression tool with the necessary arguments, or an other easy way to implement such an archive strategy?