JustAGuy's questions

Let's say I have 2 DCs and one of them which happens to hold all FSMO Roles goes down.

Please correct me if I'm wrong but from what I understand:

No Schema Master = no updating user details, no creating new users\computers\groups\group policies.
No RIF Master = no applying altering or adding new permissions to files\users\groups.
No Domain Naming Master = no adding new domains to the forest.
No PDC Emulator = no time synchronization, no password change or reset, no account lockout.
No Infrastructure Master = no cross-referencing objects between domains but only where you have a non-global catalog DC. Also no deletion of objects takes place.

Also, let's assume that the DC that contained all FSMO roles went dark for 1 hour and came back online. I suppose that the changes that were performed during that time will be will be overwritten?

I need to add the following Ciphers to my server:

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

I found the following article: https://docs.microsoft.com/en-us/windows-server/security/tls/manage-tls

However, it's not too clear to me. The list I get from the "SSL Cipher Suites" field contains 39+ Ciphers and is A LOT longer than the allowed 1023 characters. While in actuality when I test my explorer11 browser against ssllabs I get only 16.

lets say i have the following url:

www.domain.com:4567/blabla/index.html

I'm trying to get its' ssl expiration date.

There's this:

nmap --script=ssl-cert.nse -p 9194 www.domain.com

but it doesnt quite work. I'm unable to find the right argument in nmap.

Edit: I could go for Openssl but I need a Windows based solution.

I have created a local user using the SHELL, gave it a password and then added it to the Read Only admin group using the UI. I'm a bit clueless as to why the permissions are not being applied though as I cant login using that user.

I have the following Event Log:

This Event Log only appears inside Custom Views -> Server Roles -> Remote Desktop Services. What I'd like to do is add it to Windows Logs -> Security as I already have an agent that's crawling this folder. Is that even possible?

I have a large number of 2k12 r2 servers and I'd like to keep archives of their Eventlogs every 30 days. I was looking for a centralized solution, possibly a GPO. But from what I saw it's only possible to use Group Policy in order to either archive the logs by filesize or retain them for a certain amount of time. Is there a way to combine between the two to get what I want or am I best to simply script it using wevtutil?

I am trying to create an Archive for Eventlog but it does not seem to work.

Server 2k12 R2 Environment.

Following is the GPO I have enabled:

I have rebooted the server and made sure it is being applied using "gpresult /r /scope computer". I also checked locally using gpedit.msc and the same settings got propogated successfully. Unfortunately, besides an "Auditing Log is Full" popup the logs keep getting overridden.

I might as well mention that all logs are currently 100MB in size.

Edit: I fired up Process Monitor and found this:

It just looks too weird to me. How come it can write to Security.evtx but cant create a new file? What might be missing if System has FULL Control over that directory?

Is there a way I can grant a user the ability to use Invoke-Command in PowerShell remotely without giving them RDP Access to the server?

I am trying to configure Postfix to NOT accept outbound messages with FROM addresses other than my own domains.

The following regex successfully rejects only 3 domains:

/etc/postfix/header_checks:
/(^From:.*domain\.com|^From:.*domain\.net|^From:.*domain\.co\.il)/ REJECT SEND FROM THE RIGHT DOMAINS FFS!

I'd like to basically reverse it and block EVERYTHING BUT those 3.

So according to the manual:

!/pattern/flags result When pattern does not match the input string, use the corre- sponding result value.

However, this just blocks everything:

/etc/postfix/header_checks:
!/(^From:.*domain\.com|^From:.*domain\.net|^From:.*domain\.co\.il)/ REJECT SEND FROM THE RIGHT DOMAINS FFS!

Windows Server 2012 in a domain environment.

I cant seem to be able to do anything in Task Scheduler anymore. I might as well mention that my user is a domain admin.

When attempting to disable a present task I get:

"The user account you are operating under does not have permission to disable this task".

When attempting to create a new task with just about any user including the SYSTEM account which I had used numerous times before I get:

"The user account you are operating under does not have permission to disable this task"

The funny part is that deleting a task does work. What could have possible went wrong here?

Update:

I discovered I'm having issues accessing c:\windows\system32\tasks\Microsoft\Windows. It always gives me "Access Denied" even though I've taken ownership over the folder for some reason.

Source: Server 2012 R2 Destination: Server 2012

This is the command I use to export:

C:\Program Files\IIS\Microsoft Web Deploy V3>msdeploy -verb:sync  -source:apphos
tconfig="mywebsite" -dest:package=c:\test.zip,encryptPassword=password -skip:Directory= -skip:File=

The following is the error I get in IIS when attempting an import:

Microsoft.Web.Deployment.DeploymentException: Child object 'customFields' cannot be added to object 'logFile'. The 'logFile' provider may not support this deployment. at Microsoft.Web.Deployment.DeploymentObject.AddChild(DeploymentObject source, Int32 position, DeploymentSyncContext syncContext) at Microsoft.Web.Deployment.DeploymentSyncContext.HandleAddChild(DeploymentObject destParent, DeploymentObject sourceObject, Int32 position) at Microsoft.Web.Deployment.DeploymentSyncContext.SyncChildrenOrder(DeploymentObject dest, DeploymentObject source) at Microsoft.Web.Deployment.DeploymentSyncContext.SyncChildrenOrder(DeploymentObject dest, DeploymentObject source) at Microsoft.Web.Deployment.DeploymentSyncContext.SyncChildrenNoOrder(DeploymentObject dest, DeploymentObject source) at Microsoft.Web.Deployment.DeploymentSyncContext.SyncChildrenOrder(DeploymentObject dest, DeploymentObject source) at Microsoft.Web.Deployment.DeploymentSyncContext.ProcessSync(DeploymentObject destinationObject, DeploymentObject sourceObject) at Microsoft.Web.Deployment.DeploymentObject.SyncToInternal(DeploymentObject destObject, DeploymentSyncOptions syncOptions, PayloadTable payloadTable, ContentRootTable contentRootTable, Nullable`1 syncPassId, String syncSessionId) at Microsoft.Web.Deployment.DeploymentObject.SyncTo(DeploymentProviderOptions providerOptions, DeploymentBaseOptions baseOptions, DeploymentSyncOptions syncOptions) at Microsoft.Web.Deployment.UI.InstallProgressWizardPage.OnWorkerDoWork(Object sender, DoWorkEventArgs e) at System.ComponentModel.BackgroundWorker.WorkerThreadStart(Object argument)

I have a rather large XML file that I need to replace some connection strings within.

I use the following code to replace the strings:

$temp = Get-Content .\bigxmlfile.xml
$temp.replace("STRING1","STRING2") | out-file .\bigxmlfile.xml -force

This changes the strings just fine but for some reason ALWAYS ends up breaking the XML. I'm having trouble figuring out why.

dir iis:\apppools

Gives 3 properties: Name, State and Applications.

I'd like to isolate "Applications" but for some reason it's nowhere to be found on the Get-Member list.

   TypeName: Microsoft.IIs.PowerShell.Framework.ConfigurationElement#system.applicationHost/applicationPools#add

Name                        MemberType            Definition                                                           
----                        ----------            ----------                                                           
Recycle                     CodeMethod            void Recycle()                                                       
Start                       CodeMethod            void Start()                                                         
Stop                        CodeMethod            void Stop()                                                          
applicationPoolSid          CodeProperty          Microsoft.IIs.PowerShell.Framework.CodeProperty                      
state                       CodeProperty          Microsoft.IIs.PowerShell.Framework.CodeProperty                      
ClearLocalData              Method                void ClearLocalData()                                                
Copy                        Method                void Copy(Microsoft.IIs.PowerShell.Framework.ConfigurationElement ...
Delete                      Method                void Delete()                                                        
Equals                      Method                bool Equals(System.Object obj), bool IEquatable[ConfigurationEleme...
GetAttribute                Method                Microsoft.IIs.PowerShell.Framework.ConfigurationAttribute GetAttri...
GetAttributeValue           Method                System.Object GetAttributeValue(string attributeName)                
GetChildElement             Method                Microsoft.IIs.PowerShell.Framework.ConfigurationElement GetChildEl...
GetCollection               Method                Microsoft.IIs.PowerShell.Framework.ConfigurationElementCollection ...
GetHashCode                 Method                int GetHashCode()                                                    
GetMetadata                 Method                System.Object GetMetadata(string metadataType)                       
GetParentElement            Method                Microsoft.IIs.PowerShell.Framework.ConfigurationElement GetParentE...
GetType                     Method                type GetType()                                                       
LoadProperties              Method                void LoadProperties(System.Collections.Generic.Dictionary[string,S...
SetAttributeValue           Method                void SetAttributeValue(string attributeName, System.Object value)    
SetMetadata                 Method                void SetMetadata(string metadataType, System.Object value)           
ToPSObject                  Method                psobject ToPSObject(Microsoft.IIs.PowerShell.Framework.Configurati...
ToString                    Method                string ToString()                                                    
Update                      Method                void Update(Microsoft.IIs.PowerShell.Framework.ConfigurationElemen...
UpdateCollection            Method                bool UpdateCollection(psobject[] arr)                                
autoStart                   NoteProperty          System.Boolean autoStart=True                                        
CLRConfigFile               NoteProperty          System.String CLRConfigFile=                                         
cpu                         NoteProperty          Microsoft.IIs.PowerShell.Framework.ConfigurationElement#add#cpu cp...
enable32BitAppOnWin64       NoteProperty          System.Boolean enable32BitAppOnWin64=False                           
enableConfigurationOverride NoteProperty          System.Boolean enableConfigurationOverride=True                      
failure                     NoteProperty          Microsoft.IIs.PowerShell.Framework.ConfigurationElement#add#failur...
ItemXPath                   NoteProperty          System.String ItemXPath=/system.applicationHost/applicationPools/a...
managedPipelineMode         NoteProperty          System.String managedPipelineMode=Classic                            
managedRuntimeLoader        NoteProperty          System.String managedRuntimeLoader=webengine4.dll                    
managedRuntimeVersion       NoteProperty          System.String managedRuntimeVersion=v4.0                             
name                        NoteProperty          System.String name=ASP.NET v4.0                                      
passAnonymousToken          NoteProperty          System.Boolean passAnonymousToken=True                               
processModel                NoteProperty          Microsoft.IIs.PowerShell.Framework.ConfigurationElement#add#proces...
PSChildName                 NoteProperty          System.String PSChildName=ASP.NET v4.0                               
PSDrive                     NoteProperty          System.Management.Automation.PSDriveInfo PSDrive=IIS                 
PSIsContainer               NoteProperty          System.Boolean PSIsContainer=True                                    
PSParentPath                NoteProperty          System.String PSParentPath=WebAdministration::\\MED1-WEB\AppPools    
PSPath                      NoteProperty          System.String PSPath=WebAdministration::\\MED1-WEB\AppPools\ASP.NE...
PSProvider                  NoteProperty          Microsoft.IIs.PowerShell.Provider.IIsProviderInfo PSProvider=WebAd...
queueLength                 NoteProperty          System.Int64 queueLength=1000                                        
recycling                   NoteProperty          Microsoft.IIs.PowerShell.Framework.ConfigurationElement#add#recycl...
startMode                   NoteProperty          System.String startMode=OnDemand                                     
workerProcesses             NoteProperty          Microsoft.IIs.PowerShell.Framework.ConfigurationElement#add#worker...
Item                        ParameterizedProperty System.Object Item(string attributeName) {get;set;}                  
Attributes                  Property              Microsoft.IIs.PowerShell.Framework.ConfigurationAttributeCollectio...
ChildElements               Property              Microsoft.IIs.PowerShell.Framework.ConfigurationChildElementCollec...
ElementTagName              Property              string ElementTagName {get;}                                         
Methods                     Property              Microsoft.IIs.PowerShell.Framework.ConfigurationMethodCollection M...
Schema                      Property              Microsoft.IIs.PowerShell.Framework.ConfigurationElementSchema Sche...

What am I missing?

I have a website hosted on 2 servers. The website is SSL based.

I'd like to monitor (load the main page and look for a certain string) the website per server using a local Opsview. Meaning I need to go Opsview's HOSTS file and add "domain.com 10.10.10.33" and change it each time to match the right server. I obviously cant script this as the results are very likely to be skewed during the check.

Is there some sort of a crawler for Linux that's capable of taking an IP address, domain name and work them together? I tried both curl --proxy and wget --header to no avail.

Suppose I have the file temp.txt with the following content:

1
2
3
4
5
6

How would you read the file's content starting from line number 3 using BASH so that the output would be like this:

3
4
5
6

I installed Opsview using this guide. The problem is that REST API does not work.

Executing:

/usr/local/nagios/bin/opsview_rest --username=admin \
--password=password GET config/host

results in:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head>
<title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The
requested URL /rest was not found on this server.</p> <hr>
<address>Apache/2.2.15 (CentOS) Server at localhost Port 80</address>
</body></html>

Goto undefined subroutine &Carp::shortmess_real at
/usr/share/perl5/Carp.pm line 41.

I assume that the issue was caused by some Apache settings.

Hearbleed issue. Must disable SSL-VPN. I wasnt able to find it in the GUI. Might there happen to be a CLI command?

Short powershell script for testing:

$test = $args[0]
echo "this works"
echo "I transferred $test"
exit 0

nsclient.ini settings:

# If you want to fill this file with all avalible options run the following command:
#   nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
#   nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help


; Undocumented section
[/modules]

; CheckDisk - CheckDisk can check various file and disk related things. The current version has commands to check Size of hard drives and directories.
CheckDisk = 1

; Event log Checker. - Check for errors and warnings in the event log. This is only supported through NRPE so if you plan to use only NSClient this wont help you at all.
CheckEventLog = 1

; Check External Scripts - A simple wrapper to run external scripts and batch files.
CheckExternalScripts = 1

; Helper function - Various helper function to extend other checks. This is also only supported through NRPE.
CheckHelpers = 1

; Check NSCP - Checkes the state of the agent
CheckNSCP = 1

; CheckSystem - Various system related checks, such as CPU load, process state, service state memory usage and PDH counters.
CheckSystem = 1

; NRPE server - A simple server that listens for incoming NRPE connection and handles them.
NRPEServer = 1

; NSClient server - A simple server that listens for incoming NSClient (check_nt) connection and handles them. Although NRPE is the preferred method NSClient is fully supported and can be used for simplicity or for compatibility.
NSClientServer = 1


; Undocumented section
[/settings/default]

; ALLOWED HOSTS - A comaseparated list of allowed hosts. You can use netmasks (/ syntax) or * to create ranges.
allowed hosts = 10.50.11.164,10.50.11.130


; A list of aliases available. An alias is an internal command that has been "wrapped" (to add arguments). Be careful so you don't create loops (ie check_loop=check_a, check_a=check_loop)
[/settings/NRPE/server]

; COMMAND ARGUMENT PROCESSING - This option determines whether or not the we will allow clients to specify arguments to commands that are executed.
allow arguments = true

; COMMAND ALLOW NASTY META CHARS - This option determines whether or not the we will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments.
allow nasty characters = true

; PORT NUMBER - Port to use for NRPE.
port = 5666


[/settings/external scripts/alias]

; alias_cpu - Alias for alias_cpu. To configure this item add a section called: /settings/external scripts/alias/alias_cpu
alias_cpu = checkCPU warn=80 crit=90 time=5m time=1m time=30s

; alias_cpu_ex - Alias for alias_cpu_ex. To configure this item add a section called: /settings/external scripts/alias/alias_cpu_ex
alias_cpu_ex = checkCPU warn=$ARG1$ crit=$ARG2$ time=5m time=1m time=30s

; alias_disk - Alias for alias_disk. To configure this item add a section called: /settings/external scripts/alias/alias_disk
alias_disk = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED

; alias_disk_loose - Alias for alias_disk_loose. To configure this item add a section called: /settings/external scripts/alias/alias_disk_loose
alias_disk_loose = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED ignore-unreadable

; alias_event_log - Alias for alias_event_log. To configure this item add a section called: /settings/external scripts/alias/alias_event_log
alias_event_log = CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"

; alias_file_age - Alias for alias_file_age. To configure this item add a section called: /settings/external scripts/alias/alias_file_age
alias_file_age = checkFile2 filter=out "file=$ARG1$" filter-written=>1d MaxWarn=1 MaxCrit=1 "syntax=%filename% %write%"

; alias_file_size - Alias for alias_file_size. To configure this item add a section called: /settings/external scripts/alias/alias_file_size
alias_file_size = CheckFiles "filter=size > $ARG2$" "path=$ARG1$" MaxWarn=1 MaxCrit=1 "syntax=%filename% %size%" max-dir-depth=10

; alias_mem - Alias for alias_mem. To configure this item add a section called: /settings/external scripts/alias/alias_mem
alias_mem = checkMem MaxWarn=80% MaxCrit=90% ShowAll=long type=physical type=virtual type=paged type=page

; alias_process - Alias for alias_process. To configure this item add a section called: /settings/external scripts/alias/alias_process
alias_process = checkProcState "$ARG1$=started"

; alias_process_count - Alias for alias_process_count. To configure this item add a section called: /settings/external scripts/alias/alias_process_count
alias_process_count = checkProcState MaxWarnCount=$ARG2$ MaxCritCount=$ARG3$ "$ARG1$=started"

; alias_process_hung - Alias for alias_process_hung. To configure this item add a section called: /settings/external scripts/alias/alias_process_hung
alias_process_hung = checkProcState MaxWarnCount=1 MaxCritCount=1 "$ARG1$=hung"

; alias_process_stopped - Alias for alias_process_stopped. To configure this item add a section called: /settings/external scripts/alias/alias_process_stopped
alias_process_stopped = checkProcState "$ARG1$=stopped"

; alias_sched_all - Alias for alias_sched_all. To configure this item add a section called: /settings/external scripts/alias/alias_sched_all
alias_sched_all = CheckTaskSched "filter=exit_code ne 0" "syntax=%title%: %exit_code%" warn=>0

; alias_sched_long - Alias for alias_sched_long. To configure this item add a section called: /settings/external scripts/alias/alias_sched_long
alias_sched_long = CheckTaskSched "filter=status = 'running' AND most_recent_run_time < -$ARG1$" "syntax=%title% (%most_recent_run_time%)" warn=>0

; alias_sched_task - Alias for alias_sched_task. To configure this item add a section called: /settings/external scripts/alias/alias_sched_task
alias_sched_task = CheckTaskSched "filter=title eq '$ARG1$' AND exit_code ne 0" "syntax=%title% (%most_recent_run_time%)" warn=>0

; alias_service - Alias for alias_service. To configure this item add a section called: /settings/external scripts/alias/alias_service
alias_service = checkServiceState CheckAll

; alias_service_ex - Alias for alias_service_ex. To configure this item add a section called: /settings/external scripts/alias/alias_service_ex
alias_service_ex = checkServiceState CheckAll "exclude=Net Driver HPZ12" "exclude=Pml Driver HPZ12" exclude=stisvc

; alias_up - Alias for alias_up. To configure this item add a section called: /settings/external scripts/alias/alias_up
alias_up = checkUpTime MinWarn=1d MinWarn=1h

; alias_updates - Alias for alias_updates. To configure this item add a section called: /settings/external scripts/alias/alias_updates
alias_updates = check_updates -warning 0 -critical 0

; alias_volumes - Alias for alias_volumes. To configure this item add a section called: /settings/external scripts/alias/alias_volumes
alias_volumes = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED

; alias_volumes_loose - Alias for alias_volumes_loose. To configure this item add a section called: /settings/external scripts/alias/alias_volumes_loose
alias_volumes_loose = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED ignore-unreadable

; default - Alias for default. To configure this item add a section called: /settings/external scripts/alias/default
default = 


; A list of scripts available to run from the CheckExternalScripts module. Syntax is: <command>=<script> <arguments>
[/settings/external scripts/scripts]

; default - Alias for default. To configure this item add a section called: /settings/external scripts/scripts/default
default = 

; shirley - Alias for shirley. To configure this item add a section called: /settings/external scripts/scripts/shirley
shirley = scripts\check_ok.bat

; sql - Alias for sql. To configure this item add a section called: /settings/external scripts/scripts/sql
sql = scripts\check_SQL.bat

; test - Alias for sql. To configure this item add a section called: /settings/external scripts/scripts/sql
test = cmd /c echo scripts\test.ps1 "$ARG1$"; exit($lastexitcode) | powershell.exe -command


; A list of wrappped scripts (ie. using the template mechanism)
[/settings/external scripts/wrapped scripts]


; A list of templates for wrapped scripts
[/settings/external scripts/wrappings]

; BATCH FILE WRAPPING - 
bat = scripts\\%SCRIPT% %ARGS%

; POWERSHELL WRAPPING - 
;ps1 = cmd /c echo scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -

; VISUAL BASIC WRAPPING - 
vbs = cscript.exe //T:30 //NoLogo scripts\\lib\\wrapper.vbs %SCRIPT% %ARGS%


[/settings/system/windows]

; DEFAULT LENGTH - Used to define the default intervall for range buffer checks (ie. CPU).
default buffer length = 6h

And the Error message:

$ /usr/local/nagios/libexec/check_nrpe -H 10.11.11.101 -c test -a blablabla RETURN CODE: 3 (UNKNOWN) OUTPUT: Arguments not allowed

What am I missing?

I have 200B Fortigate unit with 2 internet WAN connections.

I also have a remote site which I'm connected to via IPSEC VPN through WAN1. This site has only one GW IP address. I'd also like to setup a VPN ontop of WAN2 with that specific site as it's destination. The default route for my end is WAN1.

My problem is I cant figure out how to have both tunnels up at the same time. What's the best practice for achieving this?

Thanks

I've been looking for some hours now for a plugin that will notify me if one of my server's CPU Load has been over 90% for the past 5 hours. No luck looking around the Nagios Exchange.

Can anyone help out?

Thanks!