Alex Lum's questions -server

Alex Lum

Asked: 2024-12-19 18:29:05 +0800 CST

Admin share : access and security best practices

5

I ask this question to get best practices. For example, we access software sources from a logged in pc user to an admin share with domain admin credentials to copy sources to target PC. we put creds and close window after copy but the admin cred is still "accessible", user could connect to another admin share without enter creds. My questions are :

After how many time have i to reenter credentials?
Is it possible to make a setting to be prompted every time we access admin share?
What are the best practices for admin share accesses.

Thanks. Regards.

Alex Lum

Asked: 2022-11-29 01:57:28 +0800 CST

PHP8 ldap_bind : Error -1 Can't contact LDAP server

5

I m on almalinux 8.7 with PHP8. Test ldapsearch with TLS is ok

ldapsearch -H ldap://xxxx -x -ZZ /etc/pki/tls/certs/xxxx.pem -D 'xxxxx' -w 'xxxx' -b 'cn=xxx,cn=users,dc=xxx,dc=xxxx'

But ldap_bind won't find ldap server. Error -1. Without ldap_start_tls($ldap_con);, it is ok.

- EDIT error message :

What am i missing?

if(empty(!$_POST["password"]))
        {
        // Configuration pour interface PHP de notre annuaire LDAP
        $server = "ldap://xxx:389";
        $login =  $_POST['login'];
        $password = $_POST['password'];
        $basedn = 'dc=xxx,dc=xxx';
        $group = 'xxxxx';

        // Connexion à LDAP.
        echo "Connexion...<br>";
        $ldap_con=ldap_connect($server) or die('Could not connect to LDAP server.');
        ldap_set_option(NULL, LDAP_OPT_X_TLS_CERTFILE, "/etc/pki/tls/certs/xxx.pem");
        ldap_set_option(NULL, LDAP_OPT_X_TLS_KEYFILE, "/etc/pki/tls/private/xxx.key");
        ldap_set_option($ldap_con, LDAP_OPT_PROTOCOL_VERSION, 3);
        ldap_set_option($ldap_con, LDAP_OPT_REFERRALS, 0);
        ldap_set_option($ldap_con, LDAP_OPT_NETWORK_TIMEOUT, 10);
        ldap_start_tls($ldap_con);

        if (!@ldap_bind($ldap_con, $login . "@xxxx", $password))
                {
                // Ici on peut voir quelle est la vraie nature de l'erreur (commenter la redirection)
                 echo "<p>Error:" . ldap_error($ldap_con) . "</p>";
                 echo "<p>Error number:" . ldap_errno($ldap_con) . "</p>";
                 echo "<p>Error:" . ldap_err2str(ldap_errno($ldap_con)) . "</p>";
                // Rediriger quand erreur
                // header("Location: https://xxxxx?error=1");
                }
        else
                {
                echo("Login correct <br>");

Tests with debug

> <?php
>         $server = "ldap://xxxx:389";
>         $login =  "xxxx";
>         $password = "xxxx";
>         $basedn = 'dc=xxx,dc=com';
>         $group = 'xxxx';
> 
>         // Connexion à LDAP.
>         echo "Connexion...<br>";
>         $ldap_con=ldap_connect($server) or die('Could not connect to LDAP server.');
>         ldap_set_option(NULL, LDAP_OPT_X_TLS_CERTFILE, "/etc/pki/tls/certs/xxxx.pem");
>         ldap_set_option(NULL, LDAP_OPT_X_TLS_KEYFILE, "/etc/pki/tls/private/xxxx.key");
>         ldap_set_option($ldap_con, LDAP_OPT_PROTOCOL_VERSION, 3);
>                 ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
>         ldap_set_option($ldap_con, LDAP_OPT_REFERRALS, 0);
>         ldap_set_option($ldap_con, LDAP_OPT_NETWORK_TIMEOUT, 10);
>         ldap_start_tls($ldap_con);
> 
>         ldap_bind($ldap_con, $login . "@xxxx", $password) ?>

Output

> Connexion...<br>ldap_extended_operation_s ldap_extended_operation
> ldap_send_initial_request ldap_new_connection 1 1 0
> ldap_int_open_connection ldap_connect_to_host: TCP xxx:389
> ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying
> xxxx:389 ldap_pvt_connect: fd: 4 tm: 10 async: 0 ldap_ndelay_on: 4 attempting to connect: connect errno: 115 ldap_int_poll: fd: 4 tm:
> 10 ldap_is_sock_ready: 4 ldap_ndelay_off: 4 ldap_pvt_connect: 0
> ldap_open_defconn: successful ldap_send_server_request ldap_result ld
> 0x55808231ec30 msgid 1 wait4msg ld 0x55808231ec30 msgid 1 (infinite
> timeout) wait4msg continue ld 0x55808231ec30 msgid 1 all 1
> ** ld 0x55808231ec30 Connections:
> * host: xxxx port: 389  (default)   refcnt: 2  status: Connected   last used: Mon Nov 28 11:31:12 2022
> 
> 
> ** ld 0x55808231ec30 Outstanding Requests:  * msgid 1,  origid 1, status InProgress    outstanding referrals 0, parent count 0   ld
> 0x55808231ec30 request count 1 (abandoned 0)
> ** ld 0x55808231ec30 Response Queue:    Empty   ld 0x55808231ec30 response count 0 ldap_chkResponseList ld 0x55808231ec30 msgid 1 all 1
> ldap_chkResponseList returns ld 0x55808231ec30 NULL ldap_int_select
> read1msg: ld 0x55808231ec30 msgid 1 all 1 read1msg: ld 0x55808231ec30
> msgid 1 message type extended-result read1msg: ld 0x55808231ec30 0 new
> referrals read1msg:  mark request completed, ld 0x55808231ec30 msgid 1
> request done: ld 0x55808231ec30 msgid 1 res_errno: 0, res_error: <>,
> res_matched: <> ldap_free_request (origid 1, msgid 1)
> ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace:
> SSL_connect:before SSL initialization TLS trace: SSL_connect:SSLv3/TLS
> write client hello TLS trace: SSL_connect:error in SSLv3/TLS write
> client hello ldap_int_tls_start: ldap_int_tls_connect needs read
> ldap_int_poll: fd: 4 tm: 10 ldap_is_sock_ready: 4 ldap_ndelay_off: 4
> TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace:
> SSL_connect:SSLv3/TLS read server hello TLS certificate verification:
> depth: 1, err: 0, subject: /DC=com/DC=xxx/CN=xxxx, issuer:
> /DC=com/DC=xx/CN=xx-CA TLS certificate verification: depth: 0,
> err: 0, subject: , issuer: /DC=com/DC=xxx/CN=xxxx TLS trace:
> SSL_connect:SSLv3/TLS read server certificate TLS trace:
> SSL_connect:SSLv3/TLS read server key exchange TLS trace:
> SSL_connect:SSLv3/TLS read server certificate request TLS trace:
> SSL_connect:SSLv3/TLS read server done TLS trace:
> SSL_connect:SSLv3/TLS write client certificate TLS trace:
> SSL_connect:SSLv3/TLS write client key exchange TLS trace:
> SSL_connect:SSLv3/TLS write certificate verify TLS trace:
> SSL_connect:SSLv3/TLS write change cipher spec TLS trace:
> SSL_connect:SSLv3/TLS write finished TLS trace: SSL_connect:error in
> SSLv3/TLS write finished ldap_int_tls_start: ld 0x55808231ec30 9 s
> 976966 us to go ldap_int_tls_start: ldap_int_tls_connect needs read
> ldap_int_poll: fd: 4 tm: 9 ldap_is_sock_ready: 4 ldap_ndelay_off: 4
> TLS trace: SSL_connect:SSLv3/TLS write finished TLS trace:
> SSL_connect:SSLv3/TLS read change cipher spec TLS trace:
> SSL_connect:SSLv3/TLS read finished ldap_sasl_bind_s ldap_sasl_bind
> ldap_send_initial_request ldap_send_server_request ldap_result ld
> 0x55808231ec30 msgid 2 wait4msg ld 0x55808231ec30 msgid 2 (infinite
> timeout) wait4msg continue ld 0x55808231ec30 msgid 2 all 1
> ** ld 0x55808231ec30 Connections:
> * host: xxxx port: 389  (default)   refcnt: 2  status: Connected   last used: Mon Nov 28 11:31:12 2022
> 
> 
> ** ld 0x55808231ec30 Outstanding Requests:  * msgid 2,  origid 2, status InProgress    outstanding referrals 0, parent count 0   ld
> 0x55808231ec30 request count 1 (abandoned 0)
> ** ld 0x55808231ec30 Response Queue:    Empty   ld 0x55808231ec30 response count 0 ldap_chkResponseList ld 0x55808231ec30 msgid 2 all 1
> ldap_chkResponseList returns ld 0x55808231ec30 NULL ldap_int_select
> read1msg: ld 0x55808231ec30 msgid 2 all 1 read1msg: ld 0x55808231ec30
> msgid 2 message type bind read1msg: ld 0x55808231ec30 0 new referrals
> read1msg:  mark request completed, ld 0x55808231ec30 msgid 2 request
> done: ld 0x55808231ec30 msgid 2 res_errno: 0, res_error: <>,
> res_matched: <> ldap_free_request (origid 2, msgid 2)
> ldap_parse_result ldap_msgfree ldap_free_connection 1 1
> ldap_send_unbind TLS trace: SSL3 alert write:warning:close notify
> ldap_free_connection: actually freed

EDIT

Launched a strace ps awux | grep sbin/httpd | awk '{print"-p " $2}' | xargs strace -f but nothing to note.

Strace on php-fpm strace -f $(pidof php-fpm | sed 's/$[0-9]*$/\-p \1/g')

[pid 340925] openat(AT_FDCWD, "/etc/pki/tls/private/xxx.key", O_RDONLY) = -1 EACCES (Permission non accordée)
[pid 340925] write(2, "TLS: could not use key file `/et"..., 70) = 70
[pid 340925] write(2, "TLS: error:0200100D:system libra"..., 85) = 85
[pid 340925] write(2, "TLS: error:20074002:BIO routines"..., 80) = 80
[pid 340925] write(2, "TLS: error:140B0002:SSL routines"..., 90) = 90

File /var/log/php-fpm/www-error.log

[30-Nov-2022 08:00:01 UTC] PHP Warning:  ldap_start_tls(): Unable to start TLS: Connect error in /var/www/html/SI/test2.php on line 17
[30-Nov-2022 08:00:01 UTC] PHP Warning:  ldap_bind(): Unable to bind to server: Can't contact LDAP server in /var/www/html/SI/test2.php on line 37

Thanks

Alex Lum

Asked: 2022-02-19 07:51:56 +0800 CST

WIFI : distinguishing client by OS

0

We have differents wifi clients Some of them on Android/Apple phones, others on PC Windows. Wifi is authenticated by NPS and we have a DHCP in wwindows server.

We do not trust phone. We want to put Windows PCs on a network and Phones on other network. Is it possible to distinguish each others? with NPS or with a DHCP options? Thanks.

Alex Lum

Asked: 2021-09-29 05:58:18 +0800 CST

EXCHANGE and MAPI : domain admins not allowed

0

I can't configure Outlook 2013 with Exchange 2016 as domain admin, it asks me for password, i nter it and reask as well. No problem with users, only with Administrators (Builtin, domain admins...)

Is it a normal behavior? Is it possible to bypass this issue? If yes, How? is it secure to let admins have a mailbox?

Thank you.

Alex Lum

Asked: 2019-11-26 06:34:53 +0800 CST

LINUX : mount windows fractionated volume

1

I have on Windows VM two vmdk. I created a fractionated volume to see only one HDD.

I need to mount this in Linux. I can see all sd** But i can't make a mount, Linux does not know partition type. Can you help me?

Alex Lum

Asked: 2019-03-07 07:07:06 +0800 CST

IIS 10 ARR : Client certificate not interpreted by backend server

0

I've made an IIS 10 with ARR on a DMZ windows server 2019 not domain joined to reverse proxy to OWA (exchange 2016) with client certificate authentication.

I get error 402.1. Here's some details. On ISS ARR side, In GENERAL_SET_REQUEST_HEADER, i can see the client certificate. Compared thumbprint and it's the good certificate. On ISS OWA side, i can see in GENERAL_REQUEST_HEADER my X-ARR-ClientCert with the same good certificate.

But, OWA do not seems to see it, because i'm redirected to NTLM authentication (with 402.1 error on my logs).

I've seen that SSL settings and binding to https shall be disabled on backend. but when i bind only on http, OWA does not work. i seems to work only on https.

From lan address, when ssl settings ask for certificate, it works.

What should i do to make client certificate authentication working from ARR? I can put logs if needed to help me. Thanks.

[EDIT] Followed this page : https://blogs.msdn.microsoft.com/asiatech/2014/01/27/configuring-arr-with-client-certificate/

My problem is this :

4. And the certificate can be retrieved from backend server in this way: System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding(); string cert = Request.Headers["X-ARR-ClientCert"]; X509Certificate2 x509Cert2 = new X509Certificate2(encoding.GetBytes(cert));

I don't know where to put those code lines.

Alex Lum

Asked: 2019-03-06 07:28:30 +0800 CST

CRL revocation check failed

1

Issue with crl revocation check. I can telnet target server on port 80. I can download crl with internet explorer. But when i launch certutil :

C:\Users\Administrateur\Desktop>certutil -urlfetch -verify alex.cer
Émetteur:
    CN=get-SRV-DC-CA
    DC=dom
    DC=com
  Hachage du nom (sha1) : a62888b8b494cc72d5b50a3401da695e28922316
  Hachage du nom (md5) : c8c269fb24c05cd48f07ec444fa63f93
Objet:
    [email protected]
    CN=NOM Alexandre
  Hachage du nom (sha1) : facbf33942c29a333aeea9ade9db538d3d530ff7
  Hachage du nom (md5) : 01deefd4ec4bfb2d5bc80ed8221e486a
Numéro de série du certificat : 67f0382100000000a51b

dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
ChainContext.dwRevocationFreshnessTime: 5 Days, 47 Minutes, 28 Seconds

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwRevocationFreshnessTime: 5 Days, 47 Minutes, 28 Seconds

CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=1000040
  Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
  NotBefore: 01/03/2019 15:05
  NotAfter: 29/02/2020 15:05
  Subject: [email protected], CN=NOM Alexandre
  Serial: 67f0382100000000a51b
  SubjectAltName: Autre nom :Nom [email protected]
  Template: 1.3.6.1.4.1.311.21.8.11025665.8001721.14437036.989286.1368235.196.5905011.1016426
  Cert: 9b28759fd75d66d04ad135b17ea93f541ace19f6
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
  Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
  ----------------  AIA de certificat  ----------------
  Échec "AIA" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    ldap:///CN=get-SRV-DC-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?cACertificate?base?objectClass=certificationAuthority

  Vérifié "Certificat (0)" Heure : 0 b3d1bb3362ec43aedafe4c3868805db4fcda5748
    [1.0] http://SRV-DC.domain.com/CertEnroll/SRV-DC.domain.com_get-SRV-DC-CA.crt

  ----------------  CDP de certificat  ----------------
  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint

  Vérifié "Liste de révocation des certificats de base (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    [1.0.0] ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?deltaRevocationList?base?objectClass=cRLDistributionPoint

  Ancienne liste de révocation des certificats de base "Liste de révocation des certificats delta (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0.1] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  ----------------  CDP de liste de révocation des certificats de base  ----------------
  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?deltaRevocationList?base?objectClass=cRLDistributionPoint

  OK "Liste de révocation des certificats de base (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    [1.0.0] ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?deltaRevocationList?base?objectClass=cRLDistributionPoint

  Ancienne liste de révocation des certificats de base "Liste de révocation des certificats delta (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0.1] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  ----------------  Protocole OCSP du certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  --------------------------------
    CRL 0592:
    Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
    ThisUpdate: 28/02/2019 13:55
    NextUpdate: 08/03/2019 02:15
    CRL: a467254541a842b5e0819fe02e61395baeb2b4e9
  Application[0] = 1.3.6.1.5.5.7.3.2 Authentification du client
  Application[1] = 1.3.6.1.5.5.7.3.4 Messagerie électronique sécurisée

CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
  Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
  NotBefore: 08/04/2015 13:36
  NotAfter: 08/04/2020 13:45
  Subject: CN=get-SRV-DC-CA, DC=dom, DC=com
  Serial: 40d4e5b7f3288898496b6f9bb3f1a103
  Template: CA
  Cert: b3d1bb3362ec43aedafe4c3868805db4fcda5748
  Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  AIA de certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  ----------------  CDP de certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  ----------------  Protocole OCSP du certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  --------------------------------

Exclude leaf cert:
  Chain: 52a851a29e09dc1f1aec1fd5a640854e68361f94
Full chain:
  Chain: 5046b50dfefc32be7c0c470bdb7ed2843ffc288a
  Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
  NotBefore: 01/03/2019 15:05
  NotAfter: 29/02/2020 15:05
  Subject: [email protected], CN=NOM Alexandre
  Serial: 67f0382100000000a51b
  SubjectAltName: Autre nom :Nom [email protected]
  Template: 1.3.6.1.4.1.311.21.8.11025665.8001721.14437036.989286.1368235.196.5905011.1016426
  Cert: 9b28759fd75d66d04ad135b17ea93f541ace19f6
La fonction de révocation n’a pas pu vérifier la révocation car le serveur de révocation était déconnecté. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)
------------------------------------
Vérification de révocation ignorée -- le serveur est hors connexion

ERREUR : la vérification de l’état de révocation du certificat feuille a
         renvoyé La fonction de révocation n’a pas pu vérifier la révocation car le serveur de révocation était déconnecté. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)
CertUtil: La fonction de révocation n’a pas pu vérifier la révocation car le serveur de révocation était déconnecté.

CertUtil: -verify La commande s’est terminée correctement.

Thanks for help.

Alex Lum

Asked: 2018-07-10 04:06:19 +0800 CST

Attachment size on exchange OWA with squid

0

We have a size limit of attachment on exchange 2016 for 25MB. It works with outlook client but not with owa clients. We can’t attach document larger than 100KB.

When I try to attach, I got a TCP_MISS/413.

1531128394.524     16 x.x.x.x TCP_MISS/413 299 POST https://xxxx/owa/service.svc? - FIRSTUP_PARENT/x.x.x.x -

Squid Cache: Version 3.5.20

squid.conf

    # ----- Global Settings -----

redirect_rewrites_host_header off
cache_mem 256 MB
maximum_object_size_in_memory 128 KB
#cache_log /dev/null
#cache_store_log /dev/null
#client_persistent_connections on

https_port 443 accel cert=/etc/squid/certificats/xxx.crt key=/etc/squid/certificats/xxx.key defaultsite=xxxx vhost

# ----- Exchange Server -----
#cache_peer xxxx parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER login=PASS name=exchangeServer
#cache_peer xxxx parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER login=PASS connection-auth=off name=exchangeServer
#cache_peer xxxx parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER login=PASS connection-auth=off name=autodiscoverServer
cache_peer xxxx parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER login=PASS name=exchangeServer
cache_peer xxxx parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER login=PASS name=autodiscoverServer

acl webm_url url_regex -i ^https://xxxx/.*$

acl webm_pas url_regex -i ^https://xxxx/admin.*$
acl webm_pas url_regex -i ^https://xxxx/AutoDiscover.*$
acl webm_pas url_regex -i ^https://xxxx/AutoDiscover/AutoDiscover.xml.*$
acl webm_pas url_regex -i ^https://xxxx/ecp.*$
acl webm_pas url_regex -i ^https://xxxx/ews.*$
acl webm_pas url_regex -i ^https://xxxx/Exchange.*$
acl webm_pas url_regex -i ^https://xxxx/Exchweb.*$
acl webm_pas url_regex -i ^https://xxxx/mapi.*$
acl webm_pas url_regex -i ^https://xxxx/Microsoft-Server-ActiveSync.*$
acl webm_pas url_regex -i ^https://xxxx/owa.*$
acl webm_pas url_regex -i ^https://xxxx/oab.*$
acl webm_pas url_regex -i ^https://xxxx/Public.*$
acl webm_pas url_regex -i ^https://xxxx/Rpc.*$
acl webm_pas url_regex -i ^https://xxxx/RpcWithCert.*$
acl webm_pas url_regex -i ^https://xxxx/RpcWithCert/rpcproxy.dll.*$

cache_peer_access exchangeServer allow webm_pas
cache_peer_access exchangeServer deny all

acl webm_red urlpath_regex ^/$
deny_info https://xxxx/owa/ webm_red
http_access deny webm_url webm_red

http_access allow webm_url
never_direct allow webm_url
miss_access allow webm_url

# ----- General -----

miss_access deny all
http_access deny all

# ----- Errors -----

cache_mgr xxxx
error_directory   /usr/share/squid/errors/fr
error_default_language fr
err_page_stylesheet     /etc/squid/errorpage.css
email_err_data on
httpd_suppress_version_string on
visible_hostname xxxxx

Can you help me? Thanks. Regards.

Alex Lum

Asked: 2016-05-18 07:54:08 +0800 CST

WSUS clients on remote site do not see any update

0

I've got a WSUS 3SP2 with all patchs on Windows 2008 R2. It updates all servers. all works but servers 2012R2 on a remote site.

All others Win2012R2 on other sites works.

In the site which have issue, there's only 3 2012R2 servers. There are seen by WSUS console, and they can send report. When i clic link to update from win update, it works too.

Here 's the windowsupdate.log

2016-05-13    11:46:40:192     144    1b7c    AU    Triggering AU detection through DetectNow API
2016-05-13    11:46:40:192     144    1b7c    AU    Triggering Online detection (interactive)
2016-05-13    11:46:40:192     144    1b7c    AU    Adding timer:
2016-05-13    11:46:40:192     144    1b7c    AU        Timer: 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-05-13 09:46:40, not idle-only, not network-only
2016-05-13    11:46:40:286     144    1bac    AU    #############
2016-05-13    11:46:40:286     144    1bac    AU    ## START ##  AU: Search for updates
2016-05-13    11:46:40:286     144    1bac    AU    #########
2016-05-13    11:46:40:286     144    1bac    SLS    Retrieving SLS response from server using ETAG "4V8nqvoeoxgpu+6kKNNNGpLr4BCvPTmaz82CIDm5o5g=_1440"...
2016-05-13    11:46:40:286     144    1bac    SLS    Making request with URL HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=79&L=fr-FR&P=&PT=0x7&WUA=7.9.9600.18235
2016-05-13    11:46:41:492     144    1bac    EP    Got 9482F4B4-E343-43B6-B170-9A65BC822C77 redir SecondaryServiceAuth URL: "117cab2d-82b1-4b5a-a08c-4d62dbee7782"
2016-05-13    11:46:41:492     144    1bac    SLS    FATAL: SLS:CSLSRequest::RetrieveAdditionalAttributesIfRequired: CoCreateInstance failed with 0x80040154.
2016-05-13    11:46:41:492     144    1bac    Agent    WARNING: Failed to retrieve SLS response data for service 117cab2d-82b1-4b5a-a08c-4d62dbee7782, error = 0x80040154
2016-05-13    11:46:41:492     144    1bac    Agent    FATAL: Caller Service Recovery failed to opt in to service 117cab2d-82b1-4b5a-a08c-4d62dbee7782, hr=0X80040154
2016-05-13    11:46:41:492     144    1bac    IdleTmr    WU operation (CSearchCall::Init ID 2) started; operation # 23; does use network; is not at background priority
2016-05-13    11:46:41:492     144    1bac    IdleTmr    Incremented idle timer priority operation counter to 2
2016-05-13    11:46:41:492     144    1bac    Agent    *** START ***  Queueing Finding updates [CallerId = AutomaticUpdatesWuApp  Id = 2]
2016-05-13    11:46:41:492     144    1bac    AU    <<## SUBMITTED ## AU: Search for updates  [CallId = {562A8466-865C-4ABF-8BD2-C76DB40E6F26} ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}]
2016-05-13    11:46:41:492     144    f5c    Agent    ***  END  ***  Queueing Finding updates [CallerId = AutomaticUpdatesWuApp  Id = 2]
2016-05-13    11:46:41:492     144    f5c    Agent    *************
2016-05-13    11:46:41:492     144    f5c    Agent    ** START **  Agent: Finding updates [CallerId = AutomaticUpdatesWuApp  Id = 2]
2016-05-13    11:46:41:492     144    f5c    Agent    *********
2016-05-13    11:46:41:492     144    f5c    Agent      * Online = Yes; Ignore download priority = No
2016-05-13    11:46:41:492     144    f5c    Agent      * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2016-05-13    11:46:41:492     144    f5c    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2016-05-13    11:46:41:492     144    f5c    Agent      * Search Scope = {Machine & All Users}
2016-05-13    11:46:41:492     144    f5c    Agent      * Caller SID for Applicability: S-1-5-21-4030573487-1182406749-2212445248-500
2016-05-13    11:46:41:492     144    f5c    Agent      * RegisterService is set
2016-05-13    11:46:41:492     144    f5c    EP    Got WSUS Client/Server URL: "http://xxxx:xxx/ClientWebService/client.asmx"
2016-05-13    11:46:41:492     144    f5c    Setup    Checking for agent SelfUpdate
2016-05-13    11:46:41:492     144    f5c    Setup    Client version: Core: 7.9.9600.18235  Aux: 7.9.9600.18235
2016-05-13    11:46:41:492     144    f5c    EP    Got WSUS SelfUpdate URL: "http://xxxx:xxx/selfupdate"
2016-05-13    11:46:41:570     144    f5c    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080:
2016-05-13    11:46:41:586     144    f5c    Misc     Microsoft signed: NA
2016-05-13    11:46:41:586     144    f5c    Misc     Infrastructure signed: Yes
2016-05-13    11:46:41:586     144    f5c    Misc    WARNING: Cab does not contain correct inner CAB file.
2016-05-13    11:46:41:586     144    f5c    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080:
2016-05-13    11:46:41:586     144    f5c    Misc     Microsoft signed: NA
2016-05-13    11:46:41:586     144    f5c    Misc     Infrastructure signed: Yes
2016-05-13    11:46:41:586     144    f5c    Setup    Skipping SelfUpdate check based on the /SKIP directive in wuident
2016-05-13    11:46:41:586     144    f5c    Setup    SelfUpdate check completed.  SelfUpdate is NOT required.
2016-05-13    11:46:41:789     144    f5c    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
2016-05-13    11:46:41:789     144    f5c    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://srv-secu01:8530/ClientWebService/client.asmx
2016-05-13    11:46:41:789     144    f5c    Agent    Reading cached app categories using lifetime 604800 seconds
2016-05-13    11:46:41:789     144    f5c    Agent    Read 0 cached app categories
2016-05-13    11:46:41:789     144    f5c    Agent    SyncUpdates adding 0 visited app categories
2016-05-13    11:46:43:008     144    f5c    IdleTmr    WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover) started; operation # 24; does use network; is at background priority
2016-05-13    11:46:43:289     144    f5c    IdleTmr    WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover, operation # 24) stopped; does use network; is at background priority
2016-05-13    11:46:43:289     144    f5c    Agent    Reading cached app categories using lifetime 604800 seconds
2016-05-13    11:46:43:289     144    f5c    Agent    Read 0 cached app categories
2016-05-13    11:46:43:289     144    f5c    Agent    SyncUpdates adding 0 visited app categories
2016-05-13    11:46:43:289     144    f5c    IdleTmr    WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover) started; operation # 25; does use network; is at background priority
2016-05-13    11:46:43:679     144    f5c    IdleTmr    WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover, operation # 25) stopped; does use network; is at background priority
2016-05-13    11:46:43:679     144    f5c    PT      + SyncUpdates round trips: 2
2016-05-13    11:46:44:054     144    f5c    Agent    WARNING: Failed to evaluate Installed rule, updateId = {{4DEB7F5F-D14D-43E2-93FA-F81B10846CF7}.200}, hr = 80070057
2016-05-13    11:46:44:054     144    f5c    Agent    WARNING: Failed to evaluate Installable rule, updateId = {{4DEB7F5F-D14D-43E2-93FA-F81B10846CF7}.200}, hr = 80070057
2016-05-13    11:46:44:054     144    f5c    Agent    WARNING: Failed to evaluate Installed rule, updateId = {{22FFD207-0EB5-4FCF-9F6A-67078327D7A3}.200}, hr = 80070057
2016-05-13    11:46:44:070     144    f5c    Agent    WARNING: Failed to evaluate Installed rule, updateId = {{A4ECF96E-FE76-4933-B1A9-FAA712DC2A3B}.200}, hr = 80070057
2016-05-13    11:46:44:070     144    f5c    Agent    WARNING: Failed to evaluate Installable rule, updateId = {{A4ECF96E-FE76-4933-B1A9-FAA712DC2A3B}.200}, hr = 80070057
2016-05-13    11:46:44:070     144    f5c    Agent    WARNING: Failed to evaluate Installed rule, updateId = {{9941EB5F-4953-446D-99A2-C5989C596283}.200}, hr = 80070057
2016-05-13    11:46:44:070     144    f5c    Agent    WARNING: Failed to evaluate Installable rule, updateId = {{9941EB5F-4953-446D-99A2-C5989C596283}.200}, hr = 80070057
2016-05-13    11:46:44:742     144    f5c    Agent      * Found 0 updates and 81 categories in search; evaluated appl. rules of 578 out of 1267 deployed entities
2016-05-13    11:46:44:742     144    f5c    Agent    Reporting status event with 19 installable, 86 installed,  0 installed pending, 0 failed and 0 downloaded updates
2016-05-13    11:46:44:742     144    f5c    Agent    *********
2016-05-13    11:46:44:742     144    f5c    Agent    **  END  **  Agent: Finding updates [CallerId = AutomaticUpdatesWuApp  Id = 2]
2016-05-13    11:46:44:742     144    f5c    Agent    *************
2016-05-13    11:46:44:742     144    f5c    IdleTmr    WU operation (CSearchCall::Init ID 2, operation # 23) stopped; does use network; is not at background priority
2016-05-13    11:46:44:742     144    f5c    IdleTmr    Decremented idle timer priority operation counter to 1
2016-05-13    11:46:44:742     144    1f60    AU    >>##  RESUMED  ## AU: Search for updates [CallId = {562A8466-865C-4ABF-8BD2-C76DB40E6F26} ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}]
2016-05-13    11:46:44:742     144    1f60    AU      # 0 updates detected
2016-05-13    11:46:44:742     144    1f60    AU    #########
2016-05-13    11:46:44:742     144    1f60    AU    ##  END  ##  AU: Search for updates  [CallId = {562A8466-865C-4ABF-8BD2-C76DB40E6F26} ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}]
2016-05-13    11:46:44:742     144    1f60    AU    #############
2016-05-13    11:46:44:742     144    1f60    AU    All AU searches complete.
2016-05-13    11:46:44:742     144    1f60    AU    AU setting next detection timeout to 2016-05-14 06:59:50
2016-05-13    11:46:44:742     144    1f60    AU    Adding timer:
2016-05-13    11:46:44:742     144    1f60    AU        Timer: 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-05-14 06:59:50, not idle-only, not network-only
2016-05-13    11:46:44:742     144    1f60    AU    Currently AUX is enabled - so not show any WU Upgrade notifications.
2016-05-13    11:46:44:742     144    1f60    AU    WARNING: Failed to get Network Cost info from NLM, assuming network is NOT metered, error = 0x80240037
2016-05-13    11:46:44:742     144    1f60    AU    WARNING: Failed to get Network Cost info from NLM, assuming network is NOT metered, error = 0x80240037

I've searched everywhere and tried every thing listed here : https://blogs.technet.microsoft.com/sus/2009/11/17/tips-for-troubleshooting-wsus-agents-that-are-not-reporting-to-the-wsus-server/

But still no luck, WSUS client find no updates...

Can you help me please? Thank you very much

Alex Lum

Asked: 2015-05-01 02:47:06 +0800 CST

ldap is working but not ldaps correctly

2

I'm a little lost with ldapsearch... I have to configure a cloud with AD authentication.

this is working well

 ldapsearch -h server -p 389 -x -D 'admin.test' -w 'xxx' -b 'cn=admin.test,cn=users,dc=domain,dc=com'

But i want to make some security and so i try ldaps.

This is working :

> ldapsearch -H ldaps://server -x -D 'admin.test' -w 'xxx' -b 'cn=admin.test,cn=users,dc=domain,dc=com'

And this too :

> ldapsearch -H ldaps://server:636 -x -D 'admin.test' -w 'xxx' -b 'cn=admin.test,cn=users,dc=domain,dc=com'

But this doesn't work.

ldapsearch -h server -p 636 -x -D 'admin.test' -w 'xxx' -b 'cn=admin.test,cn=users,dc=domain,dc=com' -v
ldap_initialize( ldap://srv-dc01.get.com:636 )
ldap_result: Can't contact LDAP server (-1)

I don't know what's going on. And the cloud want an URL and not an URI. Other question, is it possible to block ldap and let ldaps working?

OS : Linux CentOS 7 with selinux Enforced DC is on server 2008 R2.

Thank you very much. Regards, Alexandre

Admin share : access and security best practices

PHP8 ldap_bind : Error -1 Can't contact LDAP server

WIFI : distinguishing client by OS

EXCHANGE and MAPI : domain admins not allowed

LINUX : mount windows fractionated volume

IIS 10 ARR : Client certificate not interpreted by backend server

CRL revocation check failed

Attachment size on exchange OWA with squid

WSUS clients on remote site do not see any update

ldap is working but not ldaps correctly

Can you pass user/pass for HTTP Basic Authentication in URL parameters?

Ping a Specific Port

Check if port is open or closed on a Linux server?

How to automate SSH login with password?

How do I tell Git for Windows where to find my private RSA key?

What's the default superuser username/password for postgres after a new install?

What port does SFTP use?

Command line to list users in a Windows Active Directory group?

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

How to determine if a bash variable is empty?