Dacid Salin's questions

I've seen other questions similar but not quite the same.

Have a client that is seeing a message when trying to access files in a folder on a Windows server 2012 R2. This behavior is consistent for a specific folder. No other complaints for other files and folders.

"You require permission from Domain\xyzuser to make changes to this file."

The xyzuser name might change depending who has accessed it recently.

This only happens to one user.

On the root share, I reset permissions to Domain Users (someone had given Everyone Full Permissions) and removed all specific users assignments except the defaults (administrator, domain\administrator, domain\domain admins)

I removed Full Permissions on the subfolder for Everyone (just removed Everyone). I removed all user accounts that had Full permissions to that subfolder and assigned them to a user group and applied the group with all permissions Except Full permissions. But since this user group is a subset of Domain Users, it should be the same.

I re-enabled inheritance as all Domain Users are supposed to have read/write/modify.

I verified user is member of Domain Users.

This user still gets the same message on file access. Other users are fine and can manipulate files for her.

I see under Effective Access for the user, every permission allowed except Full, Change permissions and Take ownership.

File type is .xls. There is no ~$.* temporary office file (exposed system and hidden files to confirm).

There is no message in the user's Windows event logs.

Last thing - I saw the Owner is the XYZuser from above. Change owner of folder and files to Domain Admins, the issue is unchanged. User still cannot manipulate the file.

A colleague thought it was her local Windows profile. That has been rebuilt and the issue remains.

I have a client that just handed us access to their servers after their onsite IT quit. One is QMail that has been patched. I think it's https://qmail.jms1.net/patches/validrcptto.cdb.shtml. But not really sure.

The client's notes read:

The mail server is a patched and modified version of qmail running on CentOS 7.

To access the QmailAdmin control panel visit http://redacted/cgi-bin/qmailadmin and login with the postmaster account. To access the VqAdmin control panel visit http://redacted/cgi-bin/vqadmin/vqadmin.cgi and login with the admin user. Both of these are documented in the KeePass database on the redacted server.

Changes to email accounts must be synchronized to the ValidAuth and ValidRcptto cdb files. The scripts for managing those are in the /var/qmail/bin directory of the mail server.

Adding a user was easy enough. Next I need to "Synchronize changes to ValidAuth and ValidRcptto cdb files".

Where would I start and what further information might I share? I'm not strong with Linux scripting at all, but am familiar with Linux overall.

I see a new_authcbd_instructions.txt. Contents are:

### The lines below have been scripted
# ./mkauth -m > tmp_users.txt
# cat tmp_users2.txt | cbdmake new.cbd new.tmp
# chmod 640 new.cbd
# chown root:nofiles new.cbd
# cp ../control/smtpauth.cbd //control.smtpauth.bk2 %% mv .new.cbd ../control/smtpauth.cbd
# mkvalidrcptto -c validrcptto.cbd
# mv validrcptto.cbd /var/qmail/control/

## now you can simply do:

# ./makeNewAuth
# ./makeNewVR

The tmp_users2.txt isn't touched when I use the scripts pointed out at the end (makeNewAuth or makeNewVR). mkvalidrcptto is beyond my skill set to read.

However, when I execute makeNewAuth and makeNewVR, I see that I have a new tmp_users.txt file and two new *.cbd files in the ../control folder.

Am I safe to say this worked as intended?

I'm wanting to setup secure LDAP authentication with an external service provider. The end user currently uses unsecured LDAP to the service provider. The service provider admits they way it had been originally implemented exposes credentials via packet capture.

I've reviewed: https://support.microsoft.com/en-us/help/321051/how-to-enable-ldap-over-ssl-with-a-third-party-certification-authority

Their local domain is a *.local. The product manufacturer requires an SSL certificate that is signed by a valid certificate authority. This is good. I can create an SSL cert for the domain, but it won't match that the Directory Service has.

I'm not sure exactly how the external auth is presented to the LDAP server, if it's just passing the user name with domain name appended or if it verifies the LDAP server first.

Questions - Do I need to rename the domain to match? Would adding a UPN suffix allow for a work-around?

Edit: External access through the Internet is required, thus the desire to secure LDAP.

Update text for clarity

After building the server, I connected my laptop to Ethernet port marked as 1 and attempted to ping the IP. This failed. I tried the other 3 ports, same result. Server has 4 NICS so I connected them all to a gig switch along with my laptop, but still could not access the management IP.

Big G search engine wasn't my friend this time - I didn't find anything that helped.

The server is a Lenovo ST550. There are 2 LOM ports, a management port and a dual port NIC paddle board.

I came across a customer site Windows DNS server that has it's external domain in a forward lookup zone on the AD server. There are some A and CNAME records here that we really don't want to be public. I'm wondering if we can configure DNS to point upstream to their SOA if it doesn't have an answer to a query for this domain, say searching for autodiscover.domain.com.

The upstream is a BIND DNS controlled by a web hosting company. I don't want to transfer zones and overwrite the static entries here, just reach out upstream if we don't know.

Is this possible? what's the mechanism? It's not really a split-DNS. I modified the SOA record but it doesn't do a recursive query upstream if it doesn't know.

Thanks,

I built a CLI shortcut to ssh the config over to an Ubuntu box (with an SMB share mounted to the user home directory).

cli alias name archive copy startup-config scp://[email protected]//home/sw-backup/Cisco/Switch/Nexus/NexusB vrf default

This is so I can easily push my config out to a Windows file server via the "SSH gateway" box. I tried some freebie and Trial SSH Server software on Windows and had too many reliability issues. That was resolved with the Linux box in the middle. It's been stable for quite some time.

I copy files over to this server from all of our routers, switches and Call Manager backups.

I recently updated Nexus to version 7.1(4)N1(1). Now when I attempt to copy I receive an error:

nnn-nexus-b# archive
No matching ciphers found. Client (10.130.9.35) supported ciphers :
aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,[email protected].
se .Server supported ciphers : [email protected],aes128
-ctr,aes192-ctr,aes256-ctr,[email protected],aes256-gcm@openss
h.com

lost connection

nnn-nexus-b# 

I found the following that looks promising:

http://www.cisco.com/c/en/us/support/docs/switches/nexus-9000-series-switches/200663-Unable-to-SSH-into-Nexus-9K-fatal.html

The above link references the SSH Server on the Nexus. I'm reaching out to an Ubuntu 16.04.1 LTS machine. I can't enable the bash shell feature on the 5548UP. I'm guessing I can disable the weak ciphers on Ubuntu.

Here lies the problem. Call Manager backups, IOS and IOS-XE devices are still using the weak cipher if I understand what's going on correctly. If I change the Ubuntu box, I'll break all of these.

What are some thoughts on how to work around this?

Thanks, B-Dog

I have setup WebAuth on our public Wi-Fi. We have a Cisco WLC 5508 and when using iOS, Apple, Windows devices or some Android devices, the page loads correctly, however when I am using a device with Chrome 53.0.2785.124 as the default browser on Marshmallow 6.0.1, I get an error page indicating a possible MTM attack. It reads "Your connection is not private" followed by some other text and NET::ERR_CERT_COMMON_NAME_INVALID. Here is a screenshot of the error.

From what I understand, this is due to the browser attempting to reach a URL and is expecting a specific result, however the cert on the requested google.com home page does not match the cert for the host on the returned wlc.mydomain.com SSL certificate.

One section of www.google.com/chrome/browser/privacy/whitepaper.html reads:

In the event that Chrome detects SSL connection timeouts, certificate errors, or other network issues that might be caused by a captive portal (a hotel's WiFi network, for instance), Chrome will make a cookieless request to http:// www.gstatic.com/generate_204 and check the response code. If that request is redirected, Chrome will open the redirect target in a new tab on the assumption that it's a login page. Requests to the captive portal detection page are not logged.

It's actually sending a request to http:// connectivitycheck.android.com/generate_204. The issue I see is in the response from the WLC, the status code is HTTP 1.1 200 OK. I would either expect to see an error due to the page being blocked or a 300 response to indicate a redirection. Based on the text above from Google, it sounds like the browser will enter it's Captive Portal mode (and open a new tab for authentication) WHEN it receives a redirection.

I'm thinking this may be an issue with the WLC configuration, but perhaps it's an issue with Chrome 53 on Android.

If anyone has a recommended solution, I would appreciate it.

Regards, D