Peter Mortensen's questions

I recently imaged the hard drive in my computer to a new SSD drive hoping to be able to quickly and easily swap the original drive with the new SSD drive. When I booted to Windows after installing the newly imaged drive I noticed that Windows displayed a message in the lower right hand corner of the desktop that said:

"This copy of Windows is not genuine".

Windows Explorer did not appear, and it appeared that I couldn't actually do anything with the computer.

The question is, how can you avoid this message after imaging a drive (rather than having to re-install Windows and all other applications on the new drive)?

How can access to CD-ROM and USB be disabled for normal users in Linux?

As a part of security policy we need to disable CD-ROM and USB access for normal users. Only root users should have the access. We are mainly using Ubuntu Linux.

I always hear system administrators talk about waiting for DNS records to propagate "around the Internet" or "around the world" when they talk about making DNS changes. The fact of the matter is that my DNS records don't propagate to any other DNS servers except for the name servers that host my namespace (primary, secondary, tertiary). When I change a DNS record (A, CNAME, MX, etc.) those changes are reflected immediately in my zone and they do not propagate anywhere. What people really mean when they talk about DNS record propagation is actually TTL caching. This article at Wikipedia explains it succinctly:

http://en.wikipedia.org/wiki/Domain_Name_System

Isn't the concept of DNS propagation a myth? So, why is it called "propagation"?

I use SpinRite to recover hard disks and their content, and to a lesser degree for preventive maintenance.

However, if a USB drive (USB thumb drive and/or external hard disk with a USB interface) is connected when SpinRite scans for devices, then SpinRite never finishes/hangs.

The work-around is of course to disconnect the drive, but there is value in being able to use SpinRite on USB drives. Some external drives have no screws and it is difficult to take out the hard disk without damaging the casing. And for those that have it would save the disassembling time.

Is there a way to fix this problem (e.g. BIOS changes or a modified SpinRite boot CD) without resorting to floppy disks?

Why are so many medium to large enterprises still using Internet Explorer 6? Is there some secret ultra valuable feature or cost reason that has extended its life? What are the most common excuses you have been given?

How costly (CPU or memory wise) is it to have multiple instances of SQL server 2005 instead of only one instance with prefixed databases?

A company have three application providers. They each will install one application and they each require two or three databases. Should they all use the same instance or should every provider use it's own named instance?

Is there any strong reason for one or other setup?

I am trying to get Openfire to install on an Ubuntu virtual machine, however upon completing the web based installer, I am unable to login to the admin panel.

So far I:

• downloaded Debian installer
• Installed using stock options
• Added database and built the structure using supplied SQL file
• Completed web based installer

I am now trying to login using username: admin and my password, however I constantly get a wrong username/password error. There is a record generated in the MySQL database showing the admin user with an encrypted password, and changing to an unencoded password doesn't work. What is the problem here?

Since the NetBIOS vulnerability is quite well-known a long time ago and heavily popularized, patches have been already released. So, is opening this 139 port OK now?

Using Solaris and Linux servers and OpenSSH, is it possible to prevent users from copying files using "scp" while still allowing shell access with "ssh"?

I realize that 'ssh $server "cat file" ' type file accesses are much harder to prevent, but I need to see about stopping "scp" for starters.

Failing that, is there a way to reliably log all SCP access on the server side through syslog?

How to increase MTU size on Linux 2.6?

Is such a thing possible? If yes, which files (in /etc or elsewhere) must one edit?

Our development server at work is taking a dump on us. So at this point, we're repurposing some other servers we have in our server room for this purpose.

My boss wants me to test the servers before I even try installing anything on them. How do we to about this?

Here is the situation. I have user access to a server and root access to the same server. I want to edit files for a user that I don't have password information for on the server. ssh'ing as root is disabled, so I typically ssh in as my user and then su to root. Then I cd to the user of interest's home directory and then su to the user of interest (provided the user of interest has shell access). If the user doesn't have shell access to the server I am forced to modify the files as root, which I loathe to do. So my first question is, how can I safely modify the user's files without being root if the user does not have shell access?

My second question involves transferring files to the user's account using a graphical SFTP program from my desktop. Since I don't have the user of interest's login information (and the user may not have shell access) I can't sftp directly into the user's account, nor can I sftp as root. So instead I use my graphical SFTP program to sftp into my user account's home directory on the server. Then I transfer the files via the SFTP program to my user account's home directory on the server, and then manually copy them as root from my user's home directory to the user of interest's home directory. Obviously this is inefficient and I long for a better solution. What is it?

Note: I realize that I can use the command line scp program to transfer the files directly to the user of interests home directory, but I want to use a graphical SFTP program.

I have just purchased an SSL certificate from Go Daddy. I setup the certificate to be:

www.mydomainname.com (I changed the domain as you can tell.)

I setup Apache and it is working. So when I type https://www.mydomainname.com it all works.

HOWEVER:

When I type http://www.mydomainname.com I get this error from Apache:

Bad Request

Your browser sent a request that this server could not understand.
Reason: You're speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.

I was hoping I could type

http://www.mydomainname.com for HTTP requests

and

https://www.mydomainname.com when I want secure requests.

What have I done wrong?

Here is my Apache configuration:

Under sites-enabled (I am using Ubuntu's Apache setup)

I have file called ssl

    <IfModule mod_ssl.c>;
        SSLEngine On
        SSLCertificateFile /etc/apache2/ssl/www.mydomainname.com.crt
        SSLCertificateKeyFile /etc/apache2/ssl/www.mydomainname.com.key
    </IfModule>

and another called webapp:

    <IfModule mod_proxy_ajp.c>
        ProxyRequests On
        ProxyVia On

        <Location />
            Order allow,deny
            Allow from all
            AuthType Basic
            AuthName "Restricted area"
            AuthUserFile /etc/apache2/passwd/access
            Require valid-user
            ProxyPass ajp://localhost:9999/
            ProxyPassReverse ajp://localhost:9999/
        </Location>

        <Location /uploader>
            Order allow,deny
            Satisfy Any
            Allow from all
            ProxyPass ajp://localhost:9999/uploader
            ProxyPassReverse ajp://localhost:9999/uploader
        </Location>
    </IfModule>

What is the best way to backup data on content servers? For example, I have 15 servers that just have content, no applications running on it. Each server has a 250 GB hard drive. So, it's a pretty big amount of data. All the data have external access (via HTTP). So, the question is: what methodology is best in my case?

The most useful method I know is cross-backup: when each server contains its own data and backup of one other server. But, there is significant reduction in total capacity.

RAID?

What is SMS Agent Host service (CcmExec)? I have failed to find this information (e.g. there is no Wikipedia entry) - besides for information in some error cases on how to restart this service for dependent software. (The best I could find was: "ccmexec.exe is a part of the Microsoft SMS operating system service. This service calls upon another service, the SMS Agent Host. This program is important for the stable and secure running of your computer and should not be terminated." and SMS = Systems Management Server)

What purpose does it serve and why would it hold on to directory handles? E.g. may it scan the entire disk on behalf of some other service?

Is SMS Agent Host service specific to Windows Server 2003/Windows XP x64?

I have installed a new Linux Debian lenny server that will be a LAMP and a Subversion server. Should I have to enable automatic updates?

If I enable it, I am sure that I have the latest security patches. It also should not break my system since Debian stable provides only security patches. If I install them manually, I may be on high security risk during multiple days & week.

Please keep in mind that I am not an full time system administrator, so I do not have the time to look at security bulletins.

What are you usually doing with your servers? What is your advice?

1. What is the difference between DEP always on ("/NoExecute=AlwaysOn" in boot.ini) and DEP opt-out ( "/NoExecute=OptOut" in boot.ini) with no exceptions?

   "no exceptions" = empty list of programs for which DEP does not apply. DEP = Data Execution Prevention (hardware).

   One would expect it to work the same way, but it makes a difference for some applications:

   E.g. for all versions of UltraEdit 14 (14.2). It crashes at startup for DEP always on, at least on Microsoft Windows XP Professional Edition x64 edition. (Update 2010-03-11: this problem has been fixed with UltraEdit 15.2 and later.)

   Update 2010-07-12: Mozilla Thunderbird 2.0.0.19 also crashes at startup for DEP set to the highest level (as UltraEdit used to do).

2. Is there a difference between Windows XP, Windows Vista and Windows 7?

3. Is there a difference between 32 bit and 64 bit versions of Windows?

I am trying to get a Virtual Instance of Windows 2008 R2 running from my laptop. My laptop has a 64-bit processor and is running 32-bit Windows XP. I have hardware DEP and hardware virtualization (though I don't really know what these mean).

I tried Virtual PC but it cannot run a 64-bit guest OS. I tried the free VMWare Server, but it does not work from Windows XP. (I tried several different install configurations before giving up on that one).

So I am down to Hyper V Server. Can it run on a 64-bit processor that has a host OS that is 32-bit? Is there a way to get a virtual instance of Windows 2008 R2 (on Windows XP) in a different way? (Preferably free or using Microsoft Products.)

We're installing a digital media system at the college radio station I work at. We're trying to give programmers (read; DJs, not coders) access to the music, without allowing them to copy any of it to their flash drives or transfer it across the Internet.

We're running on Windows systems (Windows XP for the client machines, and Windows Server 2008 for the media server). My idea is this.

• Create a user (ProgramUser) that has no access at all to the digital media.
• Create a user (MediaUser) that has read-only access to the digital media that programmers know nothing about and do not know the password to.
• Have users log in to Windows as ProgramUser, giving them no access at all to the media.
• Run our playback application (Traktor) as the MediaUser, allowing the programmer to play back media but not copy or modify it.

This seems like the perfect solution, but there's one gotcha. If the playback application or machine crashes, the programmer is the only person who will be able to get it running again in a reasonable amount of time (we're a 15 kW FM radio station, so downtime is a big deal). Hence my dilemma...

How can I give the programmer the ability to start our playback application as a user they do not know the password to?

What things should every SQL Server database administrator know?

Books, blogs, tools, you name it.