LeRouteur's questions

I'm currently setting up a VPN for our enterprise users using SonicWall SSL VPN and the NetExtender client on Windows 10 (no mobiles devices).

The firewall is querying the Active Directory database for users in a specific group, which are authorized to use the VPN. When those users connect to the VPN using NetExtender, the domain used is "xxx.local" and It works fine.

But when a local user (created on the firewall itself) wants to login, using the "xxx.local" domain fails with bad credentials, which makes sense.

Therefore, what is the domain to be used for local users when connecting to the VPN using NetExtender? Is there a way to use both of those account types?

EDIT: here are the settings we have currently set up for the SSL VPN

I just ran against a strange problem a few weeks ago, and I'm still scraching my head about it.

We have an auth server (WServ 2016) running ADDS/ADFS/DNS/DHCP, having 172.17.0.5/24 as static IP and GW set to 172.17.0.1. The 172.17.0.5/24 subnet is dedicated to common services used by each subnet.

There are other subnets, such as 172.17.1.0/24 (managed services), 172.17.127.0/24 (storage ressources) and 172.17.128.0/20 (hosting ressources).

A pfSense router/FW makes the job for inter-subnet communication and Internet access (there are virtual IPs on the LAN NIC).

I had to reboot the auth server a few hours ago, and it won't go back online. I cannot ping the GW using the 172.17.0.5/24 IP, or using any IP in the 172.17.0.0/24 subnet. But if I set the static IP to 172.17.1.19/24 i.e., I can ping everything and access the Internet.

There is no FW rule blocking the communication between subnets, since this a pre-prod network.

I suspected an equipment already using the 172.17.0.5 IP, but since the whole subnet appears to be blocked, I don't know what to check.

Any idea about this?

I ran into a strange issue last week.

I have a bunch of Hyper-V 2016 Servers joined to a freshly created Active Directory domain (no GPO is currently configured).

There is one server who's rebooting at random moments, making the VMs running on it unavailable. It's not a critical server, so there's no cluster to back up.

I was wondering why, in the sconfig.cmd tool, the "Windows Update Settings" is set to "Personalised", and why I cannot change it to manual or "Download Only"?

Is there any way to change this? It's annoying to see this server rebooting during production hours and not be able to change the setting.

I'm using a domain laptop to remotely manage a bunch of Hyper-V Server 2016, also joined to this domain. But since a recent domain change, I came across an issue with one server.

I can open Hyper-V manager, add the faulty server and get the list of VMs. Even the preview of the VM screen is showing when it's running.

But whenever I try connecting to a VM, I get the error with CredSSP stating (approximative translation from French, see exact error message here):

"An authentication error occured, requested function cannot be provided" blablabla.

I already tried to add the registry key on the Hyper-V Server:

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /f /v AllowEncryptionOracle /t REG_DWORD /d 2

But it's still not working.

Since I'm in a domain, I looked at the GPO, but the "Encryption Oracle Remediation" does not show in the GPO manager.

Strange thing, I can connect and manage VMs without any problem on another server also running Hyper-V Server 2016 (those 2 servers are in a different subnet).

The VMs are running Ubuntu Server 20.04 if it matters.

Any idea on how to fix this please?

EDIT: both servers are up to date.

I'm subnetting the small network of our business for management and security reasons. Prior to this I had:

• 172.16.1.0/24

And now I want this:

• 172.16.1.0/24 -> corporate LAN
• 172.17.0.0/24 -> management of servers
• 172.17.1.0/24 -> hosting - managed services
• 172.17.2.0/24 -> game servers hosting
• 172.17.127.0/24 -> storage resources
• 172.17.128.0/20 -> hosting - servers (VPS, apps, etc)

I have a pfSense router between those subnets. All of the subnets have access to the Internet.

What I want to know is if there is a possibility to have one Active Directory, DNS and DHCP service running on a single server in the managed services subnet (172.17.1.0/24), and make it reachable by the subnets.

I already looked at DHCP relay, I guess I'll have to use it, but what about DNS and Active Directory? Anything to do on the router?

I'm wanting to start my own VPS providing service. I noticed that the big companies of the domain are using public IPs for the client's VPS (the client directly accesses the VPS using a public IP that is assigned to this VPS).

Is this mandatory? Because IPv4 is expensive, even a /29. Or else, is there any way to provide the simplest access to the VPS for the client (like Bastion for SSH gateway, or something like that)?

I'm starting to host a few websites, and someone told me to buy a public IP range.

Is there any good reason to do this? I'm actually havinf 10 websites running behind my public IP with a reverse proxy, and it's working fine.

I'm also questioning myself about the "how does it works"? How can a few IP be binded to my router MAC address?

(maybe this question is suited for SO, but I don't think it's linked to my code).

I'm using SQLite3 as a database engine for my Web app.

I freshly deployed it on the production server, and it's not working as expected.

I'm using PDO (a PHP DB interface) to access this DB, but whenever I try to write something in it, I get the error:

SQLSTATE[HY000]: General error: 8 attempt to write a readonly database

The production server is a Centos 8 running Httpd (so Apache). I've set the rights to 777 for the whole folder (this is just a test, don't blame me), but still getting the error.

I've read many things about this error, but none of them worked for me.

Funny thing, when running:

php -r 'var_dump(
  $db=new PDO("sqlite:/var/www/myProjetFolder/db/myProjetDb.sqlite"),
  $q=$db->query("SELECT * FROM sqlite_master"),
  $q->fetchAll()); '

At the root of the Web server, I get the content of my database, so I guess the rights are good.

As a precision, my project is stored in /var/www/myProjectFolder/.

I did not create any vHost for the moment, I simply edited httpd.conf and changed the DocumentRoot.

Why is this happening?

I know there are a plenty of subjects like this, but I didn't found what I wanted, maybe I was looking at the wrong place.

I have an AD running a few GPO, and one is concerning a wallpaper that is being pushed to the client. Some users sometimes go off the site, and since the VPN connection isn't always loading, the wallpaper goes to a black screen.

What I want to achieve is to copy the file on the client, and then use a GPO to apply it. By copying the file, the users won't have the problem of the black screen (at least I hope).

I found out I can copy a file using the GPO editor, but if the user isn't connected to my network (in local or with VPN), would the GPO still applied and the wallpaper displayed? And what if the user computer reboots without access to the DC?