David Bullock's questions

It is common to provide 'glue' records along with NS records, to spare DNS resolvers the bother of looking up the IP address of the DNS server itself.

However, it is not even desirable to provide glue in some situations (eg. example.com NS ns.example.net ... it is not appropriate for a .com nameserver to dish out information about .net domains). In that case, there is a risk that DNS resolvers, lacking the glue information, will take longer to resolve the domain.

But how much longer? Is it worth defining my own A record for ns.example.com to point to the IP address of ns.example.net (a so-called 'white label' or 'vanity' nameserver, such that I can provide glue? Or does it not matter much in practice?. Why not?

Hi have a Debian Squeeze box with eth0 and eth1.

In /etc/network/interfaces is:

auto eth1
iface eth1 inet static
 address 10.1.2.208
 netmask 255.255.255.0
 gateway 10.1.2.1

But every 24 hours, eth1 loses its statically-assigned IP address, and fetches one from DHCP instead! Manually doing:

# ifup eth1 && ifdown eth1

puts it back to how it should be.

But why does it spontaneously break in the first place?!

I have a catch 22 trying to:

   # apt-get update
   [... good lines omitted]
   W: GPG error: http://backports.debian.org lenny-backports Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AED4B06F473041FA
   W: GPG error: http://http.us.debian.org stable Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AED4B06F473041FA
   W: GPG error: http://ftp.us.debian.org lenny Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AED4B06F473041FA

At http://wiki.debian.org/SecureApt#Other_problems it notes the NO_PUBKEY issue "means the archive has begun to be signed by a new key, which your system does not know about ... and once the system is fed the new key (by upgrading the debian-archive-keyring package), the warning will go away"

OK, but perversely:

   apt-get install debian-archive-keyring 

gives me:

   WARNING: The following packages cannot be authenticated!
       debian-archive-keyring

and the solution for that is to do an apt-get update

Can anyone break the cycle for me?

--

Note: my /etc/apt/sources.list is:

    deb http://ftp.us.debian.org/debian/ lenny main contrib non-free
    deb http://http.us.debian.org/debian stable main contrib non-free
    deb http://security.debian.org lenny/updates main contrib non-free
    deb http://backports.debian.org/debian-backports lenny-backports main contrib non-free

I've used both WebEx and GoToAssist, but neither of them have a story to tell for 'unattended' access of a user's desktop unless the user is using the machine's primary console. Unattended in the sense that they phone me and I then appear in their session, rather than they visit a website and enter their details and wait for me.

This is a common use-case, since the users' machine is a virtual desktop, and the session broker is connecting the user via RDP. They never have a session with their desktop unless it's a remote desktop session.

At the moment, if I use either of the said products to get an unattended support session going, all I can see is the login screen of the physical console, telling me that a remote session is in progress.

Are there alternative tools which will make me happy?

UPDATE: People are asking what I am doing, so here is the basic overview:

• A user's desktop is Windows XP/7 virtualised by VMWare's hypervison. It runs on a central server.
• The user accesses their desktop using a keyboard/display provided by a "Sun Ray". Ultimately the Sun Ray uses an RDP sessison to connect to the virtualised desktop.
• As with regular desktops, when someone is logged on with an RDP session, the main display of the desktop invites you to CTRL+ALT+DEL to login, noting that someone else is already connected remotely.
• With WebEx and GoToAssist, if you use their 'unattended' solutions to try and help out the user of the machine, you'll see the login prompt of the virtual desktop's main monitor, rather than the RDP session where the user actually needs help.
• Since that's not helpful, I seek a product which will show me the user's RDP session, rather than the virtual desktop's main display.

I hope that explains it.

I am following up Sam's suggestion with the vendor, and will report back.

I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get:

C:\Windows\system32>net start npf
System error 5 has occurred.

Access is denied.

That's strange, because I am in the local admins group, and the SDDL string for the 'npf' service shows that the RP and WP permissions are allowed to the built-in administrator group.

C:\Windows\system32>net localgroup

Aliases for \\DOC

-------------------------------------------------------------------------------
*Administrators
*Backup Operators
*Cryptographic Operators
*Distributed COM Users
*Event Log Readers
*Guests
*IIS_IUSRS
*Network Configuration Operators
*Offer Remote Assistance Helpers
*Performance Log Users
*Performance Monitor Users
*Power Users
*Remote Desktop Users
*Replicator
*Users
The command completed successfully.


C:\Windows\system32>sc sdshow npf

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

Clearly I am missing something, but what?

I connect the 'net with a public static IP (my router's IP address for NAT) and a /29 subnet (for machines behind the router).

On my router, I have:

#sh ip route | inc x.x
     x.x.0.0/16 is variably subnetted, 3 subnets, 2 masks
C       x.x.196.62/32 is directly connected, Dialer1
C       x.x.206.72/29 is directly connected, BVI2


#sh run int dial 1 | inc zone
 zone-member security out-zone
#sh run int bvi 2 | inc zone
 zone-member security in-zone

The zone-pair is fairly restrictive. I would like to relax the restrictions for clients which first connect via a remote-access VPN:

#sh run int virtual-template 1
 zone-member security relaxed-zone

Now clients connecting via VPN must be assigned a private IP address. (I don't allocate public addresses to clients, right?):

# sh ip local pool

 Pool                     Begin           End             Free  In use   Blocked
 RANET100                 192.168.100.230 192.168.100.250   20       1       0

So now if I want to get a packet to x.y.206.73 from 192.168.100.230, that's fine - the router has the information it needs. But it means that the host x.y.206.73 would have to permit traffic to its public-scoped IP address from a private address ... something it would normally be configured to ignore!

So this is a dirty hack, right? What is the True Path (TM)? Should I just multi-home the hosts with the public IP addresses so that they also have a private IP address?

So I am trying to trace an ICMP conversation between 192.168.100.230/32 an EZVPN interface (Virtual-Access 3) and 192.168.100.20 on BVI4.

# sh ip access-lists 199

  10 permit icmp 192.168.100.0 0.0.0.255 host 192.168.100.20
  20 permit icmp host 192.168.100.20 192.168.100.0 0.0.0.255

# sh debug

  Generic IP:
    IP packet debugging is on for access list 199

# sh ip route | incl 192.168.100

    192.168.100.0/24 is variably subnetted, 2 subnets, 2 masks
C       192.168.100.0/24 is directly connected, BVI4
S       192.168.100.230/32 [1/0] via x.x.x.x, Virtual-Access3

# sh log | inc Buff
  Buffer logging:  level debugging, 2145 messages logged, xml disabled,
  Log Buffer (16384 bytes):

OK, so from my EZVPN client with IP address 192.168.100.230, I ping 192.168.100.20. I know the packet reaches the router across the VPN tunnel, because:

policy exists on zp vpn-to-in
 Zone-pair: vpn-to-in

  Service-policy inspect : acl-based-policy

   Class-map: desired-traffic (match-all)
      Match: access-group name my-acl

   Inspect

      Number of Half-open Sessions = 1
      Half-open Sessions
        Session 84DB9D60 (192.168.100.230:8)=>(192.168.100.20:0) icmp SIS_OPENING
          Created 00:00:05, Last heard 00:00:00
          ECHO request
          Bytes sent (initiator:responder) [64:0]


   Class-map: class-default (match-any)
     Match: any
     Drop
       176 packets, 12961 bytes

But I get no debug log, and the debugging ACL hasn't matched:

# sh log | inc IP:
#

# sh ip access-lists 198

Extended IP access list 198
10 permit icmp 192.168.100.0 0.0.0.255 host 192.168.100.20
20 permit icmp host 192.168.100.20 192.168.100.0 0.0.0.255

Am I going crazy, or should I not expect to see this debug log?

Thanks!

Assuming it were permitted by licensing, does the following configuration for getting both SBS premium servers running on the same box work technically?

1. Install the allowed 'physical' instance of SBS 2008 'add on' server on the bare metal, with only the Hyper-V profile (and possibly the GUI-free 'core' installation mode). Do not have it a member of a domain.
2. Install the instance of SBS 2008 'main' server atop #1
3. Install the allowed 'virtual' instance of SBS 2008 'add on' server atop #1

Aside from contention on I/O, memory, CPU, etc, are there any reasons not to do this?

I have inherited a Win SBS 2K8 server which is also being used as an application server - it has a mix of SQL Server 2005/2008 database instances on it (100% of these were setup by programs which installed them ... I suppose that at least some of them are 'Express' instances).

Lately, this setup has come to bite - in particular it would seem that one of the programs can't setup the SQL Server 2005 database instance to reference a machine-local security group - because DC's don't apparently support the notion of local groups.

Although there's a chance I might be able to shoe-horn the program on somehow, I am probably better to take these services off the DC, right?

Do I need to rebuild by DC so that is 'stays pure' as a matter of course? If yes, then which version of Win SBS Server do you recommend? I know that we'd appreciate 2008 R2 on account of its CA's ability to distribute per-machine certificates via SCEP. But SBS 2011 is available and I'm not heavily invested in 2008, so I might as well switch when I rebuild?

Is there any acceptable virtualisation strategy to get both the DC and the app-server on the same box?

Thank-you for advising me on the least-pain route (long term).

MS have taken great pains to remove 'Local Users and Groups' from the GUI tools, and even if you tickle up lusrmgr.msc directly it complains that the snap-in won't run on a domain controller.

The question is "why not?" Why doesn't it make sense for a DC to have local security groups?