We are having an issue where, after deploying EMET we noted that about 20% of our users are having problems when using Office or Internet Explorer. The one thing that solves the issue is if an administrator logs onto the machine. The administrator does not have to do anything but logging onto the workstation (no other action than a simple logon).
After this the problem goes away. Has anyone else had this issue before?
When trying to use SSTP with password authentication I'm unsuccesful at creating a connection from the native windows client. I always get MS-CHAPv2 authentication errors:
2015-01-03 03:04:43.278 On the TCP Listener (Port 443), a Client (IP address 1.2.3.4, Host name "1.2.3.4", Port number 51567) has connected.
2015-01-03 03:04:43.278 For the client (IP address: 1.2.3.4, host name: "something.be", port number: 51567), connection "CID-6" has been created.
2015-01-03 03:04:43.510 SSL communication for connection "CID-6" has been started. The encryption algorithm name is "RC4-MD5".
2015-01-03 03:04:44.194 SSTP PPP Session [1.2.3.4:51567]: A new PPP session (Upper protocol: SSTP) is started. IP Address of PPP Client: 1.2.3.4 (Hostname: "something.be"), Port Number of PPP Client: 51567, IP Address of PPP Server: 5.6.7.8, Port Number of PPP Server: 443, Client Software Name: "Microsoft SSTP VPN Client", IPv4 TCP MSS (Max Segment Size): 0 bytes
2015-01-03 03:04:45.613 On the TCP Listener (Port 0), a Client (IP address 1.2.3.4, Host name "something.be", Port number 51567) has connected.
2015-01-03 03:04:45.613 For the client (IP address: 1.2.3.4, host name: "something.be", port number: 51567), connection "CID-7" has been created.
2015-01-03 03:04:45.613 SSL communication for connection "CID-7" has been started. The encryption algorithm name is "(null)".
2015-01-03 03:04:45.613 [HUB "DEFAULT"] The connection "CID-7" (IP address: 1.2.3.4, Host name: something.be, Port number: 51567, Client name: "Microsoft SSTP VPN Client", Version: 4.12, Build: 9514) is attempting to connect to the Virtual Hub. The auth type provided is "External server authentication" and the user name is "test".
2015-01-03 03:04:45.613 [HUB "DEFAULT"] Connection "CID-7": User authentication failed. The user name that has been provided was "test".
2015-01-03 03:04:45.633 Connection "CID-7" terminated by the cause "User authentication failed." (code 9).
2015-01-03 03:04:45.633 Connection "CID-7" has been terminated.
2015-01-03 03:04:45.633 The connection with the client (IP address 1.2.3.4, Port number 51567) has been disconnected.
2015-01-03 03:04:45.915 SSTP PPP Session [1.2.3.4:51567]: "MS-CHAP v2" (Microsoft Challenge and Response Protocol Version 2.0) user authentication failed.
2015-01-03 03:04:45.915 SSTP PPP Session [1.2.3.4:51567]: A PPP protocol error occurred, or the PPP session has been disconnected.
2015-01-03 03:04:47.948 Connection "CID-6" terminated by the cause "Connection has been disconnected." (code 3).
2015-01-03 03:04:47.948 Connection "CID-6" has been terminated.
2015-01-03 03:04:47.948 The connection with the client (IP address 1.2.3.4, Port number 51567) has been disconnected.
It does work using the SoftEther client but I prefer the native Windows client as it's easier to set up. The type of authentication I set up is just local user/password authentication. Installed on Debian.
I have a small network set up like this:
I have a Pfsense for connecting my servers to the WAN, they are using NAT from the LAN -> WAN.
I have an OpenVPN server using TAP to allow remote workers to be put on the same LAN network as the servers.
Currently when I connect, all routes seem fine on the client side:
Destination Gateway Genmask Flags Metric Ref Use Iface
300.300.300.300 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.25.0.0 10.25.255.254 255.255.0.0 UG 0 0 0 tap0
10.25.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tap0
0.0.0.0 300.300.300.300 0.0.0.0 UG 0 0 0 eth0
I can ping the LAN interface:
root@server:# ping 10.25.255.254
PING 10.25.255.254 (10.25.255.254) 56(84) bytes of data.
64 bytes from 10.25.255.254: icmp_req=1 ttl=64 time=7.65 ms
64 bytes from 10.25.255.254: icmp_req=2 ttl=64 time=7.49 ms
64 bytes from 10.25.255.254: icmp_req=3 ttl=64 time=7.69 ms
64 bytes from 10.25.255.254: icmp_req=4 ttl=64 time=7.31 ms
64 bytes from 10.25.255.254: icmp_req=5 ttl=64 time=7.52 ms
64 bytes from 10.25.255.254: icmp_req=6 ttl=64 time=7.42 ms
But I can't ping past the LAN interface:
root@server:# ping 10.25.255.1
PING 10.25.255.1 (10.25.255.1) 56(84) bytes of data.
From 10.25.255.254: icmp_seq=1 Redirect Host(New nexthop: 10.25.255.1)
From 10.25.255.254: icmp_seq=2 Redirect Host(New nexthop: 10.25.255.1)
I ran a tcpdump on my em1 interface (LAN interface which has the IP of 10.25.255.254)
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 96 bytes
08:21:13.449222 IP 10.25.24.1 > 10.25.255.1: ICMP echo request, id 23623, seq 10, length 64
08:21:13.458211 ARP, Request who-has 10.25.255.1 tell 10.25.24.1, length 28
08:21:14.450541 IP 10.25.24.1 > 10.25.255.1: ICMP echo request, id 23623, seq 11, length 64
08:21:14.458431 ARP, Request who-has 10.25.255.1 tell 10.25.24.1, length 28
08:21:15.451794 IP 10.25.24.1 > 10.25.255.1: ICMP echo request, id 23623, seq 12, length 64
08:21:15.458530 ARP, Request who-has 10.25.255.1 tell 10.25.24.1, length 28
08:21:16.453203 IP 10.25.24.1 > 10.25.255.1: ICMP echo request, id 23623, seq 13, length 64
So traffic is reaching the LAN interface, it's also passed to the host and the host replies. But the traffic is not put on the LAN interface.
So I upgraded from Squeeze to Wheezy and Dovecot failed to resolve dependencies:
dpkg: error processing dovecot-pop3d (--configure):
dependency problems - leaving unconfigured
Errors were encountered while processing:
dovecot-core
dovecot-gssapi
dovecot-sqlite
dovecot-pgsql
dovecot-sieve
dovecot-mysql
dovecot-imapd
dovecot-common
dovecot-ldap
dovecot-pop3d
After searching around on the internet I found the following article: http://www.itwire.com/opinion-and-analysis/open-sauce/59796-dovecot-fails-during-wheezy-upgrade Now I've got two options:
Has anyone used either of these approaches or does anyone have a better idea to make this work?
I had a problem where Windows 7 would not allow inbound connections over my openVPN tunnel. Meaning that my Windows 7 client would allow outbound and established connections but not allow inbound connections coming from openVPN network. For instance I can ping a Linux client without firewall from my W7 client, but the Linux client cannot ping the W7 client (packets get dropped by the Windows 7 firewall).
I solved this by excluding the network adapter that was created by openVPN (tun/tap adapter) from the Windows firewall public and private profiles. Basically I would like ICMP to work and RDP but all the rest I want to have secure. At the moment I just allow all incoming connections on the network. (which is private and shared by only my machines). I was wondering if this is the most sensible thing to do or if there is a way to allow incoming ping and rdp towards the TUN/TAP interface (coming from my VPN network) without allowing any other connection?
The windows clients are all running Windows 7 Professional.
What are the IWWW and OWWW users for on HP UNIX? They are present on the machine but I don't really know what they are used for?
It's very important to have decent and good documentation. The problem is that often we might have good documenting techniques, but we forget some crucial points. It can be extremely painful to find these crucial points during a disaster recovery.
Therefor I want to create this canonical question and answer on what we should be documenting and how we should be writing it down.
We already have these good questions and answers on what technologies we can use for documenting:
All answers will be merged into one big sectioned answer that administrators can use to checklist their own documentation.
I'm trying to get my RAID controller working with FreeBSD. But it seems it's not being recognized by FreeBSD:
module_register_init: MOD_LOAD (pci/rr2680, 0xc0a45b90, 0xc61f0430) error 22
rr2680: RocketRAID 268x controller driver v1.0.08.1222 (Dec 22 2008 14:08:35)
rr2680: no controller detected.
I'm a bit clueless on how to get it fixed. The server is a HP HDPC with a Pentium D.
I was wondering of SNMPv3 is enabled by default on Cisco devices and if there are default credentials?
What are the commands to enable disk encryption on a NetApp NAS, can this be done per disk/array?
I have little experience with Windows systems. Coming from a Linux background I was wondering if there is a way that I can ssh to powershell from a Linux shell?
If this is not possible, is there a key exchange like way to connect from powershell to powershell? I prefer it if I do not need to enter a password for every single server every time.
If this all sounds a bit crazy and there are better ways that windows does this, then feel free to share.
I've installed openmanage on my dell poweredge 2950 and wanted to integrate check_openmanage through nrpe in my nagios3 monitoring server.
I can execute the check_nrpe!check_openmanage command manually (it returns output from the server I want to monitor when I execute it on my nagios server):
./check_nrpe -H example.com -c check_openmanage
Controller 0 [PERC 5/i Integrated]: Firmware '5.2.1-0067' is out of date
I've set up the service through:
define service{
use some-service
hostgroup_name dell-servers
service_description dell servers
check_command check_nrpe!check_openmanage
}
My problem is that on my webinterface I get status: UNKNOWN with status information: (No output returned from plugin)
I just set up OSSEC, but I accidentally shut myself out already from my home ip.
So does OSSEC have a function to unblock an IP after it is blocked or do I need to do this manually in iptables ?
Also does OSSEC provide a way to temporary ban IP's ?
I'm learning about virtual desktops and I was wondering; suppose you have 1500 people in your company, almost all using virtual desktops, and they would have to start up their computers all at the same time more or less.
How will this affect the network and what would the solution be? It would congest the network, right?
The only thing I could think off is maybe using multicast to spread the golden images, or a pool per level (building level) that caches images in the morning and sees to it that it always has the newest one cached.
But I can't find any articles about it.
Does anyone have some good reading or examples of how they solved this?
I was doing some cisco exercises on configuring a vtp server and client, something I can't figure out is :
I setup a vtp server, added my VLAN's
I then took another switch that was attached to this vtp server and set it to client
Is there a way to push the configs, like a force update command ?
I am mounting a KVM disk (LVM) following these commands :
# losetup /dev/loop0 foo.img
# kpartx -av /dev/loop0
# mount /dev/mapper/loop0p1 /mnt
# unmount /mnt
# kpartx -dv /dev/loop0
# losetup -d /dev/loop0
Problem is when I want to do kpartx -d /dev/loop0 I get :
device-mapper: remove ioctl failed: Device or resource busy
device-mapper: remove ioctl failed: Device or resource busy
I tried looking for it with lsof, but I can't find anything, anyone any idea how I can force this or what I am doing wrong?
I need to setup an Archlinux vps with openssh, everything is running smoothly except that I couldn't ssh in.
I noticed openssh wasn't installed so I looked on the wiki which said to do :
pacman -S openssh
I did that but it started giving me errors that it could not find openssh-5.8p2-9-x86_64.pkg.tar.xz on the mirror
error : failed retrieving file 'openssh-5.8p2-9-x86_64.pkg.tar.xz' from artfiles.org : No address record
I added more mirrors, but still I get the same error.
What am I doing wrong ?
I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ?
How do you guys secure iLO ? Do you put it behind a firewall ?
Would you use a firewall that can be accessed from the WAN using iLO ?
is there a way to get an overview of users logged in on my server and the ip they are connecting from ?
I have the IP already, I want the user that is associated with it :)
I want to write a bash or perl script to install a number of packages on my debian based machine.
I want it to be something like :
aptitude install package1
aptitude install package2
But, I do not know how how to automatically say "yes" through the script at the prompt to confirm you want to install that package. Can someone give me an example in perl and bash ?
gratz!