Phil's questions

Is there a way to communicate information between classes/resources?

I have a profile that I want to include on all nodes to set them up as being monitored by Icinga which uses an exported resource :

class profile::icinga2::host {
  @@::icinga2::object::host { $::fqdn:
      display_name     => $::fqdn,
      address          => $::ipaddress,
      vars             => hiera_hash('icinga_vars',{}) + {
         "dns_lookup" => $::fqdn,
         "dns_expected_answers" => $::ipaddress,
      },
      target           => "/etc/icinga2/conf.d/puppet.d/${::fqdn}.conf"
  }
}

These resources are then declared in the icinga server using the resource collector:

<<| icinga2::object::host|>>

I want to be able to customize the vars entry in the profile::icinga2::host resource and at the moment doing by adding icinga_vars data into the hiera yaml file for the node e.g.:

icinga_vars:
    http_uri: "http://puppetboard.zoo.lan" 

However ideally I would do this inside any classes that are included by the node itself.

Is there a way of setting up data in classes that can then be read by a different class?

Facts don’t seem the right way of doing it and nor does puppetdb, is there an alternative?

Can I, for example, create a icinga2::variable class and declare those outside the profile::icinga2::host class and then iterate over them in the profile::icinga2::host class? How would that be done and how would dependencies be handled e.g. I would need to ensure the icinga2::variables are ready to be read by profile::icinga2::host Thanks

We have about 20 Cisco SG500 Switches in our network configured with various VLANs, trunks, ports etc.

We recently needed to install additional network capacity so purchased some SG350X switches as the SG500s are end-of-life.

Whilst getting the SG350X configured and ready to deploy, we noticed some weird network issues on our existing network, specifically Wifi access points and IP phones were broken and no longer.

Our investigation revealed that the configuration of the broken ports had been changed and we suspect that the new SG350X may have been the culprit. We did change the admin password of the switch to match that of our other switches so does the SG350X have the ability to manage other switches? And if not, any other ideas of how it couold have happened? Is their an audit of configuration changes?

An example of a change to a ports configuration is from:

interface gigabitethernet1/1/19
loopback-detection enable 
dot1x guest-vlan enable 
dot1x port-control auto 
description 115
switchport trunk native vlan 210 

To

interface gigabitethernet1/1/19
loopback-detection enable 
dot1x guest-vlan enable 
dot1x port-control auto 
description 115
storm-control broadcast enable 
storm-control broadcast level 10 
storm-control include-multicast 
port security max 10 
port security mode max-addresses 
spanning-tree portfast 
macro description ip_phone_desktop
!next command is internal.
macro auto smartport dynamic_type unknown

Is there a way of seeing the details of the certificate used to encrypt an email that was received by Outlook.

I'm trying to diagnose an issue and want to see if someone has an out of date offline address book and so is using old certificates.

Note that its not my certificate that I am using to encrypt / sign I need details of - its the one that was used by the person sending to me

We use Bitlocker Active Directory Key Protector to protect and auto unlock USB drives but are seeing random failures to unlock.

We have two AD Groups that we use

• DOMAIN\BitlockerAdmin (contains system administrators)
• DOMAIN\BitlockerPerComputer (contains the user that uses the laptop)

The users are all members of a domain group “DOMAIN\BitlockerPerComputer” and we run the command:

Enable-BitLocker -MountPoint F: -EncryptionMethod XtsAes256 -UsedSpaceOnly -AdAccountOrGroup "Domain\BitlockerAdmin" –AdAccountOrGroupProtector 
Add-BitLockerKeyProtector -MountPoint $BACKUPVOL -AdAccountOrGroup "DOMAIN\BitlockerPerComputer" –AdAccountOrGroupProtector

What we expect to happen (which works only sometimes)

• User logs in, and the drive unlocks or the Sysadmin logs in, and the drive unlock.
• If we remove the user from the AD group, the drive will always remain locked and the user will not be able to unlock it.

What we are seeing.

• Sometimes we notice the user logs in, and the drive does not unlock. We can wait for days and do numerous reboots but no change in behaviour.
• Anyone in the BitlockerAdmin group that logs in always unlocks fine
• If we add the user to BitlockerAdmin group, log off and on the drive sometimes will unlock i.e. it works better but sometimes it will not.
• Even after removing the user from the AD group they are still able to unlock the drive

We have also tried to use the Manage-bde commands rather than powershell but get the same results

Changing the order of the groups that I add in first make no difference either.

We’ve tried to research exactly how the AD protector works in order to diagnose the issue but there is very little information out there.

Any pointers to help diagnose the issue gratefully received

We have successfully managed to deploy HAProxy as a Layer-4 load balancer for all our Exchange 2013 SP1 HTTP based traffic (Autodiscover, OWA, EXP, EWS, MAPI, etc.)

For various reasons, however, we are looking to move to a Layer-7 "SSL Offloading" architecture.

We have based most of our configuration on the excellent ALOHA guide : https://www.haproxy.com/static/media/uploads/eng/resources/aloha_load_balancer_appnotes_0065_exchange_2013_deployment_guide_en.pdf

The good news is that almost everything is working absolutely fine. Our only problem is with MAPI i.e. the replacement for RPC that was introduced in Exchange 2013 SP1.

From what I have read SSL offloading of MAPI is supported by Exchange 2013 - see http://blogs.technet.com/b/rmilne/archive/2014/02/25/exchange-2013-sp1-released.aspx. The ALOHA document advises against using Layer-7 SSL Offloading for MAPI but purely due to performance issues and not any technical reason.

If we try and load balance MAPI then the symptoms we are seeing are

• the /mapi/HealthCheck.htm URL can be returned fine in a web browser
• However, Outlook clients repeatedly ask for credentials

The relevant bits of HAProxy config are below (Its not the whole file)

frontend ft_exchange_2013_https
 bind 1.1.1.3:443 ssl crt /blah/blah.pem
 capture request header Host len 32
 capture request header User-Agent len 64
 capture response header Content-Length len 10
 maxconn 10000
 acl ssl_connection ssl_fc
 acl host_mail hdr(Host) -i mail.company.com
 acl path_slash path /
 acl path_mapi path_beg -i /mapi
 http-request deny if path_check
 http-request redirect scheme https code 302 unless ssl_connection
 http-request redirect location /owa/ code 302 if path_slash host_mail
 use_backend bk_exchange_2013_https_mapi if path_mapi

backend bk_exchange_2013_https_mapi
 option httpchk GET /mapi/HealthCheck.htm
 http-check expect string 200\ OK
 timeout server 600s
 server SERVER1 1.1.1.1:443 maxconn 2000 weight 10 check ssl verify none
 server SERVER2 1.1.1.2:443 maxconn 2000 weight 10 check ssl verify none

The things we have tried to resolve the issue are

• Use HTTP rather than HTTPS on the backend by removing the "Require SSL" flag on the MAPI IIS Virtual directory and using port 80 rather than 443 onm the SERVER1 and SERVER2 lines
• Remove one of the backend servers so all requests go to a single server
• Change the authentication settings for the MAPI Virtual directory from the default "Negotiate" to "NTLM"

However, none of these have fixed the problem. If anyone has any ideas on how to diagnose further or has a working configuraiton they could share e.g. HAProxy config + Exchange MAPI Virtual directory config that would be great !!

Edit 1

I've also managed to reproduce the Outlook behaviour by going to https://mail.company.com/mapi/emsmdb which repeatedly prompts for credentials the same as Outlook

I'm using the following powershell to get a list of certificates including any archived ones so that I can easily transfer them to a new PC

$store=new-object 
System.Security.Cryptography.X509Certificates.X509Store("My","CurrentUser")
$store.open("ReadOnly,IncludeArchived")
$privateCerts = $store.Certificates | Where-Object { $_.hasPrivateKey }

However, when I try and export them to pfx files using e.g.

$privateCerts| Foreach-Object { [system.IO.file]::WriteAllBytes("$($_.thumbprint)$($_.Subject).pfx", ($_.Export('PFX', 'password')) ) }

It throws exceptions for any that are not exportable. Now I know that I cant export those but I'd like to just skip over them without having the script throw an error. I can work around it by catching the exception but is there a way to determine if a certificate is exportable.

I found reference to x509keystorageflags which has an "exportable" bit I could check but I cant work out how to get that info for a certificate using powershell.

We have a Sonicwall SRA server configured to authenticate users using RADIUS to a Windows NPS Server running on Windows Server 2012 R2.

It all works fine EXCEPT when passwords contain the "£" character.

According to the RADIUS spec on page 24 the password field

contains UTF-8 encoded 10646 characters and String contains 8-bit binary data

I found a website that defines the pound sign as

0xC2 0xA3 (c2a3)

I hacked together a fairly ugly perl script to implement the RADIUS password encryption for short passwords (<= 16 octets) using simple MD5 hashing and XORing (I'm no perl expert so I know its not pretty!)

#! /usr/bin/perl -w
use 5.010;
use Digest::MD5 qw(md5 md5_hex md5_base64);
use MIME::Base64;
use Carp qw/croak/;
use List::Util qw/max/;

$secret = "verysecret";
$authenticator = '5354ff6a10cec708f2da74a8b268b98d';
$pwd = "££££££££";
$pwdhex = $pwd;

# Convert password to a Hex string
$pwdhex =~ s/(.)/sprintf("%02x",ord($1))/eg;

print "Password in HEX = " .$pwdhex . "\n";
print "Password in ASCII " .$pwd . "\n";

# Convert RA from Hex string into bytes
$authenticator =~ s/([a-fA-F0-9][a-fA-F0-9])/chr(hex($1))/eg;

# Concatenante the secret and authenticator then MD5 them
$md5input = $secret . $authenticator;
$md5 = md5($md5input);
$md5hex = $md5;
$md5hex =~ s/(.)/sprintf("%02x",ord($1))/eg;
print "Secret + RA (MD5)             " . $md5hex . "\n";

state $encryptedpassword = $md5 ^ $pwd;

$encryptedpassword =~ s/(.)/sprintf("%02x",ord($1))/eg;

print "Computed Encrypted Password = " . $encryptedpassword . "\n";

Using a network trace of the RADIUS traffic I was able to show that the password was being correctly encrypted using c2a3 for each pound sign.

I was going to raise a ticket with Microsoft next as it looks like a problem in their Radius server implementation in NPS but thought I'd post this rather interesting puzzle here first in case anyone had seen anything similar.

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers.

We have 2 x Windows 2012 Servers running

• IIS Server
• SQL Server 2012

We have kerberos delegation set up and working from IIS server to the SQL Server. Users authenticate to IIS and then these are passed through to SQL Server for any operations that are performed using delegation

Everything works fine with Negotiate (Kerberos then NTLM) set up on IIS and when accessing the site internally but when we try putting the site behind a reverse proxy (Sonicwall SRA), it breaks.

Having done a bit of investigation, it would appear that this is because kerberos authentication doesn't work behind a reverse proxy so we need to switch to basic (as NTLM doesn't work for delegation between IIS and SQL server).

So is best practice in this case to use HTTPS to protect basic authentication or is there a way to get Negotiate (kerberos) working?

It does seem odd that one needs to use Basic because

• Kerberos cannot be used behind a reverse proxy and
• NTLM cant be use to delegate

But maybe thats just the way it is.

I have a file share set up on a Windows Server 2008 R2 server I have a security group called "Allow file access" (not its real name!) which include a bunch of users and also "Domain Admins"

I have a single permission set up on the share to grant read/write access to "Allow file access" group. And also the security settings for the folder grant full control to "Allow file acess" ND Domain Admins

However, when logged on (as a Domain Admin) I get a Permission Denied error when trying to access the share.

If I explicitly add "Domain Admins" to the list of share permissions I am allowed access.

Am I not allowed to nest Domain Admins in other groups?

We are migrating over to using SonicWALL as our firewall from Microsoft Forefront TMG.

I have managed to export our DHCP Reservations from the DHCP Service running on our TMG box but want to avoid having to type them in by hand into the SonicWALL admin screens.

Anyone got any ideas how to bulk upload a list of reservations. I dont mind doing abit of scripting if necessary :-)

I am trying to get EFS working on our workstations. First when I tried to set a directory to be encrypted I got a warning about the Recovery Agent certificate being invalid.

It turned out that the default one set up when my domain was first set up many years ago had expired so I created a new one and added an "EFS Data Recovery Agent" to a GPO at Computer Configuration -> Policies -> Windows Settings -> Security Policies -> Public Key Policies -> Encrypting File System.

When I perform a "Group Policy Results" for a given workstation and user, it shows the new agent so its definitely in the Group Policy

Also, after running "gpupdate /force /wait:-1" and also waiting 24 hours! when I try and set a directory to be encrypted I no longer get the warning about an invalid Recovery Agent.

So far so good I thought. However, the Recovery agent is not being used which I have proved by

1. backing up the removing the "user" EFS cert and just having the recovery agent certificate and private key imported - I get access denied when trying to read the file
2. running cipher /c I get " No recovery certificate found."
3. Drilling down through the properties of the file and the advanced encryption details, the list of recovery agents is blank.

Anyone got any ideas what is going on and how I get the recovery agent to be used?

I have a fairly standard network set up with a Cisco router with a bunch of public IP addresses connected to a TMG Server Firewall (For the sake of anonymity lets say the public IP of the TMG server is 1.1.1.66 and the IP of the router is 1.1.1.65

We are in the process of setting up a branch office and I have succesfully set up another TMG server with a site-2-site VPN over a spare ADSL line we have in order to check everything works before sending it to the new office.

However, I'd like to mimic various network speeds and latencies to work out what size of connection we need in the branch office and so thought I'd put an Ubuntu Server in between the two and us tc to throttle the bandwidth.

Our ISP has changed the config on the Cisco router so one of the ports has a 172.16.0.1 / 255.255.255.0 VLAN and I have split this range into two 255.255.255.128 ranges and set up and Ubuntu Box to route between them with

• two NICS (72.16.0.2 / 255.255.255.128 and 172.16.0.202 / 255.255.255.128)
• enabled port forwarding in /etc/sysctl.conf
• added some simple config to iptables to log every packet

From the branch firewall and the main firewall I can ping both NIC IP addreses on the Ubuntu Router. And from the Ubuntu Router I can ping everywhere including the 1.1.1.x addresses However I can't ping the two firewalls from each other, its as if the packets aren't being forwarded. I can't seem to "cross" the ubuntu router.

I suspect its the way I've set up the two NICs with 255.255.255.128 masks but am not really a routing expert!

I have inherited a critical situation as follows.

• 2 x 16-Disk RAID5 Storage systems (one holding master data, one holding backups)
• Backup system had no monitoring and two disks failed so all data is lost - not a huge issue
• Master system is showing 2 disks with media errors, one holding steady at around 30 and the other at about 2,000 but slowly growing (was 2,100 after a week or so)

There are longer term plans to use better storage, use hot spares, put in place better monitoring, set up mirroring, backups etc. etc. etc. but the immediate need is to protect the master data as it is crucial to the business but is sitting on a RAID5 array with two disks showing errors

We have basically boiled down the options to one of

Option 1

• Swap out the disk with 2,000 media errors and let the RAID5 array rebuild
• Once complete, swap out the other disk with media errors

Main concern with this is that whilst the array is being rebuilt (24-48 hours?), there is zero redundancy in the system and any disk failures would mean loss of all data.

Option 2

• Leave the RAID5 array as is and copy the data onto a new storage array

Main concern with this is that it will take many times longer than the RAID rebuild as the filesystem has many 100's of millions of little files so the copy could take close to a month to complete without impacting the site that is using the files

I would be interested in views on which approach you would take and why? Are media errors of this level worrying? Is the level of growth in the media errors worrying?

As I understand it one can upgrade the firmware on a Dell Equallogic server in about 15 seconds and it can be done whilst an ESXi host is connected and VMs are running but that the iSCSI timeout value needs to be increased to avoid errors on guest VMs.

I've searched VMWare and Dell's sites but can't find a best practice quide or KB article that gives details of what to do for ESXi 5.0 in order to increase the timeout and perform a "live" firmware upgrade. Is it per-host/iSCSI initiator or per target, how do you increase it and what is a sensible value?

I have a script that I want to run at startup but that requires elevated priviledges. Is there a way of doing this with Group Policy?

I tried adding it in as a startup script using GPO but it doesn't appear to run. If I run it from a standard cmd prompt then it gives access denied but if I right click the command prompt and select "Run as Administrator" then it works fine so I suspect it is a permission issue.

The script is setting the MTU on each NIC to be 1400 as follows

Dim strDNSDomain  
Dim strComputer  
Dim strID  
Dim strKeyPath  
Dim strValueName  
Dim strDWValue  

Const HKEY_LOCAL_MACHINE = &H80000002  
Const DEFAULT_MTU_Size = 1400  
const KEY_SET_VALUE = &H0002

'====  Gets the Setting for MTU from the command line in the form of /MTU:1500 ====  

Set colNamedArguments = Wscript.Arguments.Named  

strComputer = "." 
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")  
set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

strDWValue = DEFAULT_MTU_SIZE

Set colAdapters = objWMIService.ExecQuery ("SELECT * FROM Win32_NetworkAdapterConfiguration")  
For each objAdapter in colAdapters  
   strDNSDomain = objAdapter.DNSDomain  
   if Instr(1, strDNSDOmain, strTemp) >0 then  
       strID = objAdapter.SettingID  
       strKeyPath = "SYSTEM\CurrentControlSet\Services\TCPIP\Parameters\Interfaces\" & strID  
       strValueName = "MTU" 

    oReg.CheckAccess HKEY_LOCAL_MACHINE, strKeyPath, KEY_QUERY_VALUE, bHasAccessRight
    If bHasAccessRight = True Then
        oReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
        WScript.Echo strKeyPath & " value " & strValueName & " contains " & dwValue
        oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strDWValue  
        WScript.Echo strKeyPath & " value " & strValueName & " changing to " & strDWValue
        oReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
        WScript.Echo strKeyPath & " value " & strValueName & " changed to " & dwValue
    Else
        WScript.Echo "Cannot set registry value - access denied"
    End if
   End if  
Next  

I have a Microsoft TMG server with a number of site-2-site VPNs which all have different IP address ranges.

Now a client has asked for another site-2-site VPN but their IP range clashes with an existing range. Is it possible to set up some form of IP mapping so the two ranges can be used at the same time.

e.g. both clients use 192.168.0.x can I set it up so for one client we use the "real" ip addresses but for the other we use something like 192.168.1.x and TMG server changes it to 192.168.0.x and pushes it down the correct VPN.

Thanks.

My basic question is “Why do DNS queries from the TMG server itself first go to the VPN DNS Servers rather than the ISP DNS Server configured on the internal NIC?”

Further details and diagnostics below

I have a TMG Firewall with

• 3 NICs (Internal, External, DMZ) with network binding order of
  1. First = Internal,
  2. External,
  3. DMZ,
  4. Last = (Remote Access Cnnections)
• a number of PPTP site-2-site VPNs
• the DNS service running with
  • stub zones to my internal Active-Directory DNS domains
  • forwarders set up to my ISPs DNS servers
• internal NIC had DNS server set as itself and all other NICs have blank DNS entries

DHCP is configured so clients set their DNS server to the TMG Server

If I run a network trace on the TMG Server and filter based on (tcp.port == 53 or udp.Port == 53) and (ipv4.address == 10.x.x.x or ipv4.Address == )

When I, for example, ping zzzzz.com from a client that has the Firewall Client enabled I observe - no DNS requests coming from the client from which I conclude that DNS requests are coming down the firewall client control channel - DNS requests for zzzzz.com going out to all the various Site-2-Site VPN DNS Servers and then eventually to the External ISP DNS Server - After about 12s a DNS request from the client directly to TMG with an immediate response

If I disable the Firewall client or do an nslookup directly from the client then within < 1 second I see - a DNS request form the client - a DNS request and response to the External ISP DNS Server - a DNS response to the client Which is exactly what I want and would expect!!

Also, if I do an nslookup from the TMG server itself it first goes to the VPN DNS Servers rather than the ISP DNS Server configured on the internal NIC

Note that I know that the DNS set up is not quite as described here http://technet.microsoft.com/en-us/library/cc995245.aspx and I am planning to move over to that DNS architecture. However, I don’t think that is the cause of the problem above and I suspect my issues will remain once I do that as it fundamentally boils down to the following question

Why do DNS queries from the TMG server itself first go to the VPN DNS Servers rather than the ISP DNS Server configured on the internal NIC and is there a way to stop it happening.

Is there a way to find out who created a public folder in Exchange 2010?

I've tried looking in ADSI Edit and Get-PublicFolderStatistics (which gives created/modified dates and times).

Any ideas?

We have a number of ESX Servers connected to various iSCSI Targets and I want to do a consolidation exercise so want to get an idea of the current level of IOPS each of our servers uses.

I tried running

$start = Get-Date "2010-07-25 10:00:00"
$finish = Get-Date "2010-07-26 10:00:00"
$esx = Get-VMHost <ESX-hostname>
get-stat -entity $esx -stat disk.numberRead.summation -start $start -finish $finish

But get the error

The metric counter "disk.numberread.summation" doesn't exist for entity "esx1.zoo.lan"

despite the documentation implying that the counter does exist.

Anyone done anything similar. Even if I can get the data on a per-VM or even per-LUN bassis that would be fine as I could just sum it up in a spreadsheet

I have an ISA Server 2006 Server acting as a VPN server and it is working fine for all users.

However, there is one particular user who gets an error “916, the interface is in a disabled state.”

A similar error is also logged in the event log of the ISA Server

In Active directory, the user is a member of the "Domain Guest" groups. Other members of this group are able to VPN in fine so I don't think it is a permissions thing.

Any ideas anyone?