Zoredache's questions

Is there any way in IPv6 to enable dynamic addressing and configuration for a subset of hosts on a network identified by specific mac addresses?

I have been slowly working at setting up IPv6. All my routers have static addresses and routes and a few critical servers are statically addressed. Now I want to start testing out some clients, but I don't want to simply enable it for an entire network at once. I would like to be able to just enable it for a few hosts.

In the IPv4 world I would setup a DHCP server with 0 free addresses in the scope, and just setup reservations. In the IPv6 world this doesn't appear to be an option since I can't set a default gateway via DHCPv6, that apparently can only be learned via router advertisements.

How is this approached? Is it simply not possible to selectively enable IPv6 on a network?

My routers are Linux based and the DHCPv6 server would run on Linux if it matters, and I am looking to enable clients of all sorts (Windows/Linux/OSX).

Windows 7 and Windows 2008 R2 potentially can have WMF 2, WMF 3, or WMF 4 installed. Windows 2012 could have WMF3 or 4, and 2012 R2 has WMF 4.

I am looking for a method to find which version is installed. Hopefully this can be found via WMI, so I can use it within both Group Policy filters, and as a check within Powershell scripts I am planning on building that require functionality only available if WMF 3 or 4.

I must be asking the question the wrong way because I am not finding answers on Google.

I want to detect if a 2012 server is has been setup as a Core install using WMI. An earlier question, would seem to indicate that I can get the OperatingSystemSKU from Win32_OperatingSystem. My Windows 2012 Core systems are reporting a OperatingSystemSKU of 7. The article from the other question would seem to indicate is a PRODUCT_STANDARD_SERVER, and if had a core install I should expect to see a value of 0x0000000D instead for PRODUCT_STANDARD_SERVER_CORE.

What am I missing here. I eventually want to create a policy and use item level targeting to only apply that policy to Windows 2012 Server Core installs.

PS C:\Users\zoredache\Documents> gwmi -Query "select OPeratingSystemSKU,Version,ProductType from Win32_OperatingSystem"

__GENUS            : 2
__CLASS            : Win32_OperatingSystem
__SUPERCLASS       :
__DYNASTY          :
__RELPATH          : Win32_OperatingSystem=@
__PROPERTY_COUNT   : 3
__DERIVATION       : {}
__SERVER           :
__NAMESPACE        :
__PATH             :
OperatingSystemSKU : 7
ProductType        : 2
Version            : 6.2.9200

I am looking to sort a list of domain names (a web filter whitelist) starting from the TLD and working upwards. I am looking any *nix or windows tools that can do this easily, though a script would be fine too.

So if the is the list you are given

www.activityvillage.co.uk 
ajax.googleapis.com 
akhet.co.uk 
alchemy.l8r.pl 
au.af.mil 
bbc.co.uk 
bensguide.gpo.gov 
chrome.angrybirds.com 
cms.hss.gov 
crl.godaddy.com 
digitalhistory.uh.edu 
digital.library.okstate.edu 
digital.olivesoftware.com

This is what I want as the output.

chrome.angrybirds.com 
crl.godaddy.com 
ajax.googleapis.com 
digital.olivesoftware.com 
digital.library.okstate.edu 
digitalhistory.uh.edu 
bensguide.gpo.gov 
cms.hss.gov 
au.af.mil 
alchemy.l8r.pl 
www.activityvillage.co.uk 
akhet.co.uk 
bbc.co.uk

Just in case you are wondering why, Squidguard, has a bug/design flaw. If both www.example.com and example.com are both included in a list, then the example.com entry is ignored and you can only visit content from www.example.com. I have several large lists that need some cleanup because someone added entries without looking first.

I haven't found a really clear definition about what a 'carrier error' is within the context of the ifconfig output for a interface. I have been searching on Google and there really isn't a great definition, or list of issues that cause this.

I am assuming from the context, that this means something about the Ethernet signal is bad. I suspect something about the interconnecting cable, or the network interface/port is causing this problem?

I hardly ever see this counter changing, but a client contacted me this morning and mentioned network issues. The carrier counter is increasing by about 200 each second. They had recently made some modifications to the equipment connecting to the Linux box I manage. I would like to be able to give them some more specific details about what may be causing the problem, other then saying, something you changed is broke.

eth0      Link encap:Ethernet  HWaddr 00:1b:21:f3:ea:ae  
          inet addr:172.16.0.9  Bcast:172.16.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:13386121 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21255715 errors:1701 dropped:0 overruns:0 carrier:1031707
          collisions:1313642 txqueuelen:1000 
          RX bytes:2467874046 (2.2 GiB)  TX bytes:3820141165 (3.5 GiB)

So what is it a 'carrier error', and what are the typical problems that cause it.

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, and setup my enterprise CA as a subordinate. But it seems silly to license a fully copy of Windows for this task.

What I am hoping to be able to do is to install some live distribution onto a USB flash disk, and then install openssl, and setup my CA on flash drive. When I am ready to build the root key/cert I will disconnect the computer from the network, and then never use that USB disk on a network attached computer again.

Will I be able to properly sign and create a subordinate CA certificate for a Windows enterprise CA, that will be usable. What options do I need to use with OpenSSL to build the CA and sign the subordinate CA certificate properly.

I have attempted searched the web, and the this was the only thing I could find on the subject. But it predates 2008, and I am not entirely sure the person was every successful.

I am looking for web-based interface GUI, or some kind of monitoring tool that will show replication status for a domain.

I know I can use repadmin with various options on the command line to query the status. I thought about creating a script they could run when they are interested in the status, but they will probably be more interested in some kind of status page.

So I have been reading the document "Group Policy processing and precedence". I get that policies are applied in the order of local, site, domain, organizational unit, child organizational unit. The article isn't clear about the order that things are applied to the computer like software installation, script and the new group policy preferences.

I am trying to write a script to adjust some things on the computer that doesn't seem possible with preferences, but I need to be certain that a software install has completed, and some preferences have been applied first.

Update:

Here is some background information. I have a group policy that has a software installation for Widget A (Computer Configuration\Policies\Software Settings\Assigned Applications). Widget A places shortcuts all over the place that are annoying so I am trying to use the preferences feature (Computer Configuration\Preferences\Windows Settings\Shortcuts) to delete the unneeded shortcuts. The program has a slight bug in it and I have to fix it, but the publisher hasn't provided an updated msi, just an exe that will apply an update. So I have to a startup script to run the EXE that is supposed to patch the program.

It appears the 'Computer Configuration\Preferences' are applied before software installation happens, because my file deletes don't seem to take effect until after a couple reboots. It appears something about this software package needs a reboot because the startup script that is supposed to patch it errors out until I reboot.

In my searching of Google I haven't been able to find a document that specifically states what the order is. I am also curious what the ordering is between the various preferences available. For example, I can set environment variables via preferences. Will I be able to use those variables in a Files, Folders, or Shortcuts preferences?

I am hoping there is a document somewhere that described the process in detail.

So one of my clients configured one of their switches and the resulting configuration resulted in a duplex mismatch between the switch and a Linux host.

We have fixed the duplex mismatch, but is there an easy way to clear the error counters on the interface without restarting the system?

eth0      Link encap:Ethernet  HWaddr 00:nn:nn:nn:nn:nn
          inet addr:192.168.97.166  Bcast:192.168.97.167  Mask:255.255.255.252
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:630331763 errors:1 dropped:0 overruns:0 frame:0
          TX packets:676081436 errors:1971815 dropped:0 overruns:68637 carrier:1903180
          collisions:7649984 txqueuelen:1000 
          RX bytes:2067682611 (1.9 GiB)  TX bytes:1942809411 (1.8 GiB)

Reverse DNS seems to be strongly tied to class boundaries, what methods exist now that CIDR is the standard to delegate authority for a subnet? If multiple methods exist which one is best? Do you need to handle delegation differently depending on the DNS server (Bind, djbdns, Microsoft DNS, other)? Lets say I have control of a network that is a Class B 168.192.in-addr.arpa please provide examples for:

• How to delegate authority for a /22?
• How to delegate authority for a /25?

• As a system administrator what should I know about the OSI model? (Rec X.200)
• Briefly, what are the layers and what do they do?
• How much do I need to know about in my day-to-day work?
• How does this contrast with the TCP/IP model? (RFC1122)
• Does the OSI model still apply on today's networks?

I currently rsync on a Linux host to copy things from Windows to my Linux box. But I can't copy files with long names.

I have tried DeltaCopy, cwrsync, and cygwin. From what I have found there all of these tools refuse to copy files when the length of the file becomes long, this seems to be somewhere around 255 characters.

This issue is addressed on the cwrsync forums here and it supposedly it may be fixed sometime in the future whenever cygwin 1.7 comes out and UTF8 is supported. There is even a test build here.

I am not particularly comfortable using the test build on a production system. I am hoping someone knows of another rsync option.

As an alternative to rsync do you know of another tool that I can copy a directory structure on Linux from a windows host that will not have problems with long or unusually named files? The important bit is that I need a tool that can easily work across an SSH tunnel. Some of the systems are beyond firewalls, and I believe SSH is the tunnel I will be allowed to use.

When you create some Linux filesystems like ext3 a 'lost+found' directory is created. According to this files will be placed there if files were damaged from some kind of system crash.

What happens if this directory is removed, and the system crashes. If the folder is removed can I just create a new directory with mkdir lost+found or are there attributes that can only be set when the filesystem is being created.

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just fixing the hole that was used to compromise the system.

Given all the various root kit technologies and other things a hacker can do most experts suggest you should reinstall the operating system.

I am hoping to get a better idea why more people don't just take off and nuke the system from orbit.

Here are a couple points, that I would like to see addressed.

• Are there conditions where a format/reinstall would not clean the system?
• Under what types conditions do you think a system can be cleaned, and when must you do a full reinstall?
• What reasoning do you have against doing a full reinstall?
• If you choose not to reinstall, then what method do you use to be reasonably confident you have cleaned and prevented any further damage from happening again.

For testing antivirus we have EICAR, for SPAM, we have GTUBE.

Is there a standard site that is or should be included in blacklists that you can use for testing instead of going to your favorite porn site in front of your boss, the CEO, or someone else who feels that seeing such a site is an excuse for a sexual harassment suit?

Update

This is less about getting permission for me to test, though that answer is useful. I do have both permission and responsibility to actually make sure the filter is running. I am able test the filter is functioning with a netcat.

Instead, I am hoping there is a standard domain name that is blocked by most/all filters for testing. I need to be able to share this with my boss and users.

I need to be able to demonstrate what happens when someone go to a filtered page. I need to have a way to quickly prove to others that the filter is working without asking them to go to some site that will not cause grief if for some reason the filter is not working.

If there isn't already a good domain for this purpose I may simply have to register a domain myself, and then add the domain to all the filters I am responsible for.

So you spend lots of money on nice servers, storage arrays, or network equipment and it works wonderfully for you for years. But after 3-6 years your vendor no longer offers maintenance for the device, but it is still working.

• Under what conditions would you continue using the equipment?
• What factors do you consider when trying to determine the risks associated with continuing to use the equipment?
• If you believe that the risk is to great, how do you convince management to loosen up on the purse strings in a difficult economy?

I manage several Linux servers for clients in several roles like email, caching, web serving, filtering, firewalling/routing, and so on.

Since I don't own these computers and just provide remote support, central management systems like Puppet don't seem like they are the correct tool. (Please correct me if you think I am wrong about this assumption)

What tools do you recommend to track changes of configuration files, package installs and so on?

I am thinking something like etckeeper may be near to what I need, but I want to know if there is something better.

Update

We will have backups of the systems, and I wouldn't expect this type of a tool to be an alternative to a backup. This is about keeping track of changes of configuration and having a system to know what changed when, by who, and hopefully why.

Our old tape drives have failed and we not using tapes for backup anymore. We still have a stack of DLT tapes with backups which may contain sensitive information like credit card numbers, social security numbers, etc.

How do I responsibly dispose of these backup tapes?

If I had a working drive I would be tempted to dd from /dev/urandom to the tape device, but the drives have failed. Would this be a good method if the drive was still working? What do you recommend I do with these tapes given that I have no working drive for them?

The similar question on Stack Overflow, What good technology podcasts are out there?, has lots of answers focused on software development.

What podcasts do you listen to for learning about the following?

• Information technology trends
• Network administration techniques
• Security issues and threats
• Other system/network administration issues.

Summary:

• RunAs Radio
• Security Now!
• Crypto-Gram Security Podcast
• Hak5
• VMWare VMTN
• Windows Weekly
• PaulDotCom Security
• FeatherCast
• Packet Pushers Podcast
• Floss Weekly
• Mind of Root
• Radio Free Security
• IT Idiots
• TechNet Edge
• Network Security Podcast
• Webpulp.tv

What application do you use on windows to create SSH tunnels

On Linux I use gSTM, and on OSX I have used STM, but I am not able to find any similar free tools on windows.

I don't want to use putty, or plink for these tunnels, because, I am looking for something that will sit in the tray starting stopping tunnels can easily be done by right-clicking. Ideally the configuration will be stored in a text file or something so I can automate the install of the app, keys, and tunnel configuration on a computer using a script.

Free is proffered, but please post information about any good windows SSH tunnel manager.