Month: January 2018

SSL 3.0 is insecure and should be turned off on any IIS web server. Here’s how to disable it through the registry on Windows Server 2008 R2 or 2012. For background, see the SSL 3.0 information disclosure vulnerability.

Step-by-Step

1. Open the Registry Editor as administrator: on the Start screen type regedit.exe, right-click it, and click Run as administrator.
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
   
3. Right-click Protocols and click New > Key. Name the key SSL 3.0.
   
4. Right-click the new SSL 3.0 key, click New > Key, and name it Client.
   
5. Right-click SSL 3.0 again, click New > Key, and name it Server.
   
6. Under SSL 3.0, right-click Client, click New > DWORD (32-bit) Value, and name it DisabledByDefault.
   
7. Double-click DisabledByDefault, set Value data to 1, and click OK.
   
8. Under SSL 3.0, right-click Server, click New > DWORD (32-bit) Value, and name it Enabled.
   
9. Double-click Enabled, leave Value data at 0, and click OK.
   
10. Restart the server.

SSL 3.0 is now disabled. To confirm it, see this quick way to test for SSLv3.

If you’ve forgotten the password for the super admin account on an RSA SecurID Authentication Manager appliance, you can recover by creating a temporary super admin account (for example, tempAdmin) from the command line, then using it to reset the original account’s password.

Create a Temporary Super Admin

Run the super admin restoration utility from the CLI or a serial console:

1. Log in with the emcsrv account and enter its password when prompted.
2. Switch to root, entering the password when prompted.
3. Change to the directory that holds the restoration utility and create the temporary account.

% sudo su
% cd /usr/opt/rsa/am/utils
% ./rsautil restore-admin -u [tempadmin_name] -p [password]

Enter Master Password: **********
A temporary admin will be created with the user ID 'tempAdmin'.
Are you sure you want to continue (Y/N): Y
Admin created successfully.

• [tempadmin_name] is the temporary super admin account to create.
• [password] is the password for that temporary account.

Reset the Original Password

4. Log into the Security Console with the temporary account.
5. Go to Identity > Users > Manage Existing and search for the super admin account whose password needs resetting.
6. From the context menu, select Edit and scroll to the Password section.
7. Enter the new password for the super admin account and click Save.

Note: The temporary super admin account expires after 24 hours.

Oh yeah, I got it working! I installed the Jetpack plugin on my WordPress site to connect it with Facebook, and with Google+ too, so new posts are shared to both automatically.

Symptoms

In VMware Horizon View 5.3, the View Administration dashboard reports Server’s certificate cannot be checked, and:

• The Connection Server shows a red status.
• The Security Server shows a red status.
• Clicking the Connection Server shows: Connection Server certificate is not trusted.
• Clicking the Security Server shows: Server’s certificate cannot be checked.
• External connections through the Security Server still work, and the certificates on the servers are valid.

Cause

The certificate’s Certificate Revocation List (CRL) includes a URL that the Connection Server paired with the Security Server can’t reach.

Resolution

Make sure the Connection Servers paired with Security Servers can reach the CRL URL. This usually means allowing it through the proxy server, if your environment uses one to control Internet access.

Workaround: CertificateRevocationCheckType

If you can’t open access to the CRL, create a CertificateRevocationCheckType registry string. Before changing the registry, make sure you have a current backup of the registry and the virtual machine (see Microsoft article 136393). If you run multiple Connection Servers, make this change on all of them.

1. On the View Connection Server, open HKEY_LOCAL_MACHINE\Software\VMware, Inc.\VMware VDM\Security. Make the change on the Connection Server, not the Security Server.
2. Create a string value (REG_SZ) named CertificateRevocationCheckType and set it to 1.

I know this one is really, really old, but I was asked about it the other day and wanted to keep it here for future reference.

The Problem

When a Windows XP computer boots, you want it to always log into a specific user account, and you want that account to run an executable other than Windows Explorer (explorer.exe), such as a LabVIEW application. This is known as kiosk mode.

Kiosk mode is useful for a dedicated computer or user account that should boot straight into one program. It also restricts the user’s access to the rest of the computer. Setting it up takes two registry changes: automatic logon, and a custom shell for the account.

Step 1: Log In Automatically to a Specific Account

This change is made in the Windows Registry, so work carefully.

1. Click Start » Run, type regedit, and click OK.
2. Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
3. Double-click DefaultUserName, enter the name of the account to log into automatically, and click OK.
4. Double-click DefaultPassword, enter that account’s password, and click OK. If there is no DefaultPassword entry, create it: go to Edit » New » String Value, name it DefaultPassword, press Enter, then double-click it and enter the password.
5. Double-click AutoAdminLogon, set its value data to 1, and click OK. If there is no AutoAdminLogon entry, create it the same way as a String Value named AutoAdminLogon with the value 1.
6. Close the Registry Editor and restart the computer (Start » Shut Down » Restart).

Note: If no DefaultPassword string is specified, Windows XP automatically changes AutoAdminLogon from 1 (true) to 0 (false), which turns automatic logon off.

Step 2: Replace Explorer with Your Own Executable

1. Log into the user account that should boot into kiosk mode.
2. Click Start » Run, type regedit, and click OK.
3. Browse to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
4. Go to Edit » New » String Value and name it Shell.
5. Double-click the new value and enter the path to the executable to run instead of explorer.exe, for example C:\LV Startup\MyLabVIEWVI.exe.
6. Log out of the account and log back in.

Together, these two settings make the machine skip the logon screen, sign into the chosen account, and run your executable instead of Windows Explorer. For a LabVIEW executable, you can also tune its VI Properties: set Position to Maximized in the Window Run-Time Position category so it fills the screen, and adjust the Window Appearance category so users can’t close or resize it.

Tip: Getting Back to the Registry Editor

Once the shell is replaced there’s no Start menu. To change the executable later, press Ctrl+Alt+Delete and open Task Manager, choose File » New Task (Run…), type regedit, and click OK.

Related: autologin for Windows Server.

While setting up a new SuiteCRM service, I found these PHP notices repeating in my Apache error log:

PHP Notice: Undefined index: custom in /var/www/html/themes/Suite7/css/colourSelector.php on line 95, referer:
PHP Notice: Undefined index: modlink in /var/www/html/themes/Suite7/css/colourSelector.php on line 70, referer:

I’m fairly sure they started because I changed the colors in the Suite7 theme (the color selector is a really neat way to customize the theme), though they probably appear with the standard theme colors too.

The Fix

Add these two lines to /var/www/html/config_override.php:

$sugar_config['colourselector']['modlink'] = 'EEEEEE';
$sugar_config['colourselector']['custom'] = 'EEEEEE';

With both keys defined, the notices stop appearing in the log.

By default, Storage vMotion does not rename a virtual machine’s files when it moves them. If you’ve renamed a VM and expect a Storage vMotion to bring the folder and file names into line, you need to add an advanced setting in vCenter first.

Enable File Renaming in vCenter

1. Go to Administration.
2. Click vCenter Server Settings.
3. Click Advanced Settings.
4. Add the key provisioning.relocate.enableRename with the value true, then click Add.
5. Restart the vCenter service or the vCenter Server.

Storage vMotion will now rename the files during the move again. If your team relies on this behavior, make sure the setting is added on every vCenter you manage.

Today my vCenter task bar started filling up with errors from VMware View’s daily maintenance, complaining that it couldn’t wipe a Flex-SE virtual disk:

Wipe a Flex-SE virtual disk  vmPC-019  A general system error occurred:
Wipe Disk failed: Failed to complete wipe operation.

The Cause: Changed Block Tracking

It turned out that our vRanger backup solution had enabled Changed Block Tracking (CBT) on these virtual machines, and View’s Flex-SE disk wipe doesn’t work with CBT turned on.

The Fix

Right-click each View desktop VM and disable Changed Block Tracking. Once CBT is off, the wipe errors stop.

This VMware Knowledge Base article helped me work out what was going on: VMware KB 2039907 (archived copy).

When an Astaro (Sophos UTM) Security Gateway runs its web proxy in standard mode, every browser has to be pointed at the proxy. With more than a handful of computers, configuring each one by hand isn’t practical, and static settings cause other problems: laptops need the proxy in the office but not on the road, some websites break when proxied, and you may want internal sites to skip the proxy entirely. The answer is a dynamic proxy configuration.

Use the Web Proxy Auto-Discovery Protocol (WPAD)

WPAD is widely supported by all major browsers and lets administrators push dynamic proxy policies to users. At its core is a configuration script, usually named proxy.pac or wpad.dat, containing one JavaScript function, FindProxyForURL. The browser calls it for every URL and it returns whether to use a proxy, and which one, based on the site or the client’s network location.

Sample PAC Script

This example covers the two most common needs: skip the proxy for certain domains, and use the proxy only when the client is on specific networks. Lines starting with // are comments.

function FindProxyForURL(url, host)
{
  // The following domains will not be proxied
  if (dnsDomainIs(host, "domain.com")
      || dnsDomainIs(host, "company.com")
      || dnsDomainIs(host, "intranet.mycompany.com")
      // Add new domains by customizing the line below:
      || dnsDomainIs(host, "your.domain.here"))
    return "DIRECT";

  // If the client is on one of these networks, use the proxy
  if (isInNet(myIpAddress(), "192.168.0.0", "255.255.0.0"))
    return "PROXY 192.168.0.1:8080";
  if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0"))
    return "PROXY 192.168.0.1:8080";

  // Add new networks by customizing and uncommenting these lines:
  // if (isInNet(myIpAddress(), "172.16.1.0", "255.255.255.0"))
  //   return "PROXY 192.168.0.1:8080";

  // Clients on any other network connect directly
  return "DIRECT";
}

Save the script as proxy.pac or wpad.dat and host it on a web server every workstation can reach. Google’s pactester tool (originally at http://code.google.com/p/pactester/) is handy for testing a script if it isn’t behaving.

How Browsers Find the Script

Browsers offer two automatic options. Either works.

A) Automatic configuration script URL (“Automatic proxy configuration URL” in Firefox, “Use automatic configuration script” in Internet Explorer). The simplest option: enter the full URL of the script, such as http://www.mydomain.com/proxy.pac. The browser downloads it at launch.

B) Auto-detect (“Auto-detect proxy settings for this network” in Firefox, “Automatically detect settings” in IE). The browser discovers the script on its own in one of two ways:

• DNS (most common): create a DNS record named wpad in your clients’ default domain, pointing to a web server with wpad.dat in its root. If the clients’ domain is internal.mydomain.com, browsers will request http://wpad.internal.mydomain.com/wpad.dat.
• DHCP: configure DHCP option 252 as a text option containing the script URL. Clients receive it with their DHCP lease. This is less common and not every DHCP server supports custom options.

Rolling the Setting Out to Browsers

Whichever method you pick, each browser may still need its setting changed. Here are three approaches.

1. Ask users to make the change. Where users can change their own settings, a clear email with simple instructions works surprisingly well, even for non-technical staff. For example: “Two weeks from today, we’re making a firewall change that requires a browser setting. Without it, you won’t be able to browse the web after the cutoff, but you can make the change any time before then. Please follow these simple instructions…”

2. Active Directory Group Policy. AD administrators can push proxy auto-configuration to Internet Explorer on every domain-joined Windows machine from a central GPO, for users, OUs, or the whole domain. Firefox can be managed the same way with third-party tools: the free FirefoxADM and Wetdog projects provide ADM templates (applied through login scripts or an executable), and FrontMotion offers commercial Firefox MSI packages that read Group Policy settings.

3. Login scripts. This also works in other environments, such as Novell eDirectory. For Internet Explorer, distribute the settings as a registry file, either hard-coded proxy settings or the auto-configuration URL. Include only the lines you need:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000001
"ProxyServer"="10.129.0.1:8080"
"ProxyOverride"="*.local;<local>"
"AutoConfigURL"="http://192.168.0.1/wpad.dat"

Save it as proxy.reg and merge it silently from a login script:

regedit.exe /s proxy.reg

Related: creating a PKCS12 certificate for Sophos UTM 9.