Microsoft

PCI Audit vs Exchange OWA

Leave a comment

See the previous post for more details on the PCI audit. The Exchange server failed due to accepting SSL v2 certificates. V2 can lead to malformed requests and crap out the system. Unfortunately the audit doesn’t see the IPS/IDS that would block these attacks, or the SPAM filter with 443 forwarding that would also thwart such malformed requests. But I digress.

This *should* work with 2003 and 2008, but I’ve only tested on 2003. The system requires a reboot to verify changes.

Fire up regedit
Navigate to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0
Under the registry group “Sever”, create a DWORD value named “Enabled” and verify that the value is set to 0x0.

Found this from Joson Zhou.

Linux

PCI Audit vs Ubuntu Server

Leave a comment

I was in the midst of my first ever PCI audit – the company I was doing work for wanted to start taking credit card orders over their website. I thought it would be easy – the website was a wrap-around of the credit card company’s authorization site, so no numbers ever touched the company-owned systems. Unfortunately the security firm required all external facing IP addresses to test. One of those IP addresses pointed to an Ubuntu 10.04.4LTS system that was running Owncloud software on apache (think DAV for multiple users via web interface).

So the PCI audit returns with a giant FAIL. Apache is out of date!

apache2 -v
2.2.14
This version came out in October of 2009.

So I edited the apt sources list to grab a newer file:
nano /etc/apt/sources.list
And added:

deb http://us.archive.ubuntu.com/ubuntu/ oneiric main
deb-src http://us.archive.ubuntu.com/ubuntu/ oneiric main

apt-get update
apt-get install apache2
apache2 -v
2.2.20
This version came out in August of 2010

Run the PCI compliance test again – FAIL. Apparently they require 2.2.21 or higher. The only issues I could find with 2.2.20 deal with mods being enabled that they don’t use, or .htaccess permissions that they also don’t use. OK, so let’s go up another version.

nano /etc/apt/sources.list
Add:

deb http://us.archive.ubuntu.com/ubuntu/ precise main
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main

apt-get update
apt-get install apache2
apache2 -v
2.2.22
This version came out in January of 2012

I verified the site was still working. Make sure you comment out the sources.list precise and oneiric otherwise you’ll have lots of update issues down the road.

Source generator:
http://repogen.simplylinux.ch/generate.php

Linux

Apache Prompts to Download PHP

Leave a comment

I had just run some simple patching on a test webserver and had some issues with PHP. Ran a few more commands and the problem went away. Until I decided to patch a production server as well.

Basically the update included an apache update, which wrecked the php modules. How do I know this?

Running Ubuntu 10.04.03 LTS
apt-get update
apt-get dist-upgrade
Load website and it prompts to download/save the PHP file instead of displaying the PHP file. Great.

Check if the PHP5 module is activated:
a2enmod php5
apache2ctl restart

Only the restart yielded this:

apache2: Syntax error on line 204 of /etc/apache2/apache2.conf: Syntax error on line 1 of /etc/apache2/mods-enabled/php5.load: Cannot load /usr/lib/apache2/modules/libphp5.so into server: /usr/lib/apache2/modules/libphp5.so: cannot open shared object file: No such file or directory

So just install the module libraries for PHP5:
apt-get install libapache2-mod-php5

This should automatically restart apache, but just for good measure you can do it again to verify there are no more errors:
apache2ctl restart

Linux

Proxmox 1.9 Stopped Backing Up

Leave a comment

Proxmox 1.9 – not fully updated (1.9 build 6542)
Had backups set to backup snapshots of machines every day starting at 2AM. They generally took about 3 hours and would finish by 5AM.

Little did I realize that I was no longer receiving the emails saying “backup successful”. Last one was 4 weeks ago. Whoops doesn’t even start to cover that.

Checking it out it looks like the backup stalled on one of the virtual machines.
ps auxww |grep vzdump
Then just kill any PID that looks like vzdump is running.

Re-run the command to backup either from the GUI or from the command line:
vzdump --quiet --snapshot --storage STORAGE --maxfiles 5 --mailto admin 101 102 103 etc

Microsoft

Check Database Sizes with PowerShell

Leave a comment

Exchange 2007 check the database size with a powershell ps command.

I found this from Mike Pfeiffer’s Blog – thanks Mike.

Get-MailboxDatabase | foreach-object {add-member -inputobject $_ -membertype noteproperty -name mailboxdbsizeinGB -value ([math]::Round(([int64](get-wmiobject cim_datafile -computername $_.server -filter ('name=''' + $_.edbfilepath.pathname.replace("\","\\") + '''')).filesize / 1GB),2)) -passthru} | Sort-Object mailboxdbsizeinGB -Descending | format-table identity,mailboxdbsizeinGB

Networking

Syslog Log ASA VPN AnyConnect

1 Comment

I was recently tasked with logging when users would connect and disconnect from the VPN – I believe the intent is to keep track of hours, but it was proposed as a way to keep track of users in terms of security violations. Either way I needed to come up with a solution.

Here was the setup and results:
ASA5510 with anyconnect VPN licensing
Windows RADIUS (via ISA Services) for authentication
All ASA connect requests were logged via the eventviewer on the Windows RADIUS server
Disconnects or timeouts were not logged on the server

So I had half of the equation, just needed to capture and log the disconnects as well.

Unfortunately, the RADIUS only requires authentication. There was no “hey please give me permission to disconnect” going on. Lucky for me I also have a kiwi syslog server running on the premises. Kiwi free, in case you’re wondering.

So just set the ASA to send syslog data to your syslog server, and parse out the following Message IDs (for your anyconnect client. Other clients including ipsec will have different numbers)
722022: Connect
722023: Disconnect

Microsoft

Exchange 2007 Error Updating Free/Busy Information

Leave a comment

Exchange 2007 server was getting error eventID 8207:

Error updating public folder with free/busy information on virtual machine SERVERNAME. The error number is 0x80004005.

This is generally caused when you upgraded from 2000/2003 and didn’t put in replicas for the old email groups.
You can find out by opening the powershell and running the following:
Get-PublicFolder -Identity "\NON_IPM_SUBTREE\SCHEDULE+ FREE BUSY" -Recurse | fl name,Replicas

In my case I got

Well I had my Back-End Admins group (the one from exchange 2003) had a Replicas {} listed. The screen shot shows what it *should* look like.

To fix, just copy the FB information to your current public folder database:
Set-PublicFolder -Identity "\NON_IPM_SUBTREE\SCHEDULE+ FREE BUSY\EX:/o=lkj/ou=Back-End Admins" -replicas "EXCHANGESERVER\Second Storage Group\Public Folder Database"

And then, if you’re not a patient person, run outlook via the following:
outlook.exe /cleanfreebusy

Ramblings Of An IT Person