2015. július 28., kedd

Ugly bug in Draytek Vigor firewall?

One day I came across a unique error. A client reported that they were unable to query any nameserver outside their network, except for the case they query standard A records. So, A records worked fine but, e.g. NS or MX records failed with timeout. Local DNS servers was properly set with valid forwarders.
So, we experienced:
nslookup    
Default Server:  dc01.hq.local           
Address:  192.168.80.248                                                                 

> google.org
Server:  dc01.hq.local                   
Address:  192.168.80.248

Non-authoritative answer:                       
Name:    google.org                             
Address:  216.239.32.27                                                                         

> set type=mx 
> google.org                                 
Server:  dc01.hq.local                   
Address:  192.168.80.248                                                                       

DNS request timed out.                              
timeout was 2 seconds.                      
*** Request to dc01.hq.local timed-out   

> server 8.8.8.8                                   
Default Server:  google-public-dns-a.google.com           
Address:  8.8.8.8        

> google.org                            
Server:  google-public-dns-a.google.com        
Address:  8.8.8.8

DNS request timed out.                              
timeout was 2 seconds.                      
*** Request to google-public-dns-a.google.com timed-out      

What a riddle! Guess that! :)
After three hours it turned out that in their Vigor 2925 firewall router there was a built-in rule called "xNETBios > DNS" in the section called "Data filter" (very informative names by Draytek guys, phuhh). That blocked such special DNS queries - even if it was DISABLED!
Default factory settings

Factory settings


In the end I had to disable the entire Data Filter section - in that way, external DNS queries got to work as expected. I'm still unable to find any explanation for this.

Model Name : Vigor2925n
Firmware Version : 3.7.6
Build Date/Time : Nov 17 2014 17:20:57
Working

That's the screen you never want to see on your FSMO roles holder DC!

Windows failed to boot

2015. július 17., péntek

OpenVPN and eToken5100 SafeNet token

SafeNet ePass USB token is a PKI authenticator tool. It's fully supported in, of course, Windows operation systems and, also, in Linuxes. A neat but expensive toy. It also can be used with OpenVPN. With Windows. But you will never find any documentation on how to make these two guys work together in Linux! Except for this blog. Follow these steps on a Debian/Ubuntu system: (this worked in a 12.* Ubuntu+Gnome, not tested with newer ones.)
apt-get update
apt-get upgrade
apt-get install openvpn libhal1 hal-info
unzip the stock driver, unzip the .iso and find your proper .deb or .rpm version. In my case, I installed:
dpkg -i SafenetAuthenticationClient-9.0.43-0_amd64.deb
Run your client tool to check if the token works (and you know your password):


Make your sudo system unsecure, lol: (only this line needs to be modificated)
%sudo    ALL=NOPASSWD: ALL
This is needed because we want to use a simple way to run openvpn by root privileges. Don't forget to restart sudo. And here comes the tricky part. Find the hardware id of your token in the command line with:
openvpn --show-pkcs11-ids
Then, your client.config must look like this: (only the bold lines matters:)

client
dev tun
proto udp
remote your.server.com 2001
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
ns-cert-type server
comp-lzo
verb 3
script-security 2

# for the sake of proper DNS working
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

# this is the connection with the token
pkcs11-providers /usr/lib/libeTPkcs11.so

# your ID goes here
pkcs11-id 'EnterSafe/PKCS\x2315/0250184313021110/ftsafe\x20\x28User\x20PIN\x29/5F4DD36B4A23533FC9BDBB2AC7372236E48F99E5'
or, for example:

pkcs11-id 'SafeNet\x2C\x20Inc\x2E/eToken/0223127c/John\x20token/FC67BBDD7AD8EACD'

Important: don't run the openvpn as a service because you won't see the authentication promt! Instead, in a command line do:
/usr/sbin/openvpn --config /etc/openvpn/client.conf
Entering password
Succesfully typed and connected, you will see:
Connected
Do not close this terminal x-window because the vpn process will die immediately. But the tun interface somehow remains up, so you had better create a "stopopenvpn" script and use it to clean up the processes and interfaces. In my case, that was a
x-terminal-emulator -e "sudo su -c /bin/vpndown"
command, the it called this simple vpndown script in a new window
#!/bin/bash
echo "Please wait..."
killall -9 openvpn
sleep3


The VPN started with a user friendly desktop icon:
x-terminal-emulator -e "/bin/vpnup"
command. That called:
#!/bin/bash
if $(ifconfig|grep tun); then echo "OPENVPN already started, please stop it first. (click -> stopvpn)"
sleep 5
exit 1
fi
sudo su -c "/usr/sbin/openvpn --config /etc/openvpn/client.conf"
echo "Closing interface......"
sleep 5  

The funniest part is the echo Closing interface because that runs only if the openvpn itself is already terminated by the stopvpn in the other window. That is an elegant way to keep the user informed what's going on.
An alternative way to make the connection up without typing anything could be done by the help of the interactive shell expect:
apt-get install except
cat startvpn
#!/usr/bin/expect
spawn sudo su -c "/usr/sbin/openvpn --config /etc/openvpn/client.conf"
expect "Enter John token Password:\r"
send "MyL1ttleP4ssword\r"
interact

2015. július 15., szerda

Living with IPFire (bye-bye pfSense)

In the first part of this article I discussed some interesting facts about pfsense. I, again, strongly recommend not to use pfSense 2.2.* in production environments because it is a totally unreliable and buggy system. Okay but what to use then ?
For instance, one can choose IPFire. Yep, I did. It's rock solid, lightning fast and easy to use system. Everything that can't be told about pfSense. I like it.
Except for one minor thing... And that thing is, sadly, not that minor.
For anyone who is familiar with standard iptables chains and logic (I mean input/output/forward/etc) it's very confusing the way pfsense and IPFire virtually handles the traffic.
IPFire consists lots of built-in chains that can be troublesome at the first glance. But you will never get to know about those ones if you use only the GUI based rules editor. I've spent 3 days, frankly, on creating some very basic allow and deny rule on the red0 interface, without any success. That totally screwed me up. You can just never be sure where (I mean, which chain) your web edited rules will be put in. E.g. below shown rules are all faulty, God knows why.
Playing with basic IPFire rules

So I ended up with editing the /etc/sysconfig/firewall.local file and tadaaam, that worked. If you are an expert on iptables, forget your firewall fancy GUI editor forever.

case "$1" in
  start)
        iptables -A CUSTOMINPUT -d 255.255.255.255 -p udp --dport 7437 -j DROP
        iptables -A CUSTOMINPUT -i red0 ! -s 192.168.1.1 -p udp -j DROP
        ;;
  stop)
        iptables -D CUSTOMINPUT -d 255.255.255.255 -p udp --dport 7437 -j DROP
        iptables -D CUSTOMINPUT -i red0 ! -s 192.168.1.1 -p udp -j DROP
        ;;


Just a small side note: reloading the rules with the GUI also reloads your .local defined rules.

2015. június 29., hétfő

Linux facl minihowto

First step is
apt-get install acl
Allowing members of other groups the full access to a directory, resursively:
setfacl -m d:g:groupname:rwx -R path/foldername
d means default so modifying the default ACL results that all of newly created files and directories will inherit this setting.
Modify the permissions of existing files and directories only [not the default]
setfacl -m g:groupname:rwx foldername

Important notes regarding files: Files can't have default ACL because they can't have child objects. An access ACL for an individual file can override the default: if a file has a special ACL that conflicts the inherited ACL, the file ACL wins: owerwrites the inherited default one.
Clearing an ACL, e.g.:
setfacl -x u:johnny /path/folder
 

2015. június 25., csütörtök

Failed Windows Update = Faulty Domain Controller Windows 2012 =Restart loop = Dead Exchange 2013

To be continued



Get-ExchangeServer –Identity <server_name> -Status | FL

set-exchangeserver -identity servername -staticexcludeddomaincontrollers: oldservername

How to change domain controller name that exchange sees

  https://technet.microsoft.com/en-us/library/jj592690.aspx

 
nltest /dsgetsite
DSGetSiteName failed: Status = 1919 0x77f ERROR_NO_SITENAME
nltest /dsgetdc: FQDN of your domain  


From regedit; drill down the following:
HKLM\System\CurrentControlSet\Services\Netlogon\Parameters
Once you click Parameters, add a string word called “SiteName
as written here https://messagingschool.wordpress.com/2014/04/18/dsgetsitename-failed-status-1919-0x77f-installing-exchange-2013-sp1/

 
Get-ClientAccessServer | Test-MRSHealth



-StaticExcludedDomainControllers
https://technet.microsoft.com/en-us/library/dd298163%28v=exchg.150%29.aspx

--

import-module addsdeployment
uninstall-ADDSDomainController -ForceRemoval:$true -Force:$true
https://technet.microsoft.com/en-us/library/jj574104.aspx
http://sysadminconcombre.blogspot.hu/2014/03/scenario-my-test-lab-consists-of-3.html
http://chinnychukwudozie.com/2014/01/27/using-ntdsutil-metada-cleanup-to-remove-a-failedoffline-domain-controller-object/

Finally, check if your DC is really gone:
Detailed list:
Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))"
another method to the same detailed list:
Get-ADDomainController -Filter * | Select-Object name
or a simple list:
Get-ADGroupMember 'Domain Controllers'
(note: 'Domain Controllers' string is localized into your language)

2015. június 16., kedd

Adding CSVs on Windows 2012 R2 Hyper-V Failover Cluster

In the first part of this article I have added some physical and virtual disk to my Dell iSCSI storage. Of course new vdisks do not appear immediately in the failover cluster manager console.
 
So I opened up my disk management console on my hyper-v host.
 

As you can see a new raw disk appears. We should bring it online, initialize, format and provide the disk a descriptive name.


.. and try to add it again by the FCM console - this time surely with success. But this is going to be only an "available storage" - still needs to be added to the failover role.
 
It's a good practice to rename the new disk to ease further identification and error hunting.

Voila, the new clustered virtual disk is ready to host my new VM's image files, you know the .vhdxs and so on.