all y0ur b0x3n ar3 b3l0ng t0 m3

WSUS for Organized Microsoft Updates

Monday, September 7, 2009 by Dereck Martin

After implementing Squid for caching, I noticed how much Windows Update went out to download updates for the various machines. This lead me to quickly implement WSUS and GPO for installing updates from our network. WSUS is one of the few large applications that one can get absolutely for free from Microsoft. It really helps with organizing updates. I now have the task of approving over 600 updates.

Squid cache to the resue

Monday, September 7, 2009 by Dereck Martin

I implemented a squid cache the other day for everyone. Everyone in the company mainly access only a hand-full of websites a day. The caching proxy allows us to conserve bandwidth by grabbing data locally from our network first. Through my testing it has significantly improved the load times of AJAX rich websites (like gmail) and other content rich websites. I recommend implementing one regardless the size of a company.

Windows 2008 guest and vmware

Friday, March 6, 2009 by Dereck Martin

Apparently there is a memory leak in the VDS.exe process for Windows 2008 guests in vmware. I have included the link to the article for obtaining the hot-fix. It requires filling out a form and the link for the actual hot-fix is sent via email.

You will know if you have this memory leak, the VDS.exe process will consume all available memory over time. Some have reported seeing the process consume 7GB of memory.

support.microsoft.com/kb/958387

Unifying Authentication with freeRADIUS - Part I

Wednesday, March 4, 2009 by Dereck Martin

How does one unify authentication for various technologies across a mixed operating system environment and deploy it transparently to users?

Well, I have decided to use freeRADIUS as the entry point for our roaming wireless and vpn authentication. freeRADIUS then passes the credentials on to Active Directory for authentication. In this part, I will be focusing on getting the box authenticating against Active Directory and the installation of freeRADIUS.

In order for this to work, a Linux box needs to be setup with samba and winbind to work nicely with Active Directory. If you are experienced with this setup, it can be done in as little as 30 minutes.

I have a basic configuration file for samba that should work with a Windows 2003 Active Directory domain for nearly anyone.

 [global]
        security = ads
        netbios name = server01
        server string = server01
        workgroup = DOMAIN
        realm = DOMAIN.COM          # ip of active directory server
        password server = x.x.x.x

        idmap uid = 10000-29999
        idmap gid = 10000-29999

        winbind separator = +
        winbind enum users = yes
        winbind enum groups = yes
        winbind use default domain = yes
         # You will need to create /home/DOMAIN if you plan to allow                   # user to log-in, and setup pam.d stuff
        template homedir = /home/%D/%U
        template shell = /bin/bash 
        client use spnego = yes
        domain master = no
         # ip of wins server
        wins server = x.x.x.x 
        encrypt passwords = yes
        server signing = auto
        name resolve order = wins host bcast

There is also a krb5.conf file that needs to be edited as well.

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = DOMAIN.COM
 dns_lookup_realm = true
 dns_lookup_kdc = true
 ticket_lifetime = 24h
 forwardable = yes

[realms]
 DOMAIN.COM = {
  kdc = x.x.x.x:88
 }

[domain_realm]
 .dnsdomain.DOMAIN.COM = DOMAIN.COM
 DOMAIN.COM = DOMAIN.COM

[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }

You will also need to setup /etc/nsswitch.conf as well.


passwd:     files winbind
shadow:     files winbind
group:      files winbind
protocols:  files winbind
services:   files winbind
netgroup:   files winbind
automount:  files winbind

After these three files are setup and tuned to your environment, then start the samba service with /etc/init.d/smb start.

HINT: make sure time is synced within 5mins of the Active Directory server or things tend to break.

The only thing left to do is join the box to the domain. The command below should be sufficient to do this. You will need to make sure this machine has a static ip address, and it should have a A record and ptr record in DNS for the hostname of the box. If not, Active Directory may complain about it with a cryptic error message.

#~> net join -U Administrator

Once that is complete and there are no errors, start winbind. On some Linux distributions the winbind init script is apart of the samba init script (like Gentoo).

#~> /etc/init.d/winbind

You should be able to do a wbinfo and get something like below:

#~> wbinfo -a username%password
plaintext password authentication succeeded
challenge/response password authentication succeeded

After this is working, then its time to install freeRADIUS. I would heavily recommend installing from your distribution's package management system. This is a common application, and should be available for the big distributions.

There is one thing that will need to be done in order to get freeRADIUS to work nicely with winbind. If this is not done, then radius will not work right.

#~> cd /var/cache/samba/winbindd_privileged/
#~> setfacl -m u:radiusd:rx winbindd_privileged

Note: on some distributions, "acl" needs to be added to /etc/fstab. ACL options for the file system type need to be included in the kernel configuration. On systems like CentOS and OpenSuSE this shouldn't be a problem.

In the next part coming soon. I will discuss how to configure radius for EAP/PEAP authentication for wireless networks.

The Woes of G2M3

Saturday, February 21, 2009 by Dereck Martin

For those that do not know, G2M3 is a special video codec used by GoToMeeting and GoToWebinar for recording. It is only playable in Windows Media Player and there is suppose to be a plug-in for Quicktime under MAC. It has caused so much frustration these past few weeks in a task I was assigned.

We implemented a new video help section, and we had an archive of old GoToMeeting recorded sessions. The videos were all in WMV format utilizing the G2M3 video codec.

None of the video converters available for WMV to FLV (flash video) could handle the video codec properly. Most would fatally crash. That is where the adventure began in finding a way to convert G2M WMV video files into something that was more exportable.

The first thing I tried was ffmpeg since it can handle almost anything. It failed immediately when trying to convert it. At least it was nice enough to give me a reason why. It said the video stream was unsupported.

Stream #0.2: Video: G2M3 / 0x334D3247

After trying several converters, I had almost given up. Until I dug deep into Google searches and came up with a post that shed some light on how to fix the problem. It appears the most converters do not interface with some back-end Windows Media Player functionality to decode the video of some WMV codecs during conversion. I did find something that did, and that was a utility called Windows Media Encoder.

WME was designed to stream Windows Media out to a Windows stream sever, but it can re-encode WMV using standard Windows Media 9 video and audio codecs. It is also free download and use.

This was not the end of journey for this task. The FLV converter we use does apparently support one of the Windows Media 9 codecs. It supports newer WMV codecs, just not the old codecs. I had to re-encode the WMV to another more suitable format.

I chose to just convert the WMV into MPG with the aid of TMPEGenc. This software is also free to use as long as MP2 encoding it not the main goal. After all these old video files were converted to MPG format, our FLV converter worked.

The lesson in this situation is to set the GoToMeeting settings to record in standard WMV format not the Default G2M3 Format. After testing, I found out the standard WMV works fine with our FLV converter.

I hope this helps anyone out there who plans on using G2M for any sort of video tutorials in SWF or FLV format. I should also note that Citrix is aware that the G2M3 is incompatible with Linux and any Windows or Mac box that does not have this codec installed. Keep that in mind when you use the product.

Importing certificates made easy.

Friday, February 13, 2009 by Dereck Martin

This tool has made my life much easier...

It allows me to import p12 client certificates onto machines. This will be used for the certificate based wireless we will be migrating to soon. With out this utility, I would have to manually touch each machine to install it.

http://www.symantec.com/community/forum/5172/install-p12-certificate-silently