Chris May

So today I went to make some firewall updates for a client and the Cisco PDM wouldn't launch from the browser.

After some troubleshooting, I found that the Java VM was indicating an ArrayIndexOutofBoundsException had occurred.

After some checking around I confirmed my suspicion: Java sucks.  Just kidding, well not really, but what I really confirmed was that the PDM wouldn't work with any new version of Sun Java.  I guess I'm spoiled with .Net being backward compatible. 

Some suggested installing an old version of Java
http://java.sun.com/products/archive/j2se/1.4.2_03/index.html

But lucky for me I was able to just install Java 6 Update 15 and Java 6 Update 7 from Add/Remove programs and everything started working again.

It's totally true when people accuse MS of copying Java with the .NET framework, but they sure didn't make it suck like Java.

UPDATE: The version of Java that is working for me is Java 6 Update 6.  You can download it here:
http://java.sun.com/products/archive/j2se/6u6/index.html

Earlier this morning my site got hacked by someone who put up a new home page demanding a stop to the war in Israel.

Great...

So some quick looking around quickly showed that, by default, my hosting company had enabled WebDAV, a long with a dozen other things.  WTF.

So who is worse, me for not checking this stuff, or my hosting provider for turning this crap on by default.

I think they are worse.  Way worse.

You may notice that your clipboard will sometimes work over RDP(TS) sessions, but sometimes not.

Normally the problem is that the server has clipboard access disabled.

Just follow these instructions to enable it

1. Log into the TS (on an account that has administrator rights)
2. Run the Terminal Services Configuration program
3. Select the Connections folder (under Terminal Services Configuration on the left window pane)
4. Right-click on the RDP-tcp connection (in the right window pane) and select Properties.
5. Click the Client Setting tab
6. Un-tick the Clipboard Mapping option under the Disable the following: heading.

Presto.

D-Link has a nice feature on their website that really helps people like me when I am trying to support a client who users one of these devices.

Normally when I am supporting someone I login remotely so I can view their screen and make the changes for them right there on their computer.  But if their router is down, they usually can't get internet access to allow for this to happen.

So, it can be pretty difficult to talk to someone on the phone with stuff like "Ok, do you see anywhere on the screen where it talks about setting up PPPoE information?  Maybe something regarding WAN connectivity?" 

But, if you get their D-Link model number, you can go to the device page on DLinks website and launch an emulator of their web interface.

For example: http://www.dlink.com/products/?pid=530
Click on "Emulator" on the right hand side.

This allows you to see the exact same screen they are looking at.  It also allows you to click around to find the right page w/o asking them to click every link and read you ever bit of info. 

It's a great tool, and it probably saved me an hour of time with one of my clients today.

Microsoft appears to be ready to offer a windows based service similar to Amazon's ec2.

I am not sure that I would make much use of this type of service, as I am looking for something more like GoGrid or Mosso (which I wrote about a few days ago).

Should prove to be very interesting...

I know what you are thinking...

Setting up WPA on an AP is so easy even my mom could do it!

Well, Cisco APs give you 1001 options and no clear way of setting up WPA-PSK.

To configure these devices here is what you need to do:

1) Express Security: Setup the SSID with Encryption of "None" and not WPA (yea I know...).

2) Under Security\Encryption Manager, select to use a Cipher and pick the option for TKIP.

3) Under Security\SSID Manager, select your SSID, and then pick "Open Authentication" with "No Addition".  Then change Key Management to "Manditory" and select the "WPA" checkbox.  Enter a WPA Pre-Shared Key.

I ignored the other billion options.

 

Have I mentioned how much I don't like working with Macs?

I have some friends who like them, so I won't go as far as some Mac fanboys to claim that Macs suck and everyone is better off with an XP computer (but that is pretty much how I feel).

I bought a Mac for my wife a year ago, because at school there are still people emailing around clarisworks files, and from time to time we want to do something that would require accessing a shared folder on the network.

Problem is: it never works.

"The alias ServerName could not be opened because the original item cannot be found"

Searching google turned up 101 different ways to connect to a network share, and they all failed in different ways.

Last nigiht I found myself trying to get it to work once again, but this time I happened across a solution.

After hours of wasting my time, I finally found the solution here.

Windows 2003 Servers encrypt their communications, Macs can't deal with this.  Problem solved.

Ever had some DNS problem and you wished you could just connect to a different DNS server for testing reasons?

I recently found out from my friend Pat Wirtz (yes the Pat Wirtz of Notre Dame lore and legend) that you can use these 2 public DNS servers:

4.2.2.2

4.2.2.1

That's all.

With Windows Servers, you can setup a cluster using built in Network Load Balancing.

The interesting thing about doing load balancing via software, is that once you get up around 4-5 servers, you stop gaining in performance when you add new machines, because of the added overhead associated with mainting N number of new relationships between the servers.

Also, if you use NLB and you set them up to not use any type of server affinity (i.e. a users request might hit any of the servers at any time) you will pay a serious penality if you are using SSL because each new request to a new server will require a new negoation of the SSL credentials.

The other day I was helping a client of mine who was having some problems getting a user setup as the local administrator on a laptop.

When I went to add the user, the "From this location:" option only showed the local computer name, not the domain.

The computer WAS on the domain, so what was going on?

Well it turned out that a new router had been put in on that subnet, and the DHCP on the router had started handing out IP addreses.  Those IPs didn't have the DC as the DNS server, which is something that is needed in order to allow computers to figure out where company.local is really located.

After changing the DNS server to be the DC and not the router, everything worked as expected.

Sometimes you might need/want to know what ports on your machine are being used.

If you try to start up a process listening on some port and it reports that the port is alread in use, what do you do?

The answer is to use this command:

netstat -a -n -o

This will show you all port activity including the PID so you can open up task manager and find which process is using which port.

I have written a few programs in .Net that utilize Active Directory (AD), and what a pain it was.

Here is an article where the author created classes to encapsulate some of the objects in AD, which is pretty similar to what I did.

Keywords: LDAP, AD, Active Directory

I was recently at a client reconfiguring some of their access points (Cisco 1100).  I was having trouble connecting to one of the new devices.

After some clicking around, I noticed that, by default, the wireless radio is disabled.

This is not totally apparent as you are setting up the network (it is in a different section of the web config utility).

So yea... it helps to enable the radio. :)

At Walsh Construction, we have a service that filters out our spam.  This company is called mxlogic. 

They really do a good job in my opinion.  Since we switched over to using them, I am no longer worried about giving out my email address b/c I know that spam will most likely not reach my inbox.

Now, it looks like Microsoft is going to offer a similar service:  http://www.microsoft.com/exchange/services/buy.mspx

I might want to look into this for some of my long lost email addresses.

I have been researching ways to reset a domain admin password for a client who forgot what they typed in when they set the password.

Most password crackers work only on local accounts, not for anything on a domain.  It seems like the way to go about this is to reset the local admin account, then login using Directory Service Recovery Mode to reset the domain admin account.

Here are some of the articles I have been reading:

http://www.jms1.net/nt-unlock.shtml  <-- this idiot won't let you view his pages if you are running IE, so use firebox, but again, that's just stupid

http://www.nobodix.org/seb/win2003_adminpass.html

http://home.eunet.no/~pnordahl/ntpasswd/

http://www.loginrecovery.com/about.html

http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm

 

I recently started getting some soft bounces coming back from Yahoo. 

I believe that this is a "greylisting" operation on their part:  "Message delivery has been delayed."

The typical "lists" are Blacklists (all email is rejected) and Whitelists (all email is accepted).

Greylists utilize what is called a soft error, or soft bounce on the email server. 

When sending an email, there are some errors that cause the transmission to fail and halt, and there are others that indicate that the sender should "try again later."

For example, if you try to send an email to an account that doesn't exist, the sending server will not try to deliver the message again.  But if the error is something like "Mailbox is full", then the sender will keep trying N number of times.

Almost all spammers will not bother to resend these soft bounces.  They are kicking of millions of emails, it isn't worth their time to deal with these soft bounces.

So greylisting does the soft bounce, and sees if the sender tries again.  If they do, then yahoo labels them as an OK sender, and allows their email through.  If they don't try again, yahoo can label them a spammer, and block them out.

 

To do this you

1. Need a TFTP server running (solarwinds)
2. Need to telnet into the device
3. Need to be in enable mode

First to make the backup:

write net 192.168.1.2:MyBackup.pixconfig

where the IP is the IP of your TFTPserver

Then to restore it later, you need to enter config terminal mode first and then restore the file:

config term
configure net 192.168.1.2:MyBackup.pixconfig

and there you have it...

The changes will take immediate effect, but you will still need to write them into the non volatile memory, or the changes will be lost when you reboot the device.

 

Here is a quick trick for resetting a pix password:

http://www.tech-recipes.com/cisco_firewall_tips639.html

You need console access to do so.

Problem getting PDM running:
http://www.experts-exchange.com/Security/Firewalls/Q_21611023.html

Installing PDF on a Pix Firewall:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_61/pdm_ig/pdm_inst.htm

Upgrade/Update/Flash a Cisco Pix:
http://www.windowsitpro.com/Article/ArticleID/20281/20281.html?Ad=1

Change Password on Pix:
http://www.linuxhomenetworking.com/cisco-hn/dsl-pix.htm

Working with Cisco products is not an everyday event for me, but when I do work with them I want to make sure I backup the config files before I do anything.

To do this you can follow the instructions on this page:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_tech_note09186a008020260d.shtml#tftp

You can also download a free TFTP server at this location:
http://www.solarwinds.net/Tools/Free_tools/TFTP_Server/

 

I recently went through the painful process of updating all our codebase to remove all warning messages after our "successful" convesion from .net 1.1 to 2.0.

After I made all the adjustments to remove all warnings, all seemd to be well.  In fact, it was going to well, as this morning I relized that I hadn't seen an exception report come through my email in a week.

Sure enough, I went into the database where I log everything and found exceptions that were not being emailed to our development team.

The exceptions that were being thrown when we tried to email were stuff like this:

Email address problems

Error sending Error Report: Message: The specified string is not in the form required for an e-mail address.
Stack:   at System.Net.Mime.MailBnfHelper.ReadMailAddress(String data, Int32& offset, String& displayName)
   at System.Net.Mime.MailBnfHelper.ReadMailAddress(String data, Int32& offset)
   at System.Net.Mail.MailAddressCollection.ParseValue(String addresses)
   at System.Net.Mail.MailAddressCollection.Add(String addresses)
   at System.Net.Mail.Message..ctor(String from, String to)
   at System.Net.Mail.MailMessage..ctor(String from, String to)
   at System.Net.Mail.MailMessage..ctor(String from, String to, String subject, String body)
   at Walshgroup.Logging.ApplicationAudit.EmailErrorToDevelopmentTeam(String sErrorMessage, Int32 iLoginID) in x.vb:line 586 on machine y

Subject problems

Error sending Error Report: Message: The specified string is not in the form required for a subject.
Stack:   at System.Net.Mail.Message.set_Subject(String value)
   at System.Net.Mail.MailMessage..ctor(String from, String to, String subject, String body)
   at Walshgroup.Logging.ApplicationAudit.EmailErrorToDevelopmentTeam(String sErrorMessage, Int32 iLoginID) in C:\x.vb:line 586 on machine y

It turns out that we were doing 2 things that System.Web.Mail seemed to accept, but System.Net.Mail did not.

Email Address: We were using the MS Outlook way of email concatenation (using a semicolon) to send an email to multiple people (e.g. bill@asdf.com;jack@asdf.com;pete@asdf.com).  Once I changed it to use commas, everything worked, but we still had errors related to the subject line.

What we were doing for the subject line was simply to take the first 50 characters of the email error message.  In this case, this included some CRLF.  Once those were removed the email sent w/o a problem.

For more info on these classes check out http://www.systemwebmail.com/ and http://www.systemnetmail.com/.

This is a well known log analyzer application that can provide a nice web interface for viewing we stats.

http://awstats.sourceforge.net/ 

I was having such a hard time getting MS Virtual Server setup so that my virtual servers could access the public network and vice versa.

In the end the problem was caused by a service that is running to enable my VPN connections.

The service is called:

Cisco Systems, Inc. VPN Service.

As soon as I turned off that service, everything with my virtual servers network worked just fine.

 

This weekend I helped a client of mine move their computer system to a new factility.  In the new location I racked up and configured an HP Procurve switch, and 2 Cisco APs.

All in all the move went well.  I had some problems getting into the Procurve at first.  I think the problem was a bad serial cable, but in the end I got it working right.

We didn't quite have enough ports on Procurve, so I uplinked a couple of their old switches until I could procure some more modules for the HP.

The Cisco 1100 APs had great range.  I was able to blanket the entire facility with WIFI access.  Pretty nice!

Search engine optmization is the efforts to increase a website's ranking in the various search engines.

One site that I have been using, mostly for fun, is http://www.googlerankings.com which, unlike other sites that just tell you the page rank of your site, will allow you to provide a search term, and it will try to find your site on the google, msn, and yahoo. 

You just need to provide your Google API key:

Of course, finding that your site is number 836 for some search doesn't really help you in any meaningful way, other than to know that no one is ever going to find your site through that search engine.

I was trying to see who my site is listed number 2 at MSN for "Chris May" but not even in the top 1000 at google or yahoo.  

Slashdot is running an Ask /. article on alternatives to Citrix.

At Walsh, we run a lot of applications over Citrix, mostly apps that really aren't meant to be run remotely, to allow remote users to run them against databases that are stored in our main offices.

MSi is interested in a solution such as this as well but for more daily operations than specific application access.

ColoQuest works out of the Level3 on Canal.

NaviSite is the owner of the Oakbrook datacenter. Pricing was: 375/month for a 1/2 cabinet + 300/month for 1mbps.

I can't believe I didn't find this search tool before!

I should look into this more.

Its called ADAM.

GoWebMan
ANet"
Colo411
CiHost.com

Here are some more colos in chicago:
FDC
iLand
xNet

Yes you too can build a network operations center for a couple grand

FDC offers colo from the BOT building. 99/month gets you 4U of space and 4mbit connection. I bet that wouldn't be guaranteed but... whatever. Free IP's available (as long as you justify it).

Problem The 99 is "per server". So even if you have 1 web server and 1 DB, you are looking at 200/month. STUPID!

Here is the ever elusive, and poorly documented User schema for AD.

UPDATE: It seem they took away the page above.  Here is a new one.  First pick a type of object, for example User, then pick the property you want, like Surname.  Finally look for the LDAP Display Name, and it will show you the property name, e.g. "sn".

Here is an article that discusses how to write a telnet application that can reboot your server remotely... a must for windows computers :).

Here is a list of common ports used by Windows 2003 Server.

This microsoft page didn't help me any, but it is a useful referenece.

AD DNS Lookups

This page allows you to test you SMTP to see if it is allowing Open Relay.

Pretty cool.

I fricking hate spam...

Just found this "Our Active Directory server is at address 10.50.100.36. Port 88 is Kerberos v5, and port 445 is microsoft-ds. The initial authentication gets two hits on port 88, but we get one more hit on port 88 in between a bunch of port 445s when we connect to the public share. Even when we transfer a file from the share, all traffic is still via port 445. "

This is a somewhat usefull, but confusing, list of many of the properties that are available in the property collection. If you look down the page for the "Attributes" section you can find a list of available names of properties for a DirectoryEntry item.

This Menu/Navigation control is pretty awsome!

Zone Edit offers backup email server service for only a few bucks.

Microtech does a similar thing for a few bucks.

Answer: When I'm paying an extra 15 bucks a month for static, thats when.

Earthlink gives out your static IP through their DHCP servers, so what happens when we have storm and the power flickers? I lose the DSL for a minute, and when I reconnect, it still thinks that my old connection is running, so it doesn't give me my static IP! This really pisses me off.

If someone is logging in with my username and password, then just drop the connection to my ip address if they think that it is still live, and give my MY ip address, dump assholes.

This article from Toms Hardware, goes over some of the issues surrounding Building You Own Network.