Cupfighter.net

System Center Operations Manager is monitoring DB space used by default if you have set the database to a fixed size. If you are using autogrowth with unlimited file growth, your diskspace monitoring will kick in when you are running out of disk space (don’t forget to customize these settings for large disks: you don’t want to get warned on a 500GB volume when there is only 2 GB free space).
However, if you are using autogrow options with a limited size, then SCOM 2007 doesn’t generate alerts as also documented in the product knowledge tab for “DB Space Free (%)” Monitor:
This monitor checks the database percentage free space to ensure it is above the defined thresholds. A warning or error alert will be raised if it is below one of the defined thresholds.
Databases that have autogrow set will never generate an alert regardless of the reported free space.
If your database is filling up, you get the following error: Could not allocate space for object in database because the filegroup is full.
To prevent this error and get warned in advance, I have written a custom monitor that will detect databases with the settings mentioned above and monitors database free space when autogrow AND limited file size are on.
Read more…

My work as security engineer for Schuberg Philis often requires me to deal with the following situation. A customer of our requires us to facilitate a security assessment or the infrastructure we manage on their behalf.

More of often then not, the contractual agreements between assessor and client and client and service provider together with a “third party waivers” or similar documents do not cover everything that the three parties want to commonly agree upon. After reviewing quite a number of these documents, I decided to write a template agreement (which can be downloaded below) for exactly this situation. This document is not a replacement for the agreement between the client and the assessor, but as an additional agreement between all three parties.

Madison Gurkha and ITsec have both reviewed and contributed to this agreement and we will use it in our future dealings.

The agreement covers the following topics.

Read more…

Every now and then Microsoft Outlook decides to show its reminders in a strangely deformed reminder window.

Sorry what do I need to remember?

As allways Google was my friend and pointed me to this post.

The key is the value  WindowPos in this registry key: HKCU\Software\Microsoft\Office\12.0\Outlook\Options\Reminders

If you delete this key from the registry and restart Outlook the reminders window is back to its normal size.

jMeter is a great tool to perform several load and stress tests on websites, ftp servers, database servers and more. I use it to see how much end-users can log in to their banking environment and check their current account details, to validate how much inserts/sec can be handled by a database, the maximum amount of ldap lookups, etc.

During testing, the most interesting things usually happen during the load test. It’s funny to see how a site behaves (or dies) when the system is running out of resources. My ultimate goal is not to find the moment where the site breaks, but to tune the site to a level where it actually never breaks, but only becoming slow, without collapsing via some snowball effect on system resources. I’d rather have a slow web site where 8 web servers are running at 95% cpu, than a collapsed farm because end-users hit the F5 button after receiving a system error.

In one of my last assignments to benchmark a site, the site turned out to use java classes, with browser-based functions to create an encrypted password which in turn was sent to the web site for authentication.

There I was, with a need for executing a custom java class, and a clear FAQ on the jMeter site telling me explicitely “Does JMeter process dynamic pages (e.g. Javascript and applets): No. JMeter does not process Javascript or applets embedded in HTML pages.”.

But jMeter does support a way to execute JavaScript functions, via the “BSF assertion”. And here’s the trick: JavaScript provides a bridging function towards java libraries, via the Packages method. If you have a custom class in a JAR file provided by the website, the regular path to that class would be com.Company.Custom.Classname, and the function can be called “FunctionName”. Using this function from within JavaScript is can be done by calling the function with it’s full path, and by adding “Packages.” in front of it.

Example java class function use within jMeter, e.g. by using a class file to encrypt a username/password combination by using a custom java function:

• download the website’s JAR file, and put it in the jMeter java classpath
• Create your regular jMeter test
• Add a “user definded variable” test component, and add a field called “PASSWORD” with variable “secret”, and an empty field “HASHEDPASSWORD”.
• Add the “BSF sampler” to the HTTP request sampler containing the username/password login page
• Put “javascript” in the “script language” field of the BSF assertion

This is how the JavaScript code within the BSF assertion could look like:

//Get the jMeter variable and put it in a Javascript variable

var password = vars.get(‘PASSWORD’);

//the actual magic: the calling of a Java class function from within JavaScript
//This is not an actual password encryption, only an example by help of a jMeter class available
//You can find this class in ~jmeter/lib/soap.jar
var hashedpassword = Packages.org.apache.soap.Utils.cleanString(password);

//Put the result back into a jMeter variable for further processing
vars.put(‘HASHEDPASSWORD’,hashedpassword);

//and since we’re not testing anything in this “BSF assertion”, we will always call it a success:
AssertionResult.setFailure(false);

And that’s it! Read more…

Ever thought you had a good backup and it turned out it was missing when you needed a restore? Although a regular restore test is the least you can do, there is more. SQL Server stores backupinformation for all databases in msdb.dbo.backupset. A simple query shows you all databases that have no backup in the last two days:
SELECT DatabaseName = d.name
,LatetstBackUpDate = ISNULL(CONVERT(VARCHAR(30),MAX(b.backup_finish_date),120),’No backup’)
,’Days’ = MIN(DATEDIFF(hh,b.backup_finish_date,getdate())) / 24
,’Hours’ = MIN(DATEDIFF(hh,b.backup_finish_date,getdate())) % 24
FROM master.sys.databases d
LEFT OUTER JOIN msdb.dbo.backupset b ON d.name = b.database_name
WHERE d.name NOT IN (‘tempdb’,'model’)
GROUP BY d.name
HAVING ISNULL(MIN(DATEDIFF(hh,b.backup_finish_date,getdate())),999) >= 24 * 2 — change the 2 when you want to use a different amount of days
ORDER BY d.name

Wait, there is more! You don’t want to run this query every day by hand is it? Of course you can run it as a scheduled job on your database server, but even that can be a time-consuming task if you have a lot of servers. It would be better to run this query from System Center Operations Manager.

Read more…

We are currently implementing a XenDesktop 3.0 environment on vSphere 4.

Today I started to lock down the permissions the Xen Desktop Delivery Controllers (DDC) have on vCenter. There is not much documentation on this. Except for the kb article on VMWare Infrastructure 3 and XenDesktop which is lean and mean. But then i stumbled on this great blog post: http://theether.net/kb/100114

Which describes the solution to the error “This virtual machine could not be retrieved from the hosting infrastructure”
The solution basicly describes the proper permissioning for the accunts which access Virtual Center from the DDC and this even works for vCenter 4!

In VirtualCenter:

- Select View | Administration

- Click Add Role
- Enter the name XenDesktopGlobal
- Check Global | Manage Custom Attributes
- Click OK

- Click Add Role
- Enter the name XenDesktopDataCentre
- Check Datastore | Browse Datastore
- Check Virtual Machine | Inventory | Create
- Check Virtual Machine | Provisioning | Deploy Template
- Check Resource | Assign Virtual Machine to Resource Pool
- Click OK

- Click Add Role
- Enter the name XenDesktop
- Check Global | Set Custom Attribute
- Check Virtual Machine | Interaction | Power On
- Check Virtual Machine | Interaction | Power Off
- Check Virtual Machine | Interaction | Suspend
- Check Virtual Machine | Interaction | Reset
- Click OK

- Select View | Inventory | Hosts And Clusters

- Select Hosts & Clusters
- Select the Permissions tab
- Right click and select Add Permission from the context menu
- Select XenDesktopGlobal for Assigned Role
- Click Add
- Select the account used in the Logon Information properties of the Desktop Group
- Click OK
- Click OK

- Select the Datacentre that contains the virtual desktops
- Select the Permissions tab
- Right click and select Add Permission from the context menu
- Select XenDesktopDataCentre for Assigned Role
- Click Add
- Select the account used in the Logon Information properties of the Desktop Group
- Click OK
- Click OK

- Select the Cluster or Resource Pool that contains the virtual desktops
- Select the Permissions tab
- Right click and select Add Permission from the context menu
- Select XenDesktop for Assigned Role
- Click Add
- Select the account used in the Logon Information properties of the Desktop Group
- Click OK
- Click OK

Source: http://theether.net/kb/100114

Another good (shoudl I say brilliant?) information from our collegue Elianne van der Kamp.

Yesterday we discovered an issue with Windows 2008 clusters: manually added persistent routes disappear from the active routes table, when taking offline (or failing over) a cluster group containing an ip-address-resource.

This issue is documented here. This same article also describes a workaround for when you have multiple gateways on multiple NIS’c.

By changing your route add command from e.g. <route add 10.1.0.0 mask 255.255.255.0 10.1.0.1 –p> to <route add 10.1.0.0 mask 255.255.255.0 0.0.0.0 if 25>

With this second command you bind the route to the interface instead of an ip-address. And since it is now bound to a local device any cluster failover will leave the route in the routing table.

However this will not solve the issue we discovered yesterday: We are using 2 gateways ‘behind’ the same interface. So binding the route to the interface will not help here.

Example interface 18: 192.168.251.36 mask 255.255.255.0 192.168.251.1, with added route 192.168.250.0 mask 255.255.255.0 192.168.251.3 –p.

When an ip-address will be taken offline (fails over) the Active route 192.168.250.0 255.255.255.0 192.168.251.3 will be removed.

Accidentally we found out that adding the interface to the route will solve this new issue (thanks our collegue Enrico). So our new route command will have to look like this:

<Route add 192.168.250.0 mask 255.255.255.0 192.168.251.3 if 18>. This will leave the route in the active routes table.

Why does this work? And is it reliable?

Since we couldn’t find any google/Microsoft hits on this particular issue, we had to do a little registry digging.

The standard command <Route add 192.168.250.0 mask 255.255.255.0 192.168.251.3 > just adds the persistent route to the registry which triggers the ‘bug’.

However the new command <Route add 192.168.250.0 mask 255.255.255.0 192.168.251.3 if 18> also makes 14 changes in the cluster part of the registry telling it that this route is bound to the adapter and to be left behind on the local server in case of a failover

So I think it look pretty reliable. We did lots of reboots and failovers on the cluster and the routes seem pretty persistent now..

One month ago we blogged about my interview for Security Justice. Yesterday I got a tweet from Security Justice that the recording of my interview is now available.

To my surprise the interview turned out a lot better then I remembered it.

While researching the SMB2 vulnerability I decided to make a time line. It really shows how devastating a 0-day can be in the wrong hands

To date Microsoft has not released a patch. I will continue to update this post.

A tool to disable SMB2 is here. Instructions on how to disable SMB2 manually are in the workaround section of this advisory.

On the 9th of October Microsoft announced a patch for this issue and the ISS FTP issue.

When you install McAfee on Windows Server 2008, and probably Windows Vista also, you can get a lot of messages in your security log. Like this one:

Event ID 5156 means that WFP has allowed a connection. When most connections are allowed your security log will fill up very fast.

You can disable Object Access auditing but then you’ll miss other events which might be of interest. So, instead, let’s just disable Success Auditing for Filtering Platform Connections. It’s not possible to disable auditing subcategories with a policy or other GUI tool, but I found out that you can enable and disable specific subcategories with a special command-line tool: Auditpol.exe, which is included with Windows Vista and Windows Server 2008. I used the following command:

auditpol /set /subcategory:”Filtering Platform Connection” /success:disable /failure:enable

As you can see this disables Success auditing for the Filtering Platform Connection subcategory.

For more info check out this article:

http://msdn.microsoft.com/en-us/library/bb309058(VS.85).aspx