Another Blog

Quick and Dirty DHCP setup for Vyatta

2011-11-28T12:52:00.001-08:00

I needed a quick and easy DHCP server on a Vyatta at work and it is very simple to do and thought I would share it. The first thing we need to do is to log in our Vyatta router and enter the configure mode.

Your LAN interface will need an IP address in it. In this example we will use 192.168.1.0/24 since that is very common. Our vyatta router is 192.168.1.254 by the way.

The commands typed will be in bold. The # is just signifying a line as in the console.

# set service dhcp-server shared-network-name JaredTest subnet 192.168.1.0/24 start 192.168.1.5 stop 192.168.1.10
#set service dhcp-server shared-network-name JaredTest description "Give it a Description"
#set service dhcp-server shared-network-name JaredTest subnet 192.168.1.0/24 dns-server 192.168.1.1
#set service dhcp-server shared-network-name JaredTest subnet 192.168.1.0/24 domain-name domain.local
#set service dhcp-server shared-network-name JaredTest subnet 192.168.1.0/24 default-router 192.168.1.254
#commit
#save

That is pretty much it.

Mikrotik USB Install

2011-05-24T07:21:00.000-07:00

Mikrotik is a router platform that can run on x86 hardware and actually does a pretty good job. One of the main features that many people that use it like is the fact that you can have junior admins use it because easily because there is a GUI by using their Winbox. Long story short, we have it installed on our main router and love it so far. For $45 we turned a Core 2 duo machine into a complete router with around 2000 machine behind it. This isn't a sale on the product but it isn't too bad at all and works well for us. We will replace it when we get the funds to do so. ;)

To install it on a USB drive is so simple. I know you probably are thinking this will be a long step by step post but I really don't think that is necessary. Do the following and you will be fine.

Download and install Virtual Box and install if you don't have it already.
Download the Mikrotik Iso (This is 5.8 at the writing of this)
Insert USB drive into your machine.
You will now need to create a virtual machine on your virtual box. Name it "Mikrotik Install" or something along those lines. If you don't know how to use virtual box you can google on how to create a new virtualbox machine. Under the storage options be sure to set the CD to the mikrotik ISO you downloaded.
Start the VM up.
You will have to Click on Devices then USB Devices and choose your flash drive on the top menu when you start the machine. YOU MAY HAVE TO JUST RESET THE MACHINE AGAIN for it to see your USB drive.
Follow through the install and choose the USB drive as the install target.
Insert the USB into the new machine and boot from USB and tada!

This post was a quick how to I wrote for a friend that asked me to. So it may not be the most precise or clear and I apologize but the theory of it is very simple.

The ActiveX Control for Flash Player Could Not Be Registered

2011-01-10T11:18:00.000-08:00

We were getting the "The ActiveX Control for Flash Player Could Not Be Registered" error on some computers and could not figure out exactly what was going on. So after this I ran procmon on the computers having issues and discovered that this was due to a registry issue of the previous version. To alleviate this we have to open up regedit and find the following key:

HKEY_CLASSES_ROOT\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}

Right click and take control of this and set permissions on all keys below this. Delete this whole entire key.

You will also do the same with:

HKEY_CLASSES_ROOT\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}.

Once these are removed go ahead and try the install again. Hopefully all will work well.

UPDATE TO THIS:
Unfortunately I do not know exactly which CLSID key it is. It all depends on the versioning of the FLASH PLAYER. Just run ProcMon on the computer to see which one is causing the issue. Set the filter within ProcMon to the name of the flash installer. Once you look at this you will see what is taking place. You may need to go into the CLSID key and reset the security permissions on that whole entire key. We recently saw a couple more of these buggers coming up where we had to replace security permissions on the child objects. Once I did that I was able to take Ownership and delete them out of there. This is a very frustrating process and I think maybe a virus or AV software did this a long time ago.

Hope this helps!
Thanks,
Jared

MAC address filtering with Vyatta

2010-12-10T07:12:00.000-08:00

We have an issue with people bringing devices in and connecting them on the network. Of course there are lots of solutions to alleviate this but the easiest way to do so is to do the following and apply it to the internal interfaces where the MAC address live.

#SETUP THE MAC FILTERING ON THE ROUTER
configure
set firewall name NOMAC
set firewall name NOMAC default-action accept

#SET THE RULES
set firewall name NOMAC rule 20 source mac-address xx:xx:xx:xx:xx:xx
set firewall name NOMAC rule 20 action drop
#REPLACE THE ETH0 With your local interface
set interfaces ethernet eth0 firewall in name NOMAC
#OPTIONAL FOR LOGGING
set firewall name NOMAC rule 20 log enable

commit

That should pretty much do it and block traffic for the MAC addresses going through the router.

Now just set up an individual rule for every MAC address that is causing the issues. :)

Aligning Business and IT

2010-11-07T09:24:00.000-08:00

Aligning business with IT sounds like something simple to do but so many individuals fail at this miserably. I was speaking with a friend of mine that owns a MSP business last week. He was describing this new mail/communication server that they bought and how it ties in with their ticketing system and it is going to increase the productivity of all his employees. He told me of the awesome features such as how it does complete unified messaging when they get new VOIP phones. It will only cost them a license for each station when they decide to do the Unified Messaging. He went on and on about all the awesome features.

I finally asked him, "why?".

He stated because the salesman told him all these features and this will push them in the right direction for the future.

I then asked him what was wrong with his old system.

Not to my surprise he stated "nothing".

Now I agree that having the latest and greatest technology is awesome but sometimes we get caught up in the potential of and what the technology can do instead of what the business needs the technology to do.

If we pulled up the productivity savings on what the new system they would be in the red compared to the cost of the actual system and all the integration features. We sat down and we wrote up everything line by line on estimated time savings by employee, customer wait time, increased billing, and automation savings and compared it to the system cost that he purchased.

Unfortunately, it is going to take him 7 years to break even without UM licenses and 11 with UM licenses. I believe you see the picture.

My friend purchased a system that did not align to the IT needs of his business. He bought something on the fact that it would save them money but did not do the math on the ROI and how long it would take.

I talk to so many business owners that buy IT related software, hardware, and services that are not a necessity and do not align to their business model. Technology is agreed that it can help you achieve some of the greatest goals but also can hinder your business to the point where it becomes more of a nuisance.

You want your IT and Business to be side by side going in an upward manner if you will. Each of them feeding off each other thus creating an increase in your business giving you more profitability and less IT breakdowns. This includes buying technology that is what your business needs (no more no less), technology that is easy to use for your organization, and technology that has less overhead (such as cloud based software and services).

Once you align your business and IT together you will begin to see better results and overall results.

Life of Backups

2010-03-22T18:34:00.000-07:00

So many times I am asked, "Are backups really that important?". I think to myself and am astonished that someone would even ask me that. Do you really think that this is something to think about lightly, or even worse just take the risk of not having a solid back up. You may laugh or chuckle but you have no idea of how many people do not take backups of their data.

Today I witnessed a Doctors office that has not taken a backup in a year. Yes, a year. So you might ask but all their data is digital. Meaning es no papel. All digital. So if they had a fire, you guessed it, they would lose all their data.

Their are many solutions that you can go with CHEAPLY! There all out there and are actually fairly cheap compared to the loss that you would take. What is $2000 compared to all the damage you would take if you lost all your data? Just a drop in the bucket.

People please make a backup of your data. I mean this from the bottom of my heart. Seriously. If you need help with a backup strategy, just let me know. I would be glad to help you with this.

Exchange 2007 Certificate Builder

2009-10-22T18:09:00.000-07:00

Many times creating a self signed certificate with Exchange 2007's Exchange Management Shell is a pain. I do it all the time but I am pretty lazy and don't want to have to sit there and scratch my head everytime I create a certificate. This pretty much does all the work for you with a GUI to create self-signed certificates. Try it out and hope you enjoy it.

http://www.virtualplug.com/images/CertMaker.exe

Thanks,
Jared

Runtime Errors

2009-07-02T15:26:00.000-07:00

Runtime errors are generated when computers running certain program applications encounter issues. An example of this is the runtime error code 7. This type of runtime error has to do with "out of memory" problems. Conflicts with the Terminate and Stay Resident (TSR) programs or other open apps, memory issues, computer viruses and software trouble are the main causes of runtime errors.

Dealing With Runtime Errors

Most runtime errors can be fixed. Troubleshooting runtime errors starts with entering the specific runtime error code that appeared on major search engines. Gathering as much info on the particular code will help in finding the appropriate solution for it.

Once more information is available regarding the runtime errors encountered, it's time to do something. Consider performing the following activities:

* End-task all of the TSRs and other programs that are currently running to ensure that none of these are the culprit. To do this access Task Manager and hit Ctrl-Alt-Delete.

* For issues that have to do with the operating systems (OS), consider OS reinstallation, but this is a pretty serious undertaking. In Windows 2000 or XP, a better option would be to try repairs for either Windows 2000 or XP computers. Scanning and repairing files can be done this way: Go to Start then Run. In the field provided, type: sfc/scannow and hit Enter. Make sure there's a space between "sfc" and "/."

* If the problem again and again happens with a particular application, visit that website of that program's developer and download any patches and updates. If there's none available, consider uninstalling then reinstalling the program concerned.

* Some runtime errors are cause by other plug-ins, add-ons or extra program software that were installed on the PC and are associated with the application generating the runtime error. If the additional program software installed is related to the application generating the run-time error message, make sure there are no available updates for the said programs, or try uninstalling to verify that they're not causing the issue.

* Update the definition files of the utilized anti-spyware and antivirus programs. Run regular exhaustive bug detection scans as these malware have the ability to cause a number of runtime errors.

* If the runtime errors still persist, the problem might lie with the system memory or it could be a hardware issue. In this situation, it would be best to get in touch with the program's technical support center for assistance. Contacting the motherboard or PC manufacturer could also be useful.

Issues with memory can often be settled with a simple reboot. But treat reboots as temporary fixes. Reboots clear up the memory, however, if the computer has insufficient memory or hard drive space for the applications being run, users will soon run short on memory again. Check that the hard drive has a minimum of 100 to 500MB free space so the swap file size can still expand.

To find out how much free space a PC has: go to My Computer. Right-click the hard drive (usually drive C:) and then from the menu select Properties and view the capacity of the disk. If the space is cramped, run disk cleanup by hitting the tab labeled Disk Cleanup and following the instructions.

Failing memory chips could also give rise to runtime errors. Taking out the troublesome memory chip and replacing it with a functioning one will get rid of the problem. For other runtime-related issues and errors like installation run-time error messages, consider cleaning out the registry's flawed or invalid portions using a registry cleaner.

6 Reasons IT Projects Fail

2009-07-02T13:40:00.000-07:00

Many outsourcing companies have created beneficial outsourcing relationships with vendors. Unfortunately, there are the occasional projects that fail to meet deadlines or criteria set forth by the outsources. When a project does fail, there are usually numerous reasons and not just one underlying cause.

Lack of outsourcing strategy
The outsourcing company must take the time to formulate a strategy for handling outsourced projects. Working with vendors in other countries can create even more complications, which just shows the importance of having a plan. Managers must consider how the process will be managed and must set expectations for the projects. Sometimes outsourcing companies do not adequately prepare for the administration of projects. Management should clarify how global sourcing will be implemented and effectively communicate the strategy to the internal IT department and the vendor.

Miscalculated time involved
Outsourcing companies often do not realize the amount of time it will take to get a project in operation with a vendor. Some outsourcers take a "hands off" approach, meaning they do not feel that they have to be involved once the project is sent to the vendor. That thought process can be damaging to the project. It takes time and effort to transfer technical and business knowledge to the vendor. Once the transfer is made, hours will be spent maintaining the business relationship. The outsourcing company and the vendor will also have to coordinate between the team members to ensure that everyone understands project specifications and deadlines.

Cost-reduction expectation was not realistic
One of the most common reasons that companies look to outsourcing is to reduce costs. Although outsourcing does provide cost reduction, outsourcing companies frequently have unrealistic expectations regarding the initial savings. Even though labor costs may be lower, there are other hidden costs that can cause a project to go over budget. The longer the outsourcing relationship continues, the higher the savings. However, most outsourcers do not realize this fact. Consequently, a project can be unsuccessful if an accurate budget was not put in place.

Communication barriers
Communication is more than just language. Global sourcing can be complex as outsourcers and vendors face issues of time zones and locations. These challenges can make it very difficult to communicate crucial information in a timely manner. Communication barriers are frequently to blame when it comes to a project's failure. If team members can not effectively communicate the project status, concerns or ask questions, it can negatively impact an IT project. A communication plan can overcome this obstacle.

The vendor was incompetent
Various criteria should be considered when choosing a vendor. If price is the main motivating factor, there is a risk of choosing the wrong one. A low-cost vendor most likely will not provide the same quality of work as another vendor who may charge more. That is why cost should not be the only consideration when choosing a service provider. A vendor should be evaluated on multiple areas, such as trained personnel, technology and processes. A thorough analysis of the vendor will allow the outsourcer to have a good sense of what to expect.

Differences in culture
Cultural differences can impact a project. If the outsourcer is unfamiliar with the culture of the vendor, potential problems and miscommunication can occur. Cultural differences include religion, mode of dress, social activities and work ethic. Even the way a question is answered can differ depending on the culture. Cultural obstacles can be overcome by taking measures to clearly outline project specifications and encourage feedback from the vendor.

A project can fail for a combination of reasons. However, by understanding why projects fail, outsourcers can plan ahead to avoid potential problems.

Asterisk and the Benefits

2009-07-01T14:36:00.000-07:00

Asterisk phone systems are an excellent, fully integrated VOIP PBX solution for businesses of all sizes. The set up eliminates the tremendous cost of setting up a traditional PBX system. This high cost often eliminates the possibility of using PBX for small businesses, but with Asterisk, even the smallest business can have all of the benefits of PBX in their office without spending money they do not have.

What Is Asterisk?

Asterisk is an open source software PBX that can be used by businesses and individuals alike. It is designed to run on Linux, but it can run on other platforms as well, including Windows. Asterisk was developed by Digium, Inc., who also sells the hardware necessary to set up Asterisk phone systems. Compared to other PBX options, Asterisk is incredibly affordable and has many features that are hard to find elsewhere.

Benefits of Asterisk in the Office

Besides the fact that it costs thousands of dollars less than a traditional PBX system, Asterisk provides its users with numerous other benefits. Since Asterisk phone systems are VOIP PBX systems, they use broadband connections to connect the telephone network to the traditional global telephony network. Calls can still be made and received in the same manner that they are with a traditional PBX system. Additionally, because the connection is made through the Internet and not the phone line, employees that work remotely can be connected directly to the office PBX through their Internet connections. When someone calls your office and chooses extension 10, that extension could actually be your home-based worker, and the customer would be none the wiser.

For large businesses that have locations in several geographical areas, using asterisk will allow the various offices to connect over the network. This can eliminate much of the expense of conference calls a company spread over several states usually faces. Additionally, employees who must travel frequently can stay connected to the office PBX system as long as they have an Internet connection.

Asterisk phone systems allow every extension to have its own voicemail box. These voicemail boxes are connected to the employee's email accounts, so no one will ever miss a message again.

If you should ever have a problem with your Asterisk system, you can easily get help directly from Digium. They have friendly Asterisk consulting professionals that will help you get the system up and running as quickly as possible. You can call to ask questions about bugs that you find, and they are happy to help, as this type of feedback helps them improve the software for future users.

Asterisk supports a variety of VOIP protocols. Among the protocols it accepts are MGCP, H.323, and SIP. The program can connect IP phones to the traditional phone line easily. This flexibility makes the system easy to integrate into established businesses.

If needed, Asterisk phone systems can interface with traditional telephone lines. The product comes with several high-end features, such as voice recognition system integration, call data record, and text-to-speech system integration. All of these features make it one of the best PBX products available.

Benefits of Asterisk for Customers

Your employees are not the only ones who benefit from Asterisk phone systems. Your customers will benefit as well, both directly and indirectly, when you implement this system. It has features that are found in the most expensive products on the market, such as on-hold music that supports both MP3 and streaming media. Customers will have shorter wait times because the call queues allow agents to monitor the queue while they take the incoming calls, so they can shorten the calls if needed.

Asterisk phone systems offer the best of both worlds to their users. They provide a plethora of features to the business at a fraction of the cost of their traditional competition. There are other VOIP PBX options out there, but Asterisk is the oldest and most well established, making it the preferred choice among many business owners.

Linux Refuses to Boot Up

2009-06-30T19:04:00.000-07:00

This deals with what action is to be taken (during a reboot) after a power failure or an incomplete shutdown of a Linux system due to any reason. This problem seems to be very common since many newcomers install Linux and get all the various softwares/hardwares working under Linux and suddenly one day the power fails. There are a few things that you can try to get Linux back on track..

1. While rebooting, Linux may print a message saying that there is a problem with the file system and it might force a check. It would do this for all Linux partitions. If the checks (they generally take around 30-60 seconds. also displays a rotating indicator) are successful then you are lucky. Linux should mostly continue booting and you should be back in business soon. If this is what happens then you may be under an impression that a direct switch off of a Linux machine leads to no problems. Please note that you were just lucky that you got away without any major problems.

2. While rebooting, Linux may not be successful in any of the file system checks. In this case, the booting stops abruptly with a message stating that you should run fsck manually without a few parameters. Once you reach the hash prompt (#) then run the fsck command as mentioned (fsck -a -p /dev/hdaX). The fsck command requires the partition which it has to check. So if you have installed Linux on /dev/hda1 then you have to run fsck as follows: fsck -a -p /dev/hda1.

When you run fsck it would mostly find some inode problems and ask you whether you want to fix them, Select the default option (yes). It would do so for all the problems found. Once this is over you can restart the machine using either "Ctlr+Alt+Del" or "shutdown -r 0", whichever works. Now this time your Linux machine should boot properly.

3. It has so happened that once when the power failed, Linux simple failed to boot on my machine. It gave no errors at all, but the init process would just not get initiated. It would find my partitions, mount the ext2 file system as read only and then would simply display a prompt. Even with this prompt I wasn't able to do a lot. Also I noticed that a few of the default directories were missing on the native partition. The only solution that I found to this was to Reinstall Linux.

Note: While reinstalling, the best and safest way for the above problem would be to insert the installation media (Redhat Linux 6.1 CD). And instead of selecting to install the OS once again, select to upgrade the existing installation. This would effectively replace all the damages areas of the OS and would also retain all your personal data and configurations in Linux (This should work in almost all cases).
Hence I would always advice an upgrade to the same version (If you originally had Redhat Linux 6.1, insert the CD and once again select to upgrade to Redhat Linux 6.1 itself). If the upgrade option doesn't fix the problem, then you would have to do a reinstall after a reformat of the Linux partitions.

4. In one case when Linux refused to boot I noticed that a few of the main files / directories were missing. I found that the /sbin directory (which is a very important directory) wasn't there in the root directory. I performed a search for this directory and found it to be within another directory. After some discussion I realized that my friend has accidentally moved this directory within his GUI when he was working in superuser mode. As long as he was working a few commands didn't work but he did not bother about finding out why they didn't work. Once he rebooted his machine the absence of this directory hung the booting process. So I suggest that you never work in superuser mode unless absolutely necessary. Even within the superuser mode prefer the shell, since you can hardly ever do anything accidentally in the shell. In my friend's case I simply moved that directory back within the root directory and Linux booted without any problems.

Do I Really Need Managed Hosting?

2009-06-30T05:54:00.000-07:00

Managed hosting offers many benefits to a business wishing to expand their operations or make themselves accessible to their customers online. By having an online presence, a business can increase their exposure to a local, national, or worldwide audience.

Nevertheless, a business that has a website is a business that can accomplish a lot more because they are allowing customers to learn more about them and gain wider access to what it is they have to offer.

There are several definitions that describe what managed hosting is. The service that is provided really depends on the needs of the business and how they handle their managed hosting. These definitions are:
A single website hosted on a web server that is supported by a managed hosting provider.

A service in which the dedicated server is managed for the business by a managed service provider.

Managed hosting manages and maintains the dedicated server.

Managed hosting is performed by a web host in addition to providing many services for the dedicated servers that they provide.

The business doesn't have their own dedicated server, but they are using the servers that belong to the host, which means the host is maintaining shared-servers. However, the business still maintains the privacy of its website although the servers are shared and receives all of the benefits they would have and possibly more than if they had their own dedicated server.

It is easy to see that there are many different forms of managed hosting. Depending on the needs of the business the MSP provides services to, different services can be provided. Not every business has the money to hire IT professionals and train them or train existing employees to take care of their web hosting. That is why it is feasible to outsource the jobs to managed hosting. It is actually cheaper to outsource because there is a fixed monthly rate in which the company pays that usually does not add up to the monthly salary of a single employee.

What this does is maximize profit and allows the business to focus on their customers satisfaction rather than having to spend time managing the website. If a business only had time to manage their website, they would not have time to serve their customers. In the end, there would be little impact on person-to-person sales. The idea is for the website to enhance both person-to-person sales and Internet sales, if applicable.

Other benefits

There are many more benefits of managed hosting such as security and up-time. It is very important that the website stay secure so that people with malicious intentions are unable to disrupt business on your website. Malicious activity can result in many hours of trying to bring the website back up and this also results in down-time. There is nothing more aggravating than going to a website with poor up-time either because of security breaches or issues with the server.

Managed hosting performs continuous security scans and also continually checks for issues that may interfere with the sites up-time. That is why many websites that are managed by managed hosting have 100% up-time.

So if you are not sure whether or not you need managed hosting, ask yourself these 5 questions:

How would my business benefit from a website?
Does my business have the money to operate and maintain a website?
Do I have the manpower to continually monitor a website?
Do I have the money to hire and train additional employees?
How much would managed hosting cost me compared to doing it on our own?

Deployment of a Converged Network

2009-06-29T11:12:00.001-07:00

A major shift in telecommunications from circuit to packet switched technology, along with increasing sophistication of the corporate LAN/WAN, is prompting businesses of all sizes to consider merging their voice and data networks. Increased bandwidth availability through gigabit Ethernet and fiber trunk lines allow for telephony to be treated as any other application on the IP network, albeit a very needy one.

Whereas the main motivation for individual consumers to make the switch to VoIP may be cost, as evidenced by the acceptance of such upstarts as Vonage, for businesses, the transition to IP telephony (IPT) could mean a costly network upgrade, fueled by aging or depreciated legacy PBX equipment.

The upside is the imediate potential of adding strategic business capabilities - a triple play of voice, video, and data - and future proofing the network for a host of real and non realtime applications under the concept called Unified Communications. Data and communications, all managed and maintained over one network instead of two.

The Life Cycle of an IPT Network

Just like any major network undertaking, best practices dictate that deployment take place in stages, the success of each successive phase depending on the previous. The first stage is planning and assessment, followed by an intense pre deployment testing and implementation stage, and once the migration has taken place, the ongoing operations and optimizations stage. Taken together, these phases of deployment are what is known as the converged IPT network life cycle.

Planning and Assessment: Business Drivers

The business case for convergence must be clear from the beginning. Why trash a perfectly functioning telephone network with a reliable reputation for a new, burgeoning technology, as of yet only minimally tested? If indeed your existing phone system is out of date, replacement parts are getting hard to find, or its functionality no longer suits the needs of a growing organization, one motivation for converging could be the unwillingness to invest in a new Centrex-centric PBX, based on circuit switched technology.

Managing Expectations

A successful deployment from start to finish should take about a year, with a good 6 months devoted to planning and testing. For organizations that have recently upgraded their network infrastructure, deploying a converged network may not be as costly as networks that are older, and require major renovation.

Realistically, it has been observed that migrating from a legacy PBX to an IP PBX will cost as least as much as buying a new TDM PBX. Where you may get your ROI is on moves, adds, and changes (MAC) in the new IP environment. Studies show that MAC on a TDM system averages about $65, vs. $10 on an IP PBX.

Equally important is managing the expectations of your end users. Let them know early on about deployment plans and keep them apprised of your progress. End users should be surveyed on what aspects of the current system they consider critical to their job functions, and what improvements they would like to see in the new system. Call and voice quality are understandably critical factors to users and like the carrier network you are about to replace, Service Level Agreements (SLA) play an important role to insure acceptable customer service.

Planning for Security

Security considerations are of utmost importance in the planning phase. Treat your PBXs as any other critical application server by keeping it protected from public access, perhaps even in it's own DMZ. Remember that an IP PBX has all the vulnerabilities of IP, and it opens up a whole new Pandora's Box with a connection to the PSTN. Firewalls and intrusion detection should be utilized appropriately and should be current enough to recognize voice traffic.

Also consider segregating your voice traffic through the use of virtual LANs. A VLAN can help increase network performance while having the added benefit of enhanced security.

Hosted vs. In-house

Early consideration should be given to the options available for the type of voice network to deploy, as well as who will be responsible for the deployment. For businesses simply wanting to implement a VoIP solution, a hosted IP PBX can leap frog you into the future, while saving on equipment costs and reducing the headaches associated with a long drawn out deployment process.

For organizations looking to future proof their network, vendor equipment must be chosen and assessed, as well as the management applications being considered for the deployment. Costs associated with upgrading the skill sets of the IT and/or Telephony staff must also be taken into consideration.

Calling in the Pros

Organizations that plan to migrate to IP telephony themselves but find they lack the necessary expertise, might consider bringing in a Systems Integrator to help with the deployment. A Systems Integrator should be chosen and brought in early in the project. They should work closely with the IT department and can also take on the role of trainer in getting them up to speed on the new technology. The cost of bringing in an outsider can be upwards of 20% of the entire project, but may be worth it to assure a seamless transition.

The Managed Service Provider

A growing trend in the industry is for businesses to offload all or part of VoIP deployment responsibilities to a Managed Service Provider. Carriers, equipment vendors, and professional services that now have a couple of years of experience in the field are finding that companies are willing to pay for their expertise. For businesses that find that their IT staff is not up to the task, or could be utilized better elsewhere, an MSP provides the option of outsourcing projects anywhere from doing the network assessment and capacity planning, to taking on the whole ongoing management phase, much like business was doing with their legacy telephony service providers.

Management Solutions

For the enterprise that is planning to leave it up to the IT and Communications departments, now is the time to consider third party management and analysis applications. Third party solutions are just now coming into the market that take a more holistic approach to management, looking at the effects of both real time and not so real time applications on the network as a whole. Solutions being considered should be assessed for their usefulness in the testing stage of deployment. More on these management applications in the ongoing operations and optimization part of this paper.

NTP on Linux

2009-06-29T11:08:00.002-07:00

NTP, or Network Time Protocol, was invented over 25 years ago as a means of synchronising time critical processes over the Internet. It is one of the oldest Internet protocols still in use today. NTP allows network time clients to synchronise to an accurate time reference. Originally developed for the Linux operating system, recently there have been a number of ports to other operating systems, such as Microsoft Windows.

This article provides straightforward installation and configuration information for the Linux version of the NTP distribution. It attempts to describe a simple NTP installation and goes through the configuration procedure required to provide a network time resource on a Linux machine.

The NTP distribution is a free, downloadable application licensed under the GNU public license. It can be downloaded from the Network Time Protocol website. Alternatively, many Linux operating system distributions, such as Redhat and Debian, install the daemon by default or at least provide it as a pre-configured package. As well a providing the NTP application, the distribution also provides a number of very useful tools for configuring and debugging installations. In fact the tools can be used to interrogate any NTP server, including internet based ones, to provide synchronisation status information.

NTP is configured using a configuration file called 'ntp.conf'. The file contains a list of commands indicating which time references should be used for synchronisation purposes and also specifies authentication and security options.

To synchronise to an Internet based or local NTP server, you need to use the 'server' command along with the IP address or domain name of the reference. External hardware reference clocks can also be specified. Indeed a number of such reference clock drivers are compiled into the distribution by default. Many GPS receivers and radio time code receivers can be directly configured to be used as hardware reference clocks. These hardware clocks can provide an extremely accurate external source of time. Particularly GPS clocks, they can often provide accuracies to within nanoseconds of UTC. Multiple hardware and Internet reference clocks can be specified to provide redundancy in case of failure. In this case, NTP will choose the most stable clock from the list and utilise it as the preferred time source.

The NTP daemon is itself is controlled by a number of scripts to start, stop and restart the service. The scripts are simply named 'ntpd start', 'ntpd stop' and 'ntpd restart'. Additionally, a very useful debugging tool is provided which can query any NTP server to find out its current synchronisation state and to see which reference clocks it is currently using. The 'ntpq' utility also provides stability information on each of the utilised reference clocks.

There are a number of security commands that can be utilised in the configuration file to control access to the NTP installation and also to provide authentication.

NTP can be easily configured so that only a specified subset of computers on a network are granted access. This is achieved using the 'restrict' command, which is used in conjunction with the IP address or domain name of the computer to be allowed access. Multiple 'restrict' commands can be specified in the configuration file to restrict access to a range of computers.

Authentication is a security feature that allows network time clients to authenticate a server that they receive time from. A matching set of encrypted keywords available to both the client and server are used to confirm the identity of the time reference. Shared keywords are specified in a file called 'ntp.keys' on both the server and client machines. A trusted subset of keywords are then specified in the configuration file 'ntp.conf'.

To summarise, NTP is free to download, if its not already installed on your computer, and is easy to install and configure. Essentially, it is very east to set up a local time reference within your organisation to maintain network time synchronisation.

Grabbing that GUID

2008-11-20T07:27:00.000-08:00

I have ran into an issue lately with an exchange server at work. I needed a way to grab the GUIDs from remote machines so I could compare them to the error logs. I needed a quick way to do this so here is a handy vbs script that can do just that.

On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

strComputer="COMPUTERNAME"
Dim WSH

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystemProduct", "WQL", _
wbemFlagReturnImmediately + wbemFlagForwardOnly)

For Each objItem In colItems
WScript.Echo "UUID: " & objItem.UUID
Next

Why Can't You Understand?

2008-09-14T10:31:00.000-07:00

I have been getting in an argument lately about ACL's. So I am just going to put this riiiight here:

http://en.wikipedia.org/wiki/Access_control_list

ReDuh?

2008-09-14T10:26:00.001-07:00

I have been playing with a new tool called reduh from sensepost. This thing is quite interesting. It is used to create a TCP connection through validly formed HTTP requests by connecting the client to a server page.

Essentially this means that if we can upload a reDuh JSP/PHP/ASP page on a server, we can connect to hosts behind that server trivially. Think of Tunneling. You will be able to create a connection to the web server over port 80 and then from that server connect to machines (RDP, SSH, etc) through the server. It is quite interesting. I am not going to steal any thunder so please go visit their page.

http://www.sensepost.com/research/reDuh/

Blackhat Council

2008-09-14T10:23:00.000-07:00

I registered the domain name "blackhatcouncil.com". Hopefully within the next few months I can turn this into something that can be used to give back to the security community. I am thinking about starting up a Texas community of security professionals and call it the Blackhat Council. I don't know though. I have a couple of thoughts running through my mind on what to do. We shall see.

Incredibly Busy

2008-09-07T14:40:00.000-07:00

I have been incredibly busy over the last month and haven't got time to post anything new. I have been working on a couple side projects including:

An IDS system that can be deployed from a CD. It will be based on debian and will use snort-inline for the main IDS. I am in process of making a WebBased control center, (SecCenter). I have about 5000 lines of php spread across 10 pages.
A Content Filtering called SquidInk. It will actually filter GET commands from the web browser and block content. It will even change "keywords" into something else. Kind of the same filters that ettercap uses but I am trying to optimize it for many users.

That is all being done besides the work that I do everyday. It never seems that there is enough time.

Mounting a VHD in server 2008

2008-07-12T21:40:00.000-07:00

If you haven't got to play with server 2008 yet you are missing out on some exciting things. Seriously, that is no sarcasm. I usually talk down to new Microsoft products but this one seems like it is a pretty good product. One of the coolest things so far, they got a long ways to go still, is their new Hyper-V technology. I enjoyed playing with it and was trying to find the best backup strategy to use. Well long story short I want to back up the VHD files and then look at their contents later. To do this we will have to be able to mount the VHDs in server 2008. I am going to give you some code here that will just do that. Copy the following code:

Option Explicit

Dim WMIService
Dim VHDService
Dim VHD

'Specify the VHD to be mounted
VHD = "D:\Virtual Servers\Server 2003\Vserver2k3\Vserver2k3.vhd"

'Get instance of 'virtualization' WMI service on the local computer
Set WMIService = GetObject("winmgmts:\\.\root\virtualization")

'Get the MSVM_ImageManagementService
Set VHDService = WMIService.ExecQuery("SELECT * FROM Msvm_ImageManagementService").ItemIndex(0)

'Mount the VHD
'VHDService.Mount(VHD)

'UnMount the VHD
VHDService.Unmount(VHD)

Once you have that copied paste it in a notepad and then save the file as "VHD.vbs" or something. Now we are ready to mount our first VHD. First make sure the VHD is turned off, there is not a VM using the file.

Now we will have to edit the script we just copied to reflect to:
1) Where the file is located. In line 8.
2) What we want to do as far as mounting or unmounting. This is determined by commenting and uncommenting the lines in the script. In the code you copied you see that it is set to unmount.

Once you have put your variables in place you can double-click the code. You will see Server 08 installing the drivers. Once this is done you will notice that there still isn't a drive in My Computer. You will have to turn the disk online by going to Disk Management and turning it online. Once this is done you will have access to the disk.

To unmount it just comment the Mount line and Uncomment the Unmount line. I typed this in a hurry so I hope everything is correct. I will be writing a Hyper-V toolkit hopefully in the future.

Slurping some goodness

2008-07-12T21:38:00.000-07:00

You have all heard of pod slurping? Well if you haven’t it is a way for a malicious or non-malicious user to gain files on your corporate workstations and your network. What do you mean you may be asking. With data storage increasing while the size of the devices getting smaller and smaller we have a major issue on our hands. I carry 8 gigs on my key chain which is 16 times as much storage than my first real hard drive. OK, OK, long story short is a lot of data can be stored on little devices.

A user can use a program or script to slurp data off the workstations and computers. Actually very quickly and efficiently. I am not going to go in real depth about pod slurping or data slurping because there are so many resources on the internet you can find. Just google it. The one thing I will share is a small group of scripts that I wrote being accompanied by some command line freeware to show just how easy it is to do this type of slurping.

Download Slurpee

Reset root password on Linux

2008-07-12T21:35:00.000-07:00

So you decide to change your password on your Linux box one night after you read a book on Hardening your Linux box. Got you all scared about how easy it is to crack the word "mom". You thought to yourself “I don’t want to be one of those guys”. This time you set a complex password that you have never used. You know the password that looks like a Skiddie got a hold of it. Turns out the next day you completely forgot the password. What do you do? Never fear, we can reset that bad boy!

What you will need:

Live distro, I prefer Backtrack 3.
About 15 minutes.
Cup of tea.

Now all this should only be done if you are the administrator of the box. First thing you need to do is boot up the live distro up. Once you get to the desktop or console we will need to type in a few things. Hopefully you created a non-privileged user. For this to work we will need to have access to a non-privileged account since they are the onemakes all the magic take place.

Next we need to understand the magic of the passwd file. Click on the image below and study the
file. Look where I have the numbers circled. Do some critical thinking and try to see a pattern.

Ok, did you get it? If you said that the root user had a UID of zero you are correct. Notice how the UID start at zero (being the first account created) working all the way up to ever how many users there are -1. This is a big help. We are not going to do any password cracking, brute forcing, etc. We are just going to change the UID number. Yes it is that simple.

First, logon to the distro as Root. Backtrack is defaulted to root. We then need to mount the hard drive where the passwd file is that we want to get to. sda would be your hard disk, I am using this for an example. I would do the following commands in sequence:

#mkdir /tmp/passrecov
#mount /dev/sda1 /tmp/passrecov/
#nano /tmp/passrecov/etc/passwd

Next you would find the user you wanted to be root and place a zero in the UID. You would then save the file.

Next you would then reboot the system, login as the new root user and execute a simple password change from the console to change the root password to something you can remember.

#passwd root
NEW PASSWORD:
VERIFY PASSWORD:

That’s it. I hope this helps.

Stand Alone Squid Proxy Installer (SASPI for short)

2008-07-12T21:34:00.000-07:00

The other day I wanted to install a simple proxy for my home network. Since I am behind a satellite connection at the time I want to save all the bandwidth as possible. I was looking at some window’s proxy software and it all looked, “lame”. I thought about installing squid on one of my linux boxes. Then that would just be a server that would have to be on at all times. Long story short I downloaded the Windows port of squid and installed it. After about 30 minutes tinkering I finally got it working the way I wanted it to. I started to think that most people don’t want to spend even that much to install squid. They will choose one of those crappy window’s solutions. So I had to come up with a way to rival them. A decided to make the viable solution SASPI.

SASPI is a single installer that will install to the C:\ drive. When you run the installer all you should do is click the next button. You should leave all the defaults exactly the same. Once you go through all the installation steps you will come to the last screen. Be sure to run the program when you exit. This will ensure that the configure.exe program will be ran. This ensures everything is setup as a service. After this is completed you will your proxy should be working. Of course when you configure your browsers and programs the address of the proxy is at: localhost and the port is: 3128.

If you want to run this as a proxy server on a windows 2003 server or XP pro machine you first need to install it. Once installed you will need to open up:

C:\squid\etc\squid.conf

Once you have this open do a search for:

acl me

It will find something that will look like

acl me src 127.0.0.0/8 http_access allow me

What you will have to do is add your own acl rules for whoever will be accessing this proxy below this existing rule. So let’s say you have users on the class C network of 10.10.10.0/24 accessing it you will have to add:

acl 1stnetwork src 10.10.10.0/24 http_access allow 1stnetwork

You will have to add this below the existing rule. I wanted to reiterate this again since it is important.

For more you can go to http://wiki.squid-cache.org/

Go to http://www.systemsgate.com/saspi.html to download the installer.

Why Not?

2007-01-03T21:47:00.000-08:00

Ahhh yes. The blog. Why not? Everyone else has one so I thought that I would have one. Here we go.