PiqueABoo

Some of Ben Laurie's take on the "extremely serious vulnerability" that Debian added to OpenSSL. ... I've ranted about this at length before, I'm sure - even in print, in O'Reily's Open Sources 2. But now Debian have proved me right (again) beyond my wildest expectations. Two years ago, they "fixed" a "problem" in OpenSSL reported by valgrind[1] by removing any possibility of adding any entropy to OpenSSL's pool of randomness[2]. The result of this is that for the last two years (from Debian's "Edgy" release until now), anyone doing pretty much any crypto on Debian (and hence Ubuntu) has been using easily guessable keys. This includes SSH keys, SSL keys and OpenVPN keys. What can we learn from this? Firstly, vendors should not be fixing problems (or, really, anything) in open source packages by patching them locally - they should contribute their patches upstream to the package maintainers. Had Debian done this in this case, we (the OpenSSL Team) would have fallen about laughing, and once we had got our breath back, told them what a terrible idea this was. But no, it seems that every vendor wants to "add value" by getting in between the user of the software and its author. Secondly, if you are going to fix bugs, then you should install this maxim of mine firmly in your head: never fix a bug you don't understand. ...

I looked at this stuff in 2000 days and dismissed it as useful for me: I thought you couldn't use the custom class ids to get IP addresses from a different scope, just a different set of options from the same scope everything else uses on the same subnet (different gateway, DNS, ..). Someone might know better though.

> then use dcpromo /adv to promote the server That server needs to be an existing member server doesn't it? > I think the issue is because I am using different set of hardware Yes... but it's usually not *that* hard to do. Make a 2K3 boot floppy and set the boot.ini to start in safe mode.. if you copy the mass storage (disk) driver for your new hardware on to that floppy and perhaps tweak the boot.ini to reflect the new home you can often get the OS up. You didn't say what it was, but the common BSOD is because of an incorrect disk driver. The required HAL is mostly Multiprocessor ACPI everywhere these days, but swapping that isn't too hard either i.e. if you don't want to do it the hard way, the 2K3 CD repair will normally fix that (+ you can use F6 for the disk driver). When it's up in safe mode start stripping redundant drivers and installing new ones. You can get a few icky loose ends to sort out, but nothing that seems too bad with hindsight. I think it's worth persisting in trying to make that VM work because the stuff you're likely to learn can sometimes be useful for lesser disasters. PS: Make sure you've got a 2K3 CD at the same SP level for repairing.

Ughh.. out of practice talking about this - I probably should have said "at least one of the array dimensions". Yes. Think of your 2D array as a 1D array of 1D arrays. The compiler can handle a (unspecified size) one dimensional array of [thing]s provided it can figure out the precise size of one [thing]. From my declaration it can figure out that: "size of a [thing]" = SOMESIZE * sizeof(int); That'll be lesson #27.. or at least I hope it is coz I'm sick of seeing classes used in cases where a bit of straight C-like code would have been far simpler and much more efficient.

For 2-D you must pass the size of at least one of the elements e.g. void somefunction (int x[][sOMESIZE]) Not that you'd do anything like this in the first place, but that's probably lesson #27.

> Who does CC3 installs on networks? Uh? If a system support buck stops with me then I'm going to do my best to ensure that system is put together in a consistent way by someone with a clue.

I'm not clear about the problem. Are you saying: Last week: GroupA was in the address book and contained accounts X,Y & Z. This week: GroupA in the address book and only contains account X, but if you look in the AD GroupA it still contains accounts X, Y & Z. Oh and that no one has been doing evil things with AD permissions inbetween?

> leases are set at 8 days so will your settings from the linked post be OK? That relationship is quite complicated, but doesn't matter too much unless you're seriously bothered about replication traffic. IIRC 8 days is the default DHCP lease, so stick with the defaults for DNS scavenging. Very key point: If you have any manually added DNS RR's then make sure scavenging is turned off on the properties of those particular records.

> Ok I will bite what you heard about cc4 and for what reasons see if can > confirm do deny stuff for you... I wasn't fishing, honest. I've got the means to throw my concerns at RM too, so I'll save it until I find out if it's true, and if so whether it's something on their to-fix-later list or set in stone. > remember like lot of upgrades nt to 2k, 2k to 2k3 some people will > and so won't. Sure but neither of those is quite so straightforward in RMsville: It was the NT svr + 9x -> 2K[3] svr + XP which was a significant jump with significant benefits all round. Motives for the svr 2K to 2K3 are things like the 2K box is past it, and upgrading it to 2K3 is a relatively small part/cost of moving the contents over to a shiny new server... and/or things like Capita dropping support for SIMS on 2K. CC3->CC4 upgrade obviously gets you some new some new management tools, but means rebuilding all your desktops (and paying a significant upgrade cost for each one) to typically end up where you are right now, except with more stress on the server and potential teething troubles for a year or two. That's very hard sell or it should be to anyone spending public money. I certainly wouldn't upgrade to CC4 until it came on 2K8, and I probably still wouldn't do it until the raison d'etre, the applications an organisation wants to run on the system, begin to stop working on XP, or 2014... whichever comes first. Again it will be interesting to see what people actually do and why.

> Network admins were asking for more and more from it. The problem with that is that the more you add the less simple it gets. Ultimately, why would you spend extra money buying something that essentially substitutes one pile of complexity with another? [A tangential issue is that the vanilla admin tools have inevitably been less buggy than anyone else's] > So third parties like RM with CC4 still have a very relevant product. Non-BSF CC4 progress in the world, especially CC4 whenever it gets around to running on 2K8 will be interesting. FWIW if a couple of the changes I've heard about turn out to be true I'll retire from challenging the Can't Do X-ers because they'll be right, although not necessarily for their reasons.

> You can't do a simple rename of a PC with CC3 Yup, that's a true and good criticism.

> Well at the moment I am trying to make users change their password at next login > using Active directory > computers and users. When they log on nothing happens. > I could be wrong but I'm thinking RM CC3 is stopping this happening? ::shrug:: I don't think so. I just used ADUC on a CC3 system to force a password change on an account it just worked - an ' orrible little RM password change dialog popped up. And since we're all vanilla experts we know the only place RM might be getting in the way is with their custom GINA. But again being vanilla experts we know that if you've forced a password change in AD, Windows will not let the account logon until that is done i.e. if RMs GINA were blackholing the requirement for an immediate password change you'd know about it. > We installed italc onto two classrooms, it worked perfectly in the vanilla room > without any hassle. The CC3 room has problems, the multilogon feature does > not work, the execute remote scripts does not work. :shrug:: Then that's almost certainly just the security settings interfering and suggests to me your vanilla's aren't very well locked down. But since we're all vanilla experts we're perfectly happy customising anyone else's configuration of regular vanilla GPOs, firewall, file and hash rules to accommodate all that lovely educational software that is far too brilliant to follow long-standing MS guidelines. Aren't we...? -- I'm just teasing OK? But not too much.. ;b

> this has turned into a great thread. Hmm.. it's pretty much ye olde Linux vs. Windows debate with a few left shifts. While I consider what that implies, perhaps some vanilla expert can tell me what vanilla stuff they can't do on a CC3 box?

> I thought loopback processing would apply to JUST that policy, but maybe > to all? Loopback-replace means that user policy will only come from (the user sections) of any GPOs that apply to a given computer. It will stop all the GPOs you have applied to your Students OU from being used. It definitely sounds like the root cause...

I've done Exchange 2003 syncing for a variety of WM versions via ActiveSync or via wireless from anywhere on the net and it's a bit fiddly. Key things were: Rearranging a vdir in IIS and a cert with external FQDN, CA on PDAs and proxy exceptions on PDAs. If it's just internal I'd do all the same stuff, except I'd leave the IIS cert alone.

The curse of the MS sysinternal assimilation - the eula thing sounds feasible and I think the best way is to put the "/accepteula" option on the command line.

> I've just installed it and it's still v3264 Is the SP3 install file digitally signed?

I'm contemplating the options for making the best of a two site system with a slow (symmetric 2MB) link between them. Kids move around and may need access to their docs at the other site tomorrow, so we have overnight to play with. Is anyone using DFSR in practice for something like this? How is it? What can you get away with etc? I want to play with this on the lab bench. That may end up being virtual (ESX lets you limit bandwidth per VM), but if not does anyone know of a good, preferably free ,way to throttle bandwidth to emulate performance accross say a 2MB & 10MB links? If not free then 30-day trial will be long enough

Was interested in this coz I once did lots of stuff with client certs and it rang some kind of bell. Then Google threw up this re. ISA: Ding! I suppose there's the obvious stuff e.g. is the client cert valid (e.g. in date)? Is it possible to test it directly without traversing the ISA server?

Guess it depends what you mean by "manage". I had a scenario where I only wanted an account to be e-mailed Win 2K & 2K3 server events that were uhh.. events I'm interested in and on reflection, being told once a day was quite enough (which conveniently allows you to have things like just one e-mail for 27,000 identical overnight error events). So a key point was decent-ish customisable filtering. Next attribute was free <-> very cheap, because I had quite a lot of servers in mind. Looked far and wide, there was a reasonably good one (don't have name to hand) but it was a bit too far over very-cheap. So I just ended up writing it, and because it's me that's a CL-util you schedule and the config changes are done by text-editing a reg file of target logs, event filter rules etc. Then it took a couple of *months* of events arriving and a fair amount of event research before I arrived at a filter set that did a pretty good job of filtering out the chaff-on-those-servers-according-to-me[tm] and it's still a work in progress. I'd have had to do the same with all the commercial products I found though - and I'm not sure I'd bother with this stuff for say less than 10 servers. PS: One thing that fell out of this I wasn't expecting until I got hindsight, was the relative fragility of event logs. The app knew perfectly well where it was at last time, but I ended up making it scan an entire event log every time in order to detect corruption.

Me too - although it working when you manually add the arp entry to your admin box makes sense.. ..and that strongly implies everything is on the same subnet. So I don't get the RRAS DHCP routing part. Why do you need that?

Language support.

If you have the MS "Support Tools" installed on your Main DC (you really should) then open a Command Prompt and enter this command: netdom query fsmo If all five roles point to your "main domain controller", then demoting the failing box should be relatively straight-forward.

Yes. And like NetShell (netsh) in XP/2K3, nslookup, telnet... etc. You could see this coming surely: Which nine tasks are those then? I haven't seen that compelling reason for SC yet and I'm thinking of things like this: One day your SC box isn't playing nicely, remote GUI mangements apps can't talk to it but the console is alive.. now diagnose the problem & fix it.

I'm struggling to think of anything I couldn't configure from the command line in 2K3 + support tools, struggling even more if you add reskit and let me write script. 2K8 seems to be more or less the same. I expect in practice most people will use the GUI managements tools remotely for 2K8 server core maintenance e.g. looking at event logs, fiddling with f/w policy, admin of whatver services they've added etc. When/if they add powershell to server core, obsessive geeks will of course spend ten-times longer on some of those tasks trying to correctly spell 12 syllable cmdlet names and remember their syntax & arguments.