Geoff

As a general rule of thumb I try not to have any interpreters (Java, Silverlight, Ruby, IronPython, Powershell) or compilers (more an issue on *nix) on servers. While in some cases it's necessary (good look runing a Minecraft server without Java) it's best practice to reduce the surface attack area as much as possible.

Poking around in my bag of tricks yields: workflow Find-Duplicates { [CmdletBinding()] param ( [parameter(Mandatory=$True)] [string]$Path ) if (!(Test-Path -PathType Container $Path)) { Write-Error "Invalid path specified." Exit } $LogFile="c:\temp\results.csv" $CheckpointFile="c:\temp\check.txt" Write-Verbose "Scanning Path : $Path" $Files=gci -File -Recurse -path $Path | Select-Object -property FullName,Length $MatchedSourceFiles=@() ForEach ($SourceFile in $Files) { Write-Verbose "Source : $($SourceFile.FullName)" [array]$MatchedSourceFiles=InlineScript { $MatchedFiles=@() $CurrentMatches=$Using:MatchedSourceFiles $MatchingFiles=$Using:Files |Where-Object {$_.Length -eq $Using:SourceFile.Length} Foreach ($TargetFile in $MatchingFiles) { Write-Verbose "Checking File $($TargetFile.FullName)" ($CurrentMatches | Select-Object -ExpandProperty File) | % {Write-Verbose "List1 : $_"} if (($Using:SourceFile.FullName -ne $TargetFile.FullName) -and !(($CurrentMatches | Select-Object -ExpandProperty File) -contains $TargetFile.FullName)) { Write-Verbose "Matched $($Using:SourceFile.FullName) and $($TargetFile.FullName)" if ((fc.exe /A $Using:SourceFile.FullName $TargetFile.FullName) -contains "FC: no differences encountered") { Write-Verbose "Match found." $MatchedFiles+=$TargetFile.FullName } } } if ($MatchedFiles.Count -gt 0) { Write-Verbose "Found Matching Files. Adding Object." $NewObject=[pscustomobject][ordered]@{ File=$Using:SourceFile.FullName MatchingFiles=$MatchedFiles } $CurrentMatches+=$NewObject } $CurrentMatches } Checkpoint-Workflow } $MatchedSourceFiles | Export-CSV $LogFile -NoTypeInformation }

https://www.youtube.com/watch?v=f99PcP0aFNE

Some of us are still running a BBS.

Most muggles are under the mistaken assumption that The Internet = The World Wide Web. For those in the know and possible were around before everything got ruined know there's far more stuff on the internet than is available through your web browser. Consider the joys you are missing out on of IRC, FTP, Usenet and various telnet sites. Granted most of these services can be cajoled into working via a web interface but you are missing the point and more importantly missing the extra features, flexibility and speed of a dedicated client. Also, I take great annoyance when uninformed people, such as in the media, lump anything other than websites as the 'Dark Web' like it was some sort of mysterious force. It's not magic, it's just a password protected FTP server full of child porn ffs.

You need to restore from before the point of infection. This requires that you be able to detected the infection in a timely manner and have backups going back far enough that you can do a restore successfully. Our detection time is minutes for known ransomware and worst case so far 24 hours for unknown. Our backups go back 12 months.

Where is the tipping point for this? How many FTEs?

It's not just that, you get 'continuous' feature updates with Win10 Enterprise/Education unless you use LTSB in which case you get you only get security and bug fixes on a schedule you control. You also get some features stripped out such as: The Windows Store Cortana Almost all Metro Apps Microsoft Edge Therefore I don't know why you would use anything but LTSB in an Enterprise / Educational setting.

You've told /srv/pillar/top.sls to look for /srv/pillar/dhcpd.sls and /srv/pillar/bind.sls for a minion matching 'server2.school.local'. What is the content of these files?

That must cost money in the long term (labour overheads, duplication of equipment, etc).

That's nothing new, when I was in high school in the 90's the last lesson of the day finished at 3.20pm. I then used to go to the computer club after school. I used to get home for 5pm - 5.30pm.

Sounds busted then.

It should say if it is disabling it in the logging.

Spanning Tree, BDPU guard or loop protection can cause this. What does the logging say?

Websense says 'Educational Materials'

I use a straw, obviously.

Just make sure the your remote access can't be brute forced (rubbish passwords, etc). We use two factor auth here.

I cannot speak for the wireless APs but there is no requirement for an active service contract to access HP switch firmware (unlike, for example Cisco). e.g. here is the firmware download for the E2824's we use. https://h10145.www1.hp.com/downloads/SoftwareReleases.aspx?ProductNumber=J4903A

I was disappointed to find out that fertilised earth does not work with magic crops. I have decided to build a sky base. Due to all the annoying mobs at ground level.

How did the Linux VM get infected (I assume it's a windows virus hiding in a file share or mail spool on the Linux VM)?

Relevant XKCD. https://xkcd.com/1247/

Boom Bust Boom is a Film documentary about the 2008 financial crisis and economics & capitalism in general. It is written and directed by Terry Jones of Monty Python fame.

Plenty of companies release close source apps on Linux. Oracle would be an obvious close example to what Microsoft is doing with SQL server.

As I said in the other thread, I am not suprised Microsoft is using Open Source tools in Azure. In this case being Linux to run SDN (Software defined networking). What I am suprised about is that they released it at all.