teknowfile

Splunk Management Port

2018-01-16T08:55:00.001-08:00

The Splunk management port 8089 has come up repeatedly in enterprise wide security scans. I understand the security team's concerns: This port runs HTTPS with a self-signed certificate, which is a big no-no for any IT person who is even slightly security conscious.

Self-signed TLS certificate is not a security threat in and of itself. The main weakness is that, unless the Certificate Authority is known to clients connecting to the port, the clients are left to trust that certificate, rendering the connection prone to man-in-the-middle attacks.

To make a self-signed certificate as secure as a public CA signed one, Splunk just need to verify the self-signed cert using the signing CA cert. Or, even better yet, mutual authentication may be performed on these connections. However, that also means much stricter management of these certs.

My organization's security team suggested that we get third-party signed certificates for all the Splunk forwarders, which means we would need to obtain hundreds of certificates. That number could potentially grow to over a thousand or two. We are part of a large university with the benefit of largely self-administered certificate signing. But managing such a number of certificates is still a pretty big task unless the entire workflow of certificate creation, signing and renewal can be automated.

One remedy is to disable the port on all Splunk installations where the port is not absolutely needed. That means all the Universal Forwarders, whose main purpose is to collect data and forward to indexers. However, port 8089 is labeled a management port. Access to Splunk's REST APIs goes through that port. Disabling it means apps depending on the REST APIs, such as the UFMA app, may not function as designed.

The management port obviously exists for a reason. Beyond the REST API, do we lose any other functionality if we have to disable the port?

So, You Can't Even Buy VPN App in China

2015-08-25T16:43:00.003-07:00

I went to Amazon to buy the Cisco AnyConnect app to connect back to UM through VPN.

As it turns out, you can't even do that in China:

Does Anyone Still Care About the Basics?

2015-06-29T06:24:00.001-07:00

Cisco's software has always been challenging. Much of those challenges, to put it bluntly, come from the company's neglect.

Here is a simple example: Click this link, select the "Cisco 4500" from the "Cisco Access Products" list, and click the "Go" button, instead of another page seemingly from the year of 1996, you get a 550 error.

How pathetic is that?

Splunk, SSO, Enterprise Security

2015-04-08T09:02:00.000-07:00

Splunk is a powerful tool, therefore it is natural that the need to secure it in an enterprise is strong. With the push from upper management to secure access to privileged systems, 2-factor authentication (2FA) is the next defensive weapon to be deployed against attacks from both the outside and inside.

Looking into authentication and authorization mechanisms, especially SSO (single sign-on) in Splunk, it is amazing how much things have stayed the same since I first installed Splunk 4 back in 2011. This time, I am investigating the feasibility of using SAML 2 for Splunk to achieve both single sign-on and role-based access control (RBAC).

What I have found so far are not very encouraging and I seriously hope that someone prove me wrong.

Splunk has a number of ways for user authentication:

Splunk internal: User information is stored in Splunk itself. A user would have to sign on each and every time visiting a different Splunk web host.
LDAP: Splunk uses an LDAP server as user ID store.
Proxy SSO: Splunk web must run behind a proxy server, such as Apache or IIS, which actually implements the sign-on part of SSO.
Scripted authentication: Splunk calls a custom script to perform user ID acquisition and authentication.

For user access authorization:

LDAP: Using LDAP for authentication allows Splunk to map LDAP groups to Splunk roles for access control.
Script: The script for authentication is also used to assign roles to the user.

Splunk does not seem to allow both SSO and RBAC simultaneously: The only mechanism for SSO is running Splunk web behind a proxy server. But in that case, it still relies on internally stored user information or LDAP group mappings to assign roles to an authenticated user, if this post in the Splunk Answers still holds true. Even if that changes, fronting every Splunk web service with a proxy creates an administrative challenge when you have many Splunk search heads running on both Linux and Windows, for example. Unless, of course, one uses something like Novel NetIQ or Citrix NetScaler. But those mechanisms introduce complexities of their own.

Scripted authentication would offer a way to implement both SSO and RBAC simultaneously if Splunk passes along HTTP request headers to the script. But that does not seem to be the case from reading their documentation.

Asus C300M: A Nice Chromebook but I want Linux

2014-12-02T20:27:00.000-08:00

I bought an Asus C300M Chromebook yesterday, with the plan to turn it into a little Mint Linux laptop.

Went searching online, there were lots to be found but all seemed to be about older Asus Chromebooks, like C200 or C300. Not sure if C300M is related to C300 or not. But so far I have not been able to get into the Developer Mode yet, although I did get it to flash this with a "localhost login" prompt on the screen:

The problem is that the prompt just flashes for a fraction of a second. There is no time to login.

I will keep on trying to figure this out. But if anyone has any tips on how to get into the Developer Mode, please share! Thanks in advance.

By the way, Chrome OS works nicely on this little machine. But I want to take the box to a country where most of Google's services are blocked by the government, which is the main reason for me to try installing Linux besides the fun of breaking things.

Weak Product, Bad Design

2014-11-27T11:16:00.000-08:00

Received with Bulbs Bumping Around Loose in Box

Purchased the product on eBay to replace burnt out bulbs. The package came pretty fast. I heard something knocking around inside. I opened the padded envelope, took out the box and saw the bulbs running loose in it.

The plastic piece in the box is obviously designed to hold the bulbs in place for transportation. But it is not doing the job. I actually spend a couple of minutes trying to figure out if the bulbs could be put in the holder. I finally give up as it seems that the bulbs simply would not fit.

From the packaging, I am sure that this is not the only box that went out with the product jumping around inside. I do not know if that could damage the bulbs or shorten their lives in anyway. But I am positive that the manufacturer does not want the bulbs running loose, as otherwise they would not need the holder and save a penny with the packaging and transportation.

I installed the bulbs and turned on the low beam. I was not sure if I messed up or something since there seemed to be no light coming out of the headlights -- Only did I see the lights when I stepped right in front of car. The light was bright white, but not as much as I expected.

All in all, I have to say I am less than impressed by the product so far. It seems to be much weaker than advertised. I will have to wait for a drive out in the dark to get a real feeling of how the bulbs work.

VirtualBox Raw Disk Access Problem on Windows 7

2014-11-20T21:25:00.001-08:00

For quite a while I have enjoyed running a guest Mint Linux virtual machine on a laptop that must run Windows 7: I pulled out the PC's SATA CD/DVD drive and put a second SSD in its place. To run a VM from a raw disk, VirtualBox has to be manually configured to do that and it must be run as Administrator in Windows.

All that was well, although not without a few kinks I considered minor, until this morning. All of a sudden, I got a dialog box from VirtualBox saying that it failed to start due to permission issues. Here is a list of relevant messages I've copied from the log file, which should read better than the small dialog box:

00:00:01.774460 VDInit finished
00:00:01.775010 AIOMgr: Endpoint for file 'D:\MEMEME\vbox\mint.vmdk' (flags 00040723) created successfully
00:00:01.775716 AIOMgr: Endpoint for file 'D:\MEMEME\vbox\mint.vmdk' (flags 00040781) created successfully
00:00:01.775867 AIOMgr: Endpoint for file '\\.\PhysicalDrive1' (flags 000c0781) created successfully
00:00:01.775885 VMSetError: D:\tinderbox\win-4.3\src\VBox\Devices\Storage\DrvVD.cpp(3061) int __cdecl drvvdConstruct(struct PDMDRVINS *,struct CFGMNODE *,unsigned int); rc=VERR_VD_IMAGE_READ_ONLY
00:00:01.775911 VMSetError: Failed to open image 'D:\MEMEME\vbox\mint.vmdk' for writing due to wrong permissions
00:00:01.775923 VD: Opening the disk took 1593453 ns
00:00:01.776149 VMSetError: D:\tinderbox\win-4.3\src\VBox\Devices\Storage\DrvBlock.cpp(1077) int __cdecl drvblockConstruct(struct PDMDRVINS *,struct CFGMNODE *,unsigned int); rc=VERR_VD_IMAGE_READ_ONLY
00:00:01.776153 VMSetError: Failed to attach driver below us! Image is read-only.
00:00:01.776169 VMSetError: D:\tinderbox\win-4.3\src\VBox\Devices\Storage\DevAHCI.cpp(8450) int __cdecl ahciR3Construct(struct PDMDEVINS *,int,struct CFGMNODE *); rc=VERR_VD_IMAGE_READ_ONLY
00:00:01.776171 VMSetError: AHCI: Failed to attach drive to Port0
00:00:01.776180 PDM: Failed to construct 'ahci'/0! VERR_VD_IMAGE_READ_ONLY (-3205) - Image is read-only.
00:00:01.910243 ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={8ab7c520-2442-4b66-8d74-4ff1e195d2b6} aComponent={Console} aText={Failed to open image 'D:\MEMEME\vbox\mint.vmdk' for writing due to wrong permissions (VERR_VD_IMAGE_READ_ONLY).
00:00:01.910298 Failed to attach driver below us! Image is read-only. (VERR_VD_IMAGE_READ_ONLY).
00:00:01.910299 AHCI: Failed to attach drive to Port0 (VERR_VD_IMAGE_READ_ONLY)}, preserve=false
00:00:01.927049 Power up failed (vrc=VERR_VD_IMAGE_READ_ONLY, rc=E_FAIL (0X80004005))
00:00:02.011279 UIMachineLogicFullscreen::maybeAdjustGuestScreenSizeOpenGL Error: Render SPU: (MakeCurrent) failed to make 0xe00112d5, 0x10000 current with 0x6 error.

I have checked the permissions on the "mint.vmdk" file, both my account and the local Administrators group had full control on the file. So that couldn't have been the file with read-only permission causing this indigestion.

I have also run DISKPART and checked that the disk was not set to READ-ONLY.

I have discarded my saved image and tried to start the VM from a clean state. All to no avail.

I am trying to fix this problem, but thought I may be able to get some help from the community by posting it to the VirtualBox forum.

[EDIT 2014-12-02]:Upgraded to VirtualBox 4.3.20. The problem persists. My suspicion of DDP|E grows deeper.

[EDIT 2014-11-25]: No progress on this issue. Sent email to Credent support (DDP|E was purchased from Credent, I guess.) Falling back to boot Linux on the laptop.

[EDIT 2014-11-23]: From every troubleshooting I could think of, it seems that the disk is held by some process that prevents VirtualBox from being able to write to it.

C:\Program Files\Oracle\VirtualBox>.\VBoxManage.exe internalcommands
listpartitions -rawdisk \\.\PhysicalDrive1
VBoxManage.exe: error: Cannot open the raw disk: VERR_SHARING_VIOLATION

C:\Program Files\Oracle\VirtualBox>.\VBoxManage.exe internalcommands
listpartitions -rawdisk \\.\PhysicalDrive2
Number  Type   StartCHS       EndCHS      Size (MiB)  Start (Sect)
1       0x07  0   /130/3   1023/254/63        122747         8192

From the SystemInternals Process Explorer, it seems that the Dell Data Protection's CmgShieldSvc.exe process is the most suspicious.

[EDIT 2015-05-08]: The issue is resolved in the latest DDP|E release --- kudos to our Windows image team and their working with the Dell (Credent) engineers.

Come On! USPS!!

2014-11-18T18:52:00.000-08:00

The US Postal Services has been losing money for years and years. It seems to they just can shake the bad karma.

I am trying to send a flat-rate first class package. I remember I could fill out the forms and print shipping labels online. So online I went.

I registered a personal account -- I want to support the government, I do, then filled out forms, and here is what I got:

We're Sorry

We're sorry

Our system is experiencing problems. Please try again later.

I think I am probably the one feeling sorry: It seems that they are reenforcing people's perception that the USPS can't do anything right. They seem to be letting someone else' incompetence drag them down the drain.

To all those who say The government is the problem, my suggestion is that they need to take a course in basic logic. Don't get me wrong, I am not saying that the government doesn't have problems -- It's just that we all do. With regard to problems in the government, like the one shown in the screen shot above, the problem is not the government. The government doesn't know how to build a website. In this case, I don't really blame the USPS. I would rather see whomever contracted to build this website gets exposed. I would like to see every contractor's name printed on every government website ever built, so we the people can get to know who those idiots are: They seem to have no problem taking the money from the government, the tax payers' government and the tax payers' money, but they seem to lack the basic decency of trying to do the job.

So, how about that, the USPS? Whoever built this broken website, print the names of the contractors, the company, the project manager, the project team leads, on the website, so they can take pride in what they have done with our money.

[Solved] At a Lost with Windows 2012

2014-09-23T06:28:00.002-07:00

In trying to get the Splunk tech add-on TA-nessus from Hurricane Labs to work on a pair of Windows servers, I created some DOS batch files that works fine when manually run. They also run fine on a Windows 2008 R2 server running a Splunk Universal Forwarder. Here is one of batch files, update_plugin_lookup.bat:

@echo off

rem -- To get rid of cygwin's complaints about DOS style path:
set CYGWIN=nodosfilewarning

E:\cygwin64\bin\bash.exe "%SPLUNK_HOME%/etc/apps/TA-nessus/bin/update_plugin_lookup.sh" %*

Then the shell script, update_plugin_lookup.sh, is modified to this to work with Cygwin's bash and python:

#!/bin/bash

#unset LD_LIBRARY_PATH

export PATH="/bin:/usr/bin"
cygpath=`which cygpath 2>/dev/null`
if [ "$cygpath" != "" ]; then
    splunk_home=`"$cygpath" "$SPLUNK_HOME"`
    export SPLUNK_HOME=`"$cygpath" -w "$SPLUNK_HOME"`
fi
export PATH="$PATH:$splunk_home/bin"

#cd $( dirname "${BASH_SOURCE[0]}" ) || cd "$splunk_home/etc/apps/TA-nessus/bin"
cd "$splunk_home/etc/apps/TA-nessus/bin"

./update_plugin_lookup.py $*

The problem is, on a Windows 2012R2 server running a Splunk search head, the scripted input running the update_plugin_lookup.bat command only generates a line in the splunkd.log file that reads:

09-23-2014 04:15:00.013 -0400 ERROR ExecProcessor - Couldn't start command "E:\Splunk\etc\apps\TA-nessus\bin\update_plugin_lookup.bat": The operation completed successfully.

I checked file permissions for the local SYSTEM account on the 2012 server, as I suspected that may be a factor. But that did not seem to be the issue.

I have downloaded the PsTools from SysInternals and manually run the batch command as the local SYSTEM user. That worked without a hitch.

I am at a lost of ideas to try at this point, so I am going to post this to Splunk Answers and other forums to beg for help.

[Edit - Problem resolved] : This turned out to be a file permission issue, after all. I thought I did grant executable permission to local SYSTEM on the 2012R2 server. But I did not succeed in doing that. Then because I was able to run the batch command file as local SYSTEM with the help of PsExec, I let the suspicion slip out of my mind.

Why is Adobe so Sneaky?

2014-08-15T06:02:00.000-07:00

Adobe has been doing this for quite some time:

For whatever reason, I guess some kind of financial gain, they decide to it is a good idea to sneak in a copy of McAfee Security Scan Plan on one's PC when a person is not watching carefully when installing or upgrading the Flash player.

What I don't understand is: McAfee? Really, Adobe?

Installing Windows 7 on a Samsung Ultrabook

2014-06-18T09:53:00.000-07:00

Windows 8 seems still hated by many. After using its successor, the 8.1 upgrade briefly, I have actually grown to accept it. I like its hot corners and the ability to search for apps or online resources in a single search box. When a friend asked me to install Windows 7 on his new Samsung Ultrabook, I upgraded it to Windows 8.1 first and asked him to give it another try. But he asked again in a few weeks, so I accepted the challenge.

His Samsung Ultrabook NP540U3C-A03UB is a nicely built little machine, thin, light weight, with a battery that seems to last long enough, although with the screen size it could have had a higher resolution display. I didn't expect it to be an real challenge, so I was a little disappointed to find it not able to connect to my home wireless network, or even the wired Ethernet after finished installing Windows 7. But when I found no Windows 7 driver download on Samsung's website for this model, I became a little annoyed.

Samsung was nice enough to have a live chat link on the support site. So I started a chat window and connected to a support tech pretty quickly. We went back and forth for a few rounds on what my OS was and my dilemma of not being able to find drivers on the website for it. Then he told me that it meant that the PC was not compatible with Windows 7. I told him that was the most incredible thing I had heard in a long time and closed the chat.

I don't blame the support tech. It was not his fault that Samsung decided to not provide any Windows 7 support for this laptop. Samsung probably got financial benefits from Microsoft for doing so to push Windows 8 and ignore their own customers.

So I had to go on my own. The support tech did provide a useful tip, which was that I could use the Samsung SW Update tool on a non-Samsung PC. I did that. First I found an earlier model of the Ultrabook, NP540U3C-A03UB, which did support Windows 7, and downloaded the Wireless LAN drivers. Luckily, the two models did use the same (or similar) Intel Centrino wireless chip that the driver worked.

Once on the network, I was able to download and install the Samsung SW Update tool on the Ultrabook. Then I was able to find a list of the drivers available for Windows 8 on this machine and compare the list to other Samsung models with the same or similar hardware that support Windows 7. From there, finding and installing all drivers, except for the touch screen, became much easier.

It turned out, I was able to get all drivers from two other Samsung models:

From NP530U3C-A03US, I got:

Wireless LAN driver, which I later upgraded to the latest version found on Intel's website.
Graphics: Intel HD Graphics 4000, Intel® Iris™ and HD graphics Driver
USB 3.0: Intel USB 3.0 eXtensible Host Controller Driver

From NP550P5C-A03US:

Chipset: Chipset Driver
Intel Management Engine (ME) Interface: Intel ME Interface Driver
Ethernet: LAN Driver
Utilities:

Easy Settings
Easy Software Manager
EasyFileShare
ExpressCache
Intel Rapid Storage Technology

After that, the Ultrabook became a fully functional Windows 7 machine.

Cisco IOS Tidbit

2014-01-14T13:23:00.001-08:00

When testing a SNMP configuration for Cisco switches, I wanted to use a named access list to give SNMP v2c access a bit security. I started with an extended IP ACL.

When I configured an SNMP community string:

snmp-server community blahblah ro acl-snmp-read-only

The switch accepted that command.

But when I then do a "show running-config", my configuration is not there.

It seems that Cisco IOS doesn't really allow extended access list. But it doesn't tell you either. The "snmp-server community" command is simply silently dropped. This seems to be the case with code version from 12.2(55)SE4 on a C3750 to 03.01.01.SG on a Catalyst 4500 L3 switch.

Fun with Comcast begins -- Cable TV is Dead!

2014-01-14T12:57:00.002-08:00

Fun with Comcast begins.

Over the holiday season just passed, I finally changed my ISP from ATT Uverse to Comcast. When paying my first bill online, I noticed a $39.99 charge that was labeled "miscellaneous charge". So I called Comcast's customer service. Twenty some minutes later, I got a rep on the phone and was told that was a charge for a "Technician visit".

I told him I never ordered a "technician visit", nor did a technician visit my house.

He told me to hold the phone. Two minutes later, he returned and told me that the charge had been removed.

That was pretty quick. But the fun part was yet to come.

When we finished the business about my first bill, I mentioned to the rep that I received a TV set top box that I was not going to use, so I would like to know if I could just drop it at a local Comcast office.

I was really surprised then, when I was told that I could not "not use" the TV set-top box, that I had to activate it, or the service bundle would be revoked and I would have to pay more.

I asked, so even if I paid for the bundled services and I decided to not use part of it, I could not do that?

"No", the service rep replied. "We would not be able to prove that we provided the bundled services to you. So you would have to pay the unbundled price."

Hmm, I didn't buy that, but I didn't want to make that into an argument. So I just said "Interesting!" and let it go.

The Comcast device is still in its cardboard box. I do not intend to use it. I have no interest in cable TV programs.

CABLE TV IS DEAD! I guess Comcast don't want to accept that. We'll see.

Good-Bye, at&t!

2013-03-19T14:43:00.000-07:00

I strongly disagrees with at&t on the "Weev" case based on this Wired report (AT&T Hacker 'Weev' Sentenced to 3.5 Years in Prison). If the report is not proven wrong, I am going to say good-bye to at&t.

Maybe for good this time.

At&t 2Wire Gateway

2013-02-25T23:30:00.001-08:00

I have to delete a previous post as the rant was off the target: I thought that at&t might be blocking ports entering my home. But the real problem turns out to be in the 2Wire gateway device -- more specifically, in its firewall settings. I forgot to check if my previous setting was changed. But anyway, resetting its firewall to expose the next router as a DMZ device -- which is where my port forwardings are configured -- has solved the problem.

At&t may still be to blame, as the firewall configuration change could not have happened by itself, but could have been the result of firmware upgrade in the gateway, or something like that.

Password? What password?

2013-02-06T09:24:00.004-08:00

This morning I mindlessly did an iOS upgrade -- I came into work, plugged my iPhone to charge it; iTunes popped up and prompted me to do some upgrade. I haven't had my morning coffee yet, so I just clicked OK. When I realized it was upgrading my phone, the process was already well under way. So I decided to let it go ahead -- I am now regretting that (non-)decision.

I was working on my PC doing whatever I was supposed to do. Then this screen popped up:

I thought, hmmm.... What does that mean? Was the upgrade completed? Or did it fail?

At that point, it didn't seem that there was anything else I could do. So, I went along. Then I got this:

That made me a bit nervous. If this warning came earlier, I might have stopped the upgrade even not being fully awake. But at this point, what could I do? So I hit Restore and Update.

Now that's strange! I didn't see it doing the backup. So I definitely did not set a password on the backup. I tried my Apple account password, my Windows password, etc. It just kept giving me the same password ... was incorrect message.

So I googled iPhone upgrade backup password. This one came up on top of the result:

To put it mildly, I have never liked Apple products. Now this is pushing my dislike to a level of hatred.

Planview

2012-12-12T11:03:00.003-08:00

As a grumpy old software engineer, I complain about other people's software a lot, as shown in this blog. But I must say, Planview has to be on top of the pile for being arrogant, stupid and time-wasting. I am no management expert -- I am not even a manager, but this message is a bit too much -- I don't know what you think.

The problem is caused by me closing the lid on my laptop before I finished what I was doing. When I came back to it, the session apparently timed out. I clicked on something and was shown this message implying that I might be treated as a criminal -- One would expect that a leader in an industry could at least be able to tell a simple timed out session from a criminal attack.

As for what I was doing, well -- I don't even want to go there. Here is my take on Planview: If your company is planning to implement this software and you have any say in that decision process at all, fight against it with all you have got. You will thank yourself down the road if you still work for the same organization.

They are Branded as Windows

2012-12-01T20:39:00.000-08:00

They are branded as Windows -- in fact, they have been for years. But this is how you know, it's just holes in the wall.

Pain with Windows Continues

2012-11-24T08:53:00.000-08:00

I admit that I seriously lack in-depth knowledge of Microsoft Windows, but this one still looks ridiculous never-the-less.

I am trying to hook up a ViewSonic gTablet to a Windows XP machine to load a ROM. Upon plug in the USB cable, Windows recognized the new device and popped up the Found New Hardware Wizard. All seems smooth sailing, until the wizard seems to stuck at copying a file.

Of course, when I check the destination folder, the file is there. The copying is already done but the Wizard just sits there twiddling its thumb, forever and ever. I can't even cancel it as the buttons are all greyed out. It only goes away and declares that it has finished installing the software for the device when I unplug the USB cable or power off the device.

Yet, when I plug the device back in, it is not functioning properly as an APX device. The properties dialog box in the Windows Device Manager says that "No drivers are installed for this device."

So the next thing I try is to remove the device from the Device Manager. Windows stuck again:

I guess I am going to try Linux.

[Edit 2012-11-25] -- I thought if Linux was to help, I would write another post titled "Linux to the Rescue" or something. But Linux made it so easy which made me question myself as why I started with Windows in the first place -- Possibly because most of the how-to type articles mention Windows. Well, anyway, I found this article on SlateDroid.com and followed its instructions to nvflash the tablet, which is basically, plug in the device using a mini USB cable, download nvflash, download the device image you want to install on the device and run the nvflash script -- not worth writing another post.

Windows Registry is Evil

2012-11-23T11:31:00.000-08:00

I have heard from colleagues who worked in end user support, that Windows registry was a source for many problems. But this one that just bit me int he rear is evil.

I have an old Asus EeePC running Windows XP. It was setup initially as a box to automatically logon. I wanted to give it to my kid to carry around. So I needed to turn off the auto logon. Googling "Windows XP auto logon", I found this Microsoft article titled "How to turn on automatic logon in Windows XP". So I went ahead and found the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon". I then removed the DefaultUserName entry, assuming that would be enough to disable auto logon.

Upon reboot, however, Windows popped up an error message which is quickly covered with the Windows startup screen. It seemed to just hang there. The mouse cursor moved, but Ctrl-Alt-Del did not do anything. I rebooted it a couple of times by pressing on the power button. I got distracted for a while and come back to find Windows actually timed out from whatever it was doing.

One wouldn't have thought Windows would behave like that with removing one single value from the registry. But I guess this just shows that I have not messed around in the Windows registry enough.

I ended up downloading the Microsoft Fixit program in the How to page linked above. That did work to turn off auto logon for me. Otherwise, I guess I would have to break out my Windows XP CD, go into recovery console mode, find a registry backup and restore it. That would have been the last straw to break it for me to replace this Windows installation with Linux.

Sharing the Pain from IE

2012-11-12T12:58:00.000-08:00

I just complained to a colleague, after he spent some time helping me with an issue in Microsoft Internet Explorer 8, that Microsoft wanted to conquer the world. They did it, but with whole truck loads of manure, piled up high in everybody's backyard. Now we are left to clean up all that smelly stuff.

The issue is that, the hospital has some legacy applications that run only on IE. We finally got to IE8 not too long ago after a relatively brief encounter with IE7, which was after a long tiring adventure with IE6. But some applications still require IE7. So the standard issue browser on everyone's desktop is IE8 running in IE7 compatibility mode. Web based applications that I have worked on usually are used by technical people so I usually could care less if something works in IE or not.

The latest project involves a dashboard for the non-techies, including executives, which means we are not allowed to bring a tool not sanctioned by the enterprise, such as Firefox. Fortunately, we have another colleague who has dealt with IE quite extensively. He provided information that was priceless to us, with a caveat: The tricks he gave us may or may not work. At least he had not been able to get them all to work.

The one trick is to force IE8 to render HTML as IE8, rather than in IE7 compatibility mode. There are three ways to do that:

Change Compatibility View Settings in IE8: That function is listed in Tools menu. One just needs to check off the Display Intranet sites in Compatibility View.
Add a meta tag in the HTML document head part:
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
Add an item in the HTTP response header: x-ua-compatible: IE=Edge

#1 is a non-starter because it requires manually configuring the browser.

#2 worked for my colleague right away in one of his applications. So he gave me the information to try out in my code.

It didn't work!

After a number of frustrating trials, every single time clearing IE8 cache, closing the browser, open the browser again and checking the rendering mode, etc., with no luck whatsoever, we decided to try #3.

That worked.

At this point, I am too lazy to bother with the changes in previous trials. So I still don't know if #3 alone or the a combination of #2 and #3 made it work. I am just glad that it works.

web2py and apache2/mod_python

2012-10-25T14:04:00.002-07:00

Finally got it to work!

web2py is an open source Python based web application framework. I had the fun of setting one up on a SuSE ELS 11.1 server. Not wanting to go outside the distribution to alert the server administrative team, I stayed with what are available in the repository, which does not have the WSGI module. So I went with the Python module for Apache.

There is a file named modpythonhandler.py in the top folder of web2py installation, with sample configuration in it. But following that I get an "invalid request" message from accessing web2py. I searched on Google for setting up web2py with mod_python, but it still took me some time and trials to get it right. So here is what I have learned from this experience.

One thing is to setup access to the static files (CSS, JavaScripts, etc.):

AliasMatch ^/([^/]+)/static/(.+)$ /path/to/web2py/applications/$1/static/$2

That turns request for welcome/static/js/jquery.js to the actual path to that file, which is usually in the applications subfolder.

Next, setup the handler for web2py -- All client requests pass through the handler, except for the static files:

SetHandler python-program PythonHandler web2py_modpython PythonPath "sys.path+['/path/to/web2py']"
AllowOverride FileInfo Options -Indexes FollowSymLinks Order Allow,Deny Allow from all

Next, the static files:

SetHandler None Options -Indexes FollowSymLinks ExpiresActive On ExpiresDefault "access plus 1 hour" Order Allow,Deny Allow from all

Files in all the static/ subfolders should be handled by Apache directly.

The content of the web2py_modpython.py file (the Python handler):

from mod_python import apacheimport modpythonhandler
def handler(req): req.subprocess_env['PATH_INFO'] = '/welcome/default/index' return modpythonhandler.handler(req)

The end.

VPN in Ubuntu and Upgrading to 12.10, Quantal Quetzal

2012-10-20T22:02:00.002-07:00

The latest release of Ubuntu hit the news a couple of days ago. I have been hesitant upgrading for some time as I have become less enthusiastic about new operating system features since moving away from system level development.

My experiences following Ubuntu has been that, every time a new release comes out, some functions are broken. Over time, bugs get reported, updates released and broken functions repaired. It has been a great OS for years, although Unity has not been my favorite. Between Gnome and KDE, I have always liked Gnome better, so I have stayed with Ubuntu, using it on my desktop, my netbook, and home server.

After reading about the 12.10 release for a few days, I decided to upgrade my desktop. The upgrade went pretty smooth besides taking a while. I went the command line route as that was easier for me.

Before I started the upgrade process, I had to enable the upgrade to a non-long-term-support (LTS) release -- Ubuntu does 2 release every year, one in April and one in October, which is where the release numbers like 10.04 and 12.10 come from. The latest release, 12.10, means it is released in October 2012. I forgot the file containing that option, so I started the System Tools » Administration » Update Manager, went to Settings and change the Notify me of a new Ubuntu version option from For long-term support versions to For any new version.

Then in a terminal window, I did a do-release-upgrade. That's pretty much it -- all I had to do after than was answering a few questions about new configuration files -- Since I haven't done much customization, I only had to answer y.

The upgrade process kept all my personalizations, including my choice of Gnome 3 and background images, etc.

But then almost immediately after reboot into 12.10, I noticed something not working: My VPN to work. It is a Cisco AnyConnect setup. The Network Manager isn't much help -- it just says connection failed. In syslog, this one message looks quite suspicious: Failed to open tun device: Permission denied -- I checked /dev/net/tun, I should already have read and write access to it per group permissions. Only by granting world read/write access to the tun device seems to make VPN work -- That seems rather strange. But that's a story for another day.

Problem Connecting an XP VBox to WHS

2012-07-14T00:09:00.000-07:00

The Acer EasyStore AH340 is a nice little headless box running Windows Home Server. It has 4 SATA hard drive bays, a gigabit Ethernet, a few USB ports and an expansion slot. With an Intel Atom CPU, it is obviously not a power computer. But it serves the purpose of backing up home PCs well. But the bad news is that Acer has discontinued the product line.

Anyway, my AH340 currently is backing up a Windows XP laptop from work. But I am having much trouble trying to connect an XP virtual machine running in Oracle VirtualBox inside my Ubuntu desktop.

After connecting from the VBox to HTTP port 55000 on the AH340, I downloaded the WHSConnectorInstall.exe software. Starts it. It goes looking for the server on the network:

It seems to find it OK and start to download software:

But that's as far as it gets:

There isn't really much help in troubleshooting. I searched online but did not find anyone else with the exact same problem.

Wireshark came to the rescue. It turns out that the WHS connector installer program changes the Windows hosts file after it finds the home server. Because the XP VM network adaptor is configured in NAT mode, the home server's address is translated to 10.0.0.2 by VirtualBox.

After changing the VM's network interface to Bridged mode, everything works.

Cygwin OpenSSH Server

2012-07-13T21:10:00.000-07:00

SSH is a Swiss army knife of secure remote access and much more. It has been prevalent on all operating systems but glaringly missing from all versions of Microsoft Windows. Which is one of the reasons I put Cygwin on every Windows machine I am allowed to install software on.

Installing the SSH service in Windows has become much easier with the newest version of Cygwin, as instructions found online changing from that long to this short.

Yes, it is that simple to setup OpenSSH in Windows now. But problems do occur. The easiest way to fix an OpenSSH SSHD service installation problem is probably to follow the Cygwin SSHD HowTo: How to run the OpenSSH SSHD server on Windows using Cygwin instruction, remove an old installation and reinstall.

One particular installation I botched kept giving me Windows error code 1069 when trying to start the service. I double checked the user id configured for the service but could not find anything wrong. As it turns out, one thing I need is to make sure that the /var/empty folder (in Cygwin) is owned by and writeable to the user running the sshd service, which is cyg_server if you follow the short instructions above and run ssh-host-config -y to setup the sshd service.

After the installation and starting the service, you should be able to test it by opening a Cygwin terminal window and connect to the computer itself using ssh localhost.

If you can connect to the localhost but not from a different computer, you may need to add a Windows firewall exception for SSH by allowing incoming connection to TCP port 22.

While writing this note, I found the two part tutorial The 101 Uses of OpenSSH (Part 1 and Part 2, published in the LINUX Journal on Jan 01, 2001 by Mick Bauer) to be a quite comprehensive read. But still, SSH offers much more.