Network bytes (Every BYTE of information is important)

2012-11-06T09:59:00.002-08:00

AD RMS Infrastructure Concepts

AD RMS infrastructure

AD RMS, like any IT service, relies on some infrastructure to work. In the case of AD RMS there are several components that work together in order for the solution to deliver a useful service. The most relevant ones are:
· AD RMS servers and clusters
· The AD RMS SQL Server database
· Active Directory
· The Rights Management Services client and RMS-enabled applications in the client
· AD RMS-integrated server applications

While there are other components that work along with AD RMS to make the whole thing work, those should cover the most important ones needed to understand other topics in this blog.

AD RMS Servers and Clusters

AD RMS provides its services to other elements as a web-service, and it is thus hosted inside Internet Information Services in a Windows Server. It normally runs over HTTPs (though running it over HTTP is also possible) providing a few web service operations that can be consumed by clients and services to perform information protection and consumption tasks.
AD RMS actually not only uses IIS in the hosting server, but it also uses Message Queuing to interact with the AD RMS database which we will be discussing later. That ensures that operations in the AD RMS services that need to send data to the database can be performed asynchronously and that in turn increases performance and resiliency of the database services.
Multiple AD RMS servers are typically joined together forming AD RMS clusters, which are basically collections of identically-configured AD RMS servers connected to the same AD RMS database and working together to resolve requests from other clients and servers. In an AD RMS cluster it doesn’t matter which server resolves a request, so the requests are typically load balanced through a mechanisms such as Network Load Balancing in Windows or an external load balancer.

AD RMS Database

As stated, a group of identical AD RMS servers form an AD RMS cluster. Servers in a cluster don’t host persistent service-related data in their own disks. All configurations, logs, persistent status and operation data and caches are actually hosted externally to the AD RMS servers in a SQL Server database called the AD RMS Database. That way, all servers share a common configuration and if a server fails users can continue to work through other servers in the cluster.
There’s actually not a single AD RMS database but three. Those three databases are typically hosted in the same server and are:
· The AD RMS Configuration Database, which hosts all the configurations defining the behavior of the cluster such as its URLs and caching behavior, as well as copies of some certificates and other items needed to keep the service running. It typically also holds the core certificates and keys for the AD RMS servers themselves.
· The AD RMS Caching database, which is used to cache frequently used data about the users and groups defined in Active Directory, in order to avoid impacting the performance of AD every time the service needs anything from the directory.
· The AD RMS Logging Database, in which AD RMS puts information about transactions that have been performed by the service. This information is not used by AD RMS for anything other than for reporting.

Active Directory

AD RMS uses Active Directory to authenticate users of the system within the forest where it is installed. It also uses AD to obtain information about the email address of the users, which is used as the users’ identifier thorough the system, and to obtain information about group membership when the rights assigned to a document refer to a group instead of an individual user.
As stated above, AD RMS caches data from AD in the AD RMS AD Caching database in order to avoid hitting the domain controllers too hard.

Client-side components

AD RMS typically works together with client-side components to perform the encryption, decryption and policy enforcement tasks.
The main client-side components in an AD RMS system are the Rights Management Services client and AD RMS-enabled applications.
The Rights Management Services client, which comes installed as part of Windows Vista SP1 and later and in Windows 7, and that can be installed in earlier versions of Windows, deals with all the key management, communicates with the AD RMS services in requesting licenses and providing certificates and communicates with the client applications to perform the encryption and decryption of content. It also provides a secure environment for all these tasks to occur, helping prevent tampering and potential key disclosures.

AD RMS enabled server-side applications

While most AD RMS-related operations are performed between the clients and the AD RMS servers, having some level of integration between certain server-side services and AD RMS can provide for a better user experience and more efficient IT services. For example, Exchange Server 2010 can acquire licenses for content on behalf of the users so users don’t have to wait for a license to be acquired when they open email they have in their inbox. It also provides the ability to create and consume protected content in the browser when using OWA, along with other capabilities.

2012-11-06T08:45:00.002-08:00

How to Backup and Restore Active Directory on Server 2008

By Eric English

Have you ever accidentally deleted a user account or an OU in Active Directory and wished you could restore it?
I recently had a client call me after they installed updates and rebooted their server. They noticed after the reboot that there was a message that said “Active Directory is rebuilding indices. Please wait”.
Their Active Directory database had become corrupted from the updates. So what do you do? How can you restore AD?
Let’s talk about how to backup AD in Windows Server 2008 and how to restore it. Today I’ll show you:

what you need to do to get your Server 2008 ready for backup
how to backup Active Directory on Server 2008
how to perform an Authoritative Restore of Active Directory
how to perform Active Directory Snapshots

Prerequisites: Getting Server 2008 Ready for Backup

Before you can backup Server 2008 you need to install the backup features from the Server Manager.
1. To install the backup features click Start → Server Manager.

2. Next click Features → Add Features

3. Scroll to the bottom and select both the Windows Server Backup and the Command Line Tools

4. Click Next, then click Install

Backing up Server 2008 Active Directory

Now that we have the backup features installed we need to backup Active Directory. You could do a complete server backup, but what if you need to do an authoritative restore of Active Directory?
As you’ll notice in Server 2008, there isn’t an option to backup the System State data through the normal backup utility.

So what do we do? We need to go “command line” to backup Active Directory.
1. Open up your command prompt by clicking Start and type “cmd” and hit enter.
2. In your command prompt type “wbadmin start systemstatebackup -backuptarget:e:” and press enter.
Note: You can use a different backup target of your choosing
3. Type “y” and press enter to start the backup process.

When the backup is finished running you should get a message that the backup completed successfully. If it did not complete properly you will need to troubleshoot.

Now you have a system state backup of your 2008 Server!

Authoritative Restore of Active Directory

So now what if you accidentally delete an OU, group, or a user account and it’s already replicated to your other servers? We will need to perform an authoritative restore of the Active Directory object you accidentally deleted.
1. To do this you will need to boot into DSRM (Directory Services Restore Mode) by restarting your server and pressing F8 during the restart.
2.Choose Directory Services Restore Mode from the Advanced Boot menu.

3. Login to your server with your DSRM password you created during Active Directory installation.
4. Once you’re logged into your server and in DSRM safe mode, open a command prompt by clicking Start, type “cmd“, and press enter.
5. To make sure you restore the correct backup it’s a good idea to use the “wbadmin get versions” command and write down the version you need to use.

6. Now we need to perform a non-authoritative restore of Active Directory by typing “wbadmin start systemstaterecovery -version:04/14/2009-02:39“.
Note: The version of backup will vary depending on your situation. Type “y” and press enter to start the non authoritative restore.
7. Go grab some coffee and take a break while the restore completes.

8. You can mark the sysvol as authoritative by adding the –authsysvol switch to the end of the wbadmin command.

9. But if you want to restore a specific Active Directory object then you can use the ever familiar ntdsutil.
For this example we are going to restore a user account with a distinguished name of CN=Test User,CN=Users,DC=home,DC=local. So the commands would be:

ntdsutil
activate instance ntds
authoritative restore
restore object “cn=Test User,cn=Users,dc=home,dc=local”

Note: The quotes are required

10. Reboot your server into normal mode and you’re finished. The object will be marked as authoritative and replicate to the rest of your domain.

Using Active Directory Snapshots

There is a really cool new feature in Windows Server 2008 called Active Directory Snapshots. Volume Shadow Copy Service now allows us to take a snapshot of Active Directory as a type of backup. They are very quick to create and serve as another line of defense for your backup strategy.
With your server booted into normal mode open a command prompt by clicking Start, type “cmd“, and press enter.
We are going to use the ntdsutil again for creating the Active Directory snapshots. The commands are:

ntdsutil
snapshot
activate instance ntds
create
quit
quit

So now that you have a snapshot of AD, how do you access the data? First we need to mount the snapshot using ntdsutil. The commands are:

ntdsutl
snapshot
list all
mount 1 — (Note: You should mount the correct snapshot you need; for this example there is only 1.)
quit
quit

Your snapshot is mounted, but how do you access the data? We need to use the dsamain command to accomplish this. Then we need to select an LDAP port to use. The command is as follows:

dsamain –dbpath c:\$SNAP_200905141444_VOLUMEC$\WINDOWS\NTDS\ntds.dit –ldapport 10001

The result should look like this:

Now we need to go to Start, Administrative Tools, then Active Directory Users and Computers.
Right click Active Directory Users and Computers and select Change Domain Controller.

In the area that says < Type a Directory Server name [:port] here > enter the name of your server and the LDAP port you used when running the dsamain command.
For my example it would be: WIN-V22UWGW0LU8.HOME.LOCAL:10001

Now you can browse the snapshot of Active Directory without affecting anything else negatively.

2012-11-05T09:43:00.001-08:00

Installing Active Directory on Windows Server 2012 Core

Microsoft has indeed made installing roles and features a great ease. To install Active Directory on Serve Core 2012 we must first configure the server to promote it to a domain by using the sconfig command.

The next step is to prepare our unattended file for Active Directory.

Our next step is run the unattended file to install Active Directory and DNS.

The Active Directory installation will run and install DNS.

As the installation runs normal Active Directory install and securing will take place.

Once completed depending on your unattended file the system will reboot if yes was selected in your answer file.

Once restarted the next step is to enable remote management to manage the Server Core from your Windows 8 Client. Using the sconfig command enter the remote management option by pressing 4 and then 1 to enable remote management.

To manage Active Directory from your Windows 8 client the next step is first join the Windows 8 client to the domain then install the Remote Server and Administration Tool (RSAT) for Windows 8. RSAT for Windows can be downloaded here.

Once RSAT is installed. Depending on your network needs you can turn on and off features to manage from your Windows 8 Client. By default all RSAT features are turned on for server roles and features.

From the Metro UI you can now access Server Manager and Administrative Tools to manage your network.

In Server Manager select manage then add the server you would like to manage.

Once the server is added that you would like to manage. Select tools to choose the role or feature you would like to manage.

Now you can manage and configure Active Directory on Server Core 2012 from your Windows 8 Client.

Branch Cache in win 8

2012-11-05T08:43:00.004-08:00

BranchCache is a Windows feature origially introduced in Windows 7 and Windows 2008.

BranchCache feature enables files and content from file servers and Web servers on a wide area network (WAN) to be cached on the computers at a branch offices. BranchCache is helpful to improve application response time and reduce WAN traffic by allowing access to files from local cache instead of accessing it from the head office for each request. Cached content can either be distributed across peer client computers (distributed cache mode) or centrally hosted on a server (hosted cache mode).

Work in a branch office with BranchCache feature in Windows 8

Windows 8 further enhances the features and capabilities of BranchCache.

BrachCache feature allow Windows applications that use network protocols to cache files and content locally from the remote servers. Since files are stored locally, it will reduce application response time and also reduce the network traffic by avoiding using WAN to get the files. This helps users in remote locations to be more productive and experience faster response time for their network applications.

The enhancements to BranchCache feature in Windows 8 consumer preview streamline the deployment process. Also, it optimizes bandwidth over WAN connections between content servers and remote client computers. With the new enhanced BranchCache feature in Windows 8, remote computers can now access data and files and run applications in a more secure, efficient, and scalable way.

Performance is improved in BranchCache by reducing data transfer size requirements through cache encryption, using data de-duplication, and minimizing cache block sizes. BranchCache can now scale to the requirements of any large or small enterprises and allow deploying hosted cache servers as many as they want. The new database and storage technologies used with Windows 8 BranchCache make it more scalable, secure and faster.

Read Windows 8 Consumer Preview Guide for additional information on Windows 8 BranchCache enhancements.

2012-11-05T08:37:00.008-08:00

Five Group Policy Preferences that replace Windows logon scripts

Are you still using Windows logon scripts? They’re no longer the Windows administrator’s necessary evil for desktop configuration control. These days, Group Policy Preferences can accomplish virtually anything a logon script can do.

Here are five Group Policy Preferences (GPPs) that’ll get you off the scripts and onto complete configuration control.

Drive Maps

Many IT shops still use logon scripts solely because of their ability to map drives to shares. Until GPPs came around, logon scripts were the easiest way to associate those drives with specific users and groups. Logon scripts execute as the user logs on, so adding a net use into that script makes it so H: drives map to home folders and S: drives to shared ones. Add in a little conditional script logic, and you can map drives based on each user’s identity.

Drive Maps are a GPP found under a Group Policy Object’s User Configuration half. Creating yours there enables the same mapping of drives to users, but without all the nasty scripting.

Environment variables

Not every user needs environment variables set, nor does every application. Therefore, many logon scripts required some fairly complex logic to confirm variables were set based on user, machine, and even application.

GPPs greatly simplify this process. Found in a GPO’s Computer Configuration half, environment variables can be configured on a per-machine basis. Even better, by tagging each GPP with the File Match item-level targeting, you can ensure an environment variable is only applied to computers containing the application that needs them.

Files

Ever have to work with an application whose settings are stored not in the registry, but in one or more files? There are still plenty of applications around that use files for storing their entire-machine and specific-user information. Files are great because they’re easy to work with, but they can be hard when multiple users need configurations on multiple machines.

The “preferences” in Group Policy Preferences highlights the fact that GPPs don't have to be enforced. It is entirely possible (and encouraged!) to use GPPs for defining a user’s or an application’s initial configuration. Once that initial configuration is set, users can then make whatever changes suit their needs.

Files are a GPP found in either half of a GPO. This GPP enables you to copy files from a source to destination location. They’re absolutely useful for copying files for those applications that need them. Just create your initial configuration, add that file to a GPP, and see it automatically distribute out to any relevant computer. Check the box for Apply once and do not reapply under the GPP’s Common tab if you want to give users the preference and not the policy.

Registry

While there remain some apps that store configurations in files, the vast majority of them today use the Windows registry. Back before GPPs, making registry changes was notoriously difficult, especially if they were to the HKEY_CURRENT_USER hive.

GPPs once again come to the rescue for locking down (or suggesting) application configurations, across both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. In a GPO you’ll find Registry GPP support in both the Computer and User Configuration halves. You can guess which hive each half corresponds to.

More on Group Policy Preferences

Five Group Policy Preferences you must implement right now
Five Group Policy improvements in Windows Server 2012
Configuring applications in Windows with Group Policy preferences

Often, however, the hardest part of controlling registry values is merely finding them. The software packager tool can help. Many software packagers do their work by analyzing two snapshots of a system, one before the application and another after it completes. By looking for what’s different between these two snapshots, the packager can identify what files and registry keys were changed by an installation.

You can use that same process to figure out which registry value an application setting corresponds to. The trick: Do the initial snapshot with the application already installed. Change the application setting, and then do the second snapshot. Whatever changed is what you’ll enter into the Registry GPP.

Printers

You think you’re smart because you’ve published your printers into your Active Directory, but even the most well-documented (and well-named) printer structure can still confuse users. Why not map whatever printer is closest to them, automatically?

You can with Printers in a GPP, linked with either the Computer or User half of a GPO. You’ll also need the aid of some setting on each computer that identifies where that computer lives. A common one is its subnet.

If your network engineers have laid out subnets by location, you can use that network in a GPP’s Item-Level Targeting. Just add it as an IP Address Range, and the next time users log in they’ll automatically attach to their closest printer.

GPPs aren’t even new technology. They’ve been around since the release of Windows Server 2008. They’re stable, they’re easy to use, and they’re a technology you already have on-hand. No extra software (or budget) needed.

If you haven’t spent much time with this incredibly useful administrative solution, give them another look. Coupled with their Item-Level Targeting, they’re a great way to finally eliminate those nasty logon scripts forever.

Source:-http://searchwindowsserver.techtarget.com/tip/Five-Group-Policy-Preferences-that-replace-Windows-logon-scripts?utm_medium=EM&asrc=EM_ERU_19400615&

Security Attacks

2012-11-02T10:36:00.000-07:00

This page lists types of security attacks. This document will address security issues, measures, and policies which take these types of attacks into consideration.

DoS- Denial of Service
Trojan Horse - Comes with other software.
Virus - Reproduces itself by attaching to other executable files.
Worm - Self-reproducing program. Creates copies of itself. Worms that spread using e-mail address books are often called viruses.
Logic Bomb - Dormant until an event triggers it (Date, user action, random trigger, etc.).

Hacker Attacks

I use the term "hacker attacks" to indicate hacker attacks that are not automated by programs such as viruses, worms, or trojan horse programs. There are various forms that exploit weakneses in security. Many of these may cause loss of service or system crashes.

IP spoofing - An attacker may fake their IP address so the receiver thinks it is sent from a location that it is not actually from. There are various forms and results to this attack.
- The attack may be directed to a specific computer addressed as though it is from that same computer. This may make the computer think that it is talking to itself. This may cause some operating systems such as Windows to crash or lock up.
Gaining access through source routing. Hackers may be able to break through other friendly but less secure networks and get access to your network using this method.
Man in the middle attack -
- Session hijacking - An attacker may watch a session open on a network. Once authentication is complete, they may attack the client computer to disable it, and use IP spoofing to claim to be the client who was just authenticated and steal the session. This attack can be prevented if the two legitimate systems share a secret which is checked periodically during the session.
Server spoofing - A C2MYAZZ utility can be run on Windows 95 stations to request LANMAN (in the clear) authentication from the client. The attacker will run this utility while acting like the server while the user attempts to login. If the client is tricked into sending LANMAN authentication, the attacker can read their username and password from the network packets sent.
DNS poisoning - This is an attack where DNS information is falsified. This attack can succeed under the right conditions, but may not be real practical as an attack form. The attacker will send incorrect DNS information which can cause traffic to be diverted. The DNS information can be falsified since name servers do not verify the source of a DNS reply. When a DNS request is sent, an attacker can send a false DNS reply with additional bogus information which the requesting DNS server may cache. This attack can be used to divert users from a correct webserver such as a bank and capture information from customers when they attempt to logon.
Password cracking - Used to get the password of a user or administrator on a network and gain unauthorized access.

Some DoS Attacks

Ping broadcast - A ping request packet is sent to a broadcast network address where there are many hosts. The source address is shown in the packet to be the IP address of the computer to be attacked. If the router to the network passes the ping broadcast, all computers on the network will respond with a ping reply to the sttacked system. The attacked system will be flooded with ping responses which will cause it to be unable to operate on the network for some time, and may even cause it to lock up. The attacked computer may be on someone else's network. One countermeasure to this attack is to block incoming traffic that is sent to a broadcast address.
Ping of death - An oversized ICMP datagram can crash IP devices that were made before 1996.
Smurf - An attack where a ping request is sent to a broadcast network address with the sending address spoofed so many ping replies will come back to the victim and overload the ability of the victim to process the replies.
Teardrop - a normal packet is sent. A second packet is sent which has a fragmentation offset claiming to be inside the first fragment. This second fragment is too small to even extend outside the first fragment. This may cause an unexpected error condition to occur on the victim host which can cause a buffer overflow and possible system crash on many operating systems.

Soource:-http://www.comptechdoc.org

TACACS+ and RADIUS Comparison

2012-11-02T10:16:00.002-07:00

TACACS+ and RADIUS Comparison

Introduction

Two prominent security protocols used to control dial-up access into networks are Cisco's TACACS+ and Livingston Enterprise's RADIUS. Cisco is committed to supporting both protocols with the best of class offerings. It is not Cisco's intention to compete with RADIUS or influence our users to use TACACS+. We want you to choose the solution that will best meet your needs. This document is intended to educate users on the differences between TACACS+ and RADIUS, so that they can make an educated choice.

Cisco has supported the RADIUS protocol since the release of Cisco IOS® Software Release 11.1 in February, 1996. We continue to enhance our RADIUS Client with new features and capabilities, supporting RADIUS as a standard. Cisco Access Servers are the only ones that implement both RADIUS and TACACS+.

Cisco seriously evaluated RADIUS as a security protocol before developing TACACS+. Many features were included in the TACACS+ protocol to meet the needs of the growing dial-up access control and security market. The protocol was designed to scale as networks grow, and to adapt to new security technology as the market matures. The underlying architecture of TACACS+ protocol complements the independent AAA architecture.

RADIUS Background

RADIUS is an access server authentication, authorization, and accounting protocol developed by Livingston Enterprises, Inc. It is a system of distributed security that secures remote access to networks and network services against unauthorized access. RADIUS is comprised of three components:
a protocol with a frame format that utilizes UDP/IP
a server
a client

The server runs on a central computer typically at the customer's site, while the clients reside in the dial-up access servers and can be distributed throughout the network. Cisco has incorporated the RADIUS client into Cisco IOS 11.1.

Client/Server Model

A Network Access Server (NAS) operates as a client of RADIUS. The client is responsible for passing user information to designated RADIUS servers, and then acting on the response that is returned. RADIUS servers are responsible for receiving user connection requests, authenticating the user, and then returning all configuration information necessary for the client to deliver service to the user. The RADIUS servers can act as proxy clients to other kinds of authentication servers.

Network Security

Transactions between the client and RADIUS server are authenticated through the use of a shared secret, which is never sent over the network. In addition, any user passwords are sent encrypted between the client and RADIUS server, to eliminate the possibility that someone snooping on an unsecured network could determine a user's password.

Flexible Authentication Mechanisms

The RADIUS server supports a variety of methods to authenticate a user. When it is provided with the user name and original password given by the user, it can support PPP PAP or CHAP, UNIX login, and other authentication mechanisms.

Server Code Availability

There are a number of distributions of server code commercially and freely available. Cisco's servers include CiscoSecure ACS for Windows, CiscoSecure UNIX and Cisco Access Registrar.

Comparing TACACS+ and RADIUS

The following sections compare several features of TACACS+ and RADIUS.

UDP and TCP

RADIUS uses UDP while TACACS+ uses TCP. TCP offers several advantages over UDP. TCP offers a connection-oriented transport, while UDP offers best effort delivery. RADIUS requires additional programmable variables such as re-transmit attempts and time-outs to compensate for best effort transport, but it lacks the level of built-in support that a TCP transport offers:
Using TCP provides a separate acknowledgment that a request has been received, within (approximately) a network RTT, regardless of how loaded and slow the backend authentication mechanism might be. (TCP ACK).
TCP provides immediate indication of a crashed (or not running) server (RST packets). You can determine when a server has crashed and come back up if you use long-lived TCP connections. UDP can't tell the difference between a down server, a slow server, and a non-existent server.
Using TCP keepalives, server crashes can be detected out-of-band with actual requests. Connections to multiple servers can be maintained simultaneously, and you only need to send messages to the ones that are known to be up and running.
TCP is more scalable and adapts to growing, as well as congested, networks.

Packet Encryption

RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is in the clear. Other information, such as username, authorized services, and accounting, could be captured by a third party.

TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. For debugging purposes it is useful to have the body of the packets in the clear. However, normal operation will fully encrypt the body of the packet for more secure communications.

Authentication and Authorization

RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to de-couple authentication and authorization.

TACACS+ uses the AAA architecture, which separates authentication, authorization, and accounting. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting. For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and accounting. After a NAS authenticates on a Kerberos server, it requests authorization information from a TACACS+ server without having to re-authenticate. The NAS informs the TACACS+ server that it has successfully authenticated on a Kerberos server, and the server then provides authorization information.

During a session, if additional authorization checking is needed, the access server checks with a TACACS+ server to determine if the user is granted permission to use a particular command. This provides greater control over the commands that can be executed on the access server while decoupling from the authentication mechanism.

Multiprotocol Support

RADIUS does not support the following protocols:
AppleTalk Remote Access (ARA) protocol
Net BIOS Frame Protocol Control protocol
Novell Asynchronous Services Interface (NASI)
X.25 PAD connection

TACACS+ offers multiprotocol support.

Router Management

RADIUS does not allow users to control which commands can be executed on a router and which cannot; therefore, it is not as useful for router management or as flexible for terminal services.

TACACS+ provides two ways to control the authorization of router commands on a per-user or per-group basis. The first way is to assign privilege levels to commands and have the router verify with the TACACS+ server whether or not the user is authorized at the specified privilege level. The second way is to explicitly specify in the TACACS+ server, on a per-user or per-group basis, the commands that are allowed.

Interoperability

RADIUS Standard does not guarantee interoperability. Even though several vendors implement RADIUS clients, this does not mean they are interoperable. There are approximately 45 standard RADIUS ATTRIBUTES. Cisco implements most of them today and is consistently adding more. If customers use only the standard ATTRIBUTES in their servers, they can probably interoperate between several vendors, providing that these vendors implement the same ATTRIBUTES. However, many vendors implement extensions that are proprietary ATTRIBUTES. If a customer uses one of these vendor-specific extended ATTRIBUTES, interoperability is not possible.

Traffic

Due to the previously differences between TACACS+ and RADIUS, the amount of traffic generated between the client and server will differ. The following examples illustrate the traffic between the client and server for TACACS+ and RADIUS when used for router management with authentication, exec authorization, command authorization (which RADIUS cannot do), exec accounting, and command accounting (which RADIUS cannot do).

TACACS+ Traffic Example

The following example assumes login authentication, exec authorization, command authorization, start-stop exec accounting, and command accounting is on with TACACS+ when a user telnets to a router, performs a command, and exits the router:

RADIUS Traffic Example

The following example assumes login authentication, exec authorization, and start-stop exec accounting is on with RADIUS when a user telnets to a router, performs a command, and exits the router (other management services are not available):

RODCs: Understanding and Implementing the New Windows Server 2008 R2 Domain Controllers

2012-10-23T06:12:00.001-07:00

RODC in server 2008R2

Read-only domain controllers (RODCs), a new feature of Active Directory Domain Services, represent a fundamental change in how you'll use DCs. Here's what you need to know to implement them in your enterprise.
When physical security is lacking, it becomes essential to increase the focus on data security. Windows Server 2008 and R2 provide some new ways to do so that seem uniquely tailored for environments like remote offices where physical security may not be as tight. Read-only domain controllers (RODCs) are a new feature of the Active Directory Domain Services (AD DS) in the Windows Server systems. They represent a fundamental change to how you'd typically use domain controllers (DCs).
Because many of RODCs' new capabilities impact key aspects of the design and deployment process, it's important to understand how you can leverage them in your enterprise. There are also critical design and planning considerations you must take into account before introducing them into your environment. RODCs are DCs that host complete, read-only copies of Active Directory database partitions, a read-only copy of SYSVOL, and a Filtered Attribute Set (FAS) that restricts the inbound replication of certain application data from writable DCs.

Generally speaking, RODCs are meant for environments that require local authentication and authorization, but lack the physical security to safely use writable DCs.
Branching Out
The most common environments for RODCs using AD DS are still branch offices. These types of environments are typically end points in a hub-and-spoke network topology. They're widely distributed geographically, in large numbers, and they individually host small user populations, connect to hub sites by slow, unreliable network links. Additionally, they often lack local, experienced administrators.
For branch offices already hosting writable DCs, it's probably unnecessary to deploy RODCs. In this scenario, however, RODCs may not only meet existing AD DS-related requirements, but also exceed them with regard to tighter security, enhanced management, simplified architecture and lower total cost of ownership (TCO). For locations where security or manageability requirements prohibit using DCs, RODCs can help you introduce DCs into the environment and provide a number of beneficial, localized services.
Although the new features and benefits make evaluating RODCs compelling, there are additional factors to consider, like application compatibility issues and service impact conditions. These could render RODC deployments unacceptable for certain environments.
For example, because many directory-enabled applications and services read data from AD DS, they should continue to function and work with an RODC. However, if certain applications require writable access at all times, an RODC may not be acceptable. RODCs also depend on network connectivity to a writable DC for write operations. Although failed write operations may be the cause of most well-known application-related issues, there are other issues to consider, such as inefficient or failed read operations, failed write-read-back operations, and general application failures associated with the RODC itself.
Besides application issues, fundamental user and computer operations can be affected when connectivity to a writable DC is disrupted or lost. For example, basic authentication services may fail if account passwords are not both cacheable and cached locally on the RODC. You can easily mitigate this issue by making accounts cacheable through an RODC's Password Replication Policy (PRP), and then caching the passwords through pre-population. Performing these steps also requires connectivity to a writable DC.
Along with other authentication issues, password expirations and account lockouts are significantly impacted when connectivity to a writable DC is unavailable. Password change requests and any attempts to manually unlock a locked account will continue to fail until connectivity to a writable DC is restored. Understanding these dependencies and subsequent changes in operational behavior is critical to ensuring your requirements and any service level agreements (SLAs).
There are several general scenarios in which you can deploy RODCs. They're useful in locations that don't have existing DCs, or in locations that currently host DCs that will either be replaced or upgraded to a newer version of Windows. Although there are comprehensive planning considerations specific to each scenario, we'll focus here on non-specific approaches. They are, however, distinct to RODCs, rather than to traditional writable DCs.
Preplanning
Before you start any formal RODC planning, you should conduct an appropriate level of due diligence and fundamental AD DS preplanning. This should include key tasks like validating the existing AD DS logical structure, and ensuring the administration model and the AD DS physical structure supports existing business and technical requirements. You'll also have to consider hardware requirements, software upgrade strategies, and applicable operating system known issues, and to evaluate RODC AD DS prerequisites. This information will be critical to the planning and deployment processes. You'll find it's well-documented in detailed deployment check lists.
Management Features
There's a substantial manageability feature in RODCs called Administrator Role Separation (ARS). This delegates to non-service administrators the ability to install and administer RODC servers, without granting Active Directory rights. This is a significant change to the traditional considerations with respect to DC server design, delegation of administration, and deployment procedures. This role separation becomes increasingly important with critical applications requiring direct installation on a DC, or for locations that host single, multi-purpose servers.
Additional Server Roles
As a general rule, you should eliminate from the server all roles not required for the RODC to function. Therefore, the only roles you should add to RODCs are the DNS and global catalog server roles. You should install the DNS server role on each RODC so local DNS clients can perform DNS resolution when network connectivity to a writable DC is unavailable. However, if the DNS server role is not installed through Dcpromo.exe, you'll have to install it afterward. You have to use Dnscmd.exe to enlist the RODC in the DNS application directory partitions that host the Active Directory integrated zones. You should also configure RODCs as global catalog servers so they can perform authentication and global catalog queries using just the RODC. From an authentication standpoint, if the global catalog role is not an option, you can use universal group caching. Successful authentication to an RODC may ultimately be dependent on the RODC's PRP configuration.

Configuring Applocker in the Domain

2012-09-09T09:05:00.001-07:00

Step-By-Step Guide on Configuring Applocker in the Domain…

As a systems admin, you might have probably wanted to deny your users to use a particular software application. This is pretty common since using some applications in some network environments is illegal.

In order to block an application, we can make user of a great feature called AppLocker available in Windows 7 and Windows Server 2008 R2. Here is a step by step guide on how to configure AppLocker in the domain or on computers in a special OU or site.

Let’s assume in this exercise you want to block the Internet Explorer on all the computers in your domain.

First of all, on your DC you need to go to Administrative Tools and open up Group Policy Management console and then right click on the Default Domain Policy and click Edit to open Group Policy Management Editor.

Then here, under Computer Configuration go to Windows Settings -> Security Settings -> Application Control Policies -> AppLocker

Before anything right-click on AppLocker and click on Properties and then under Executable Rules, click on Configured and choose Enforce rules:

And then as shown in the below photo right click on Executable Rules and choose Create New Rule:

Once you click on Create New Rule, this window will open up and you just need to click on Next:

On the next Window, you will need to select which users or groups this rule applies to and whether you want the rule to allow users or deny them to use that application. Once Configured, click Next:

On the next window choose File Hash and then click Next:

On the next windows click on Browse Files and choose Internet Explorer from your program files and then click Next:

Give the new rule a name and then click Create:

Now the new rule must have been added under Executable Rules as shown below:

Now if anyone in the domain tries to open Internet Explorer from their computer, they will receive this message, meaning that Internet Explorer has been blocked by a policy:

Windows 8

2012-09-09T09:03:00.002-07:00

Windows 8 Security Mechanisms

We live in a world of information where all our data is maintained in a digital format.

What would be your reaction if you found out that an unknown person has accessed your profile information? How would you react if you found out that your credit card details and passwords stored in your computer have been compromised?

Microsoft has ensured that it leaves no stone unturned to ensure that its new billion-dollar venture is equipped with adequate levels of protection.

Viruses, worms and Trojans that corrupted the previous versions of Windows will not be able to tamper with Windows 8 operating system easily. Windows president Steven Sinofsky has mentioned some security features of Windows 8 at the recent Microsoft build conference and how they are derived from their predecessor operating system Windows 7.

In this article, we present an overview of the new security features of Windows 8.

Security Features of Windows 8

Address space layout randomization (ASLR)

It involves random arrangement of base addresses of executable, libraries, heap and stack addresses in a process’s address space. The user’s code and data locations on hard drive are shuffled randomly to avoid revealing addresses to hackers. This feature was existent in Windows 7 but has been enhanced in Windows 8.

Heap Randomization (HR)

Attackers can corrupt or cause abnormal execution of programs by overwriting data pointers located in the heap. Randomization attempts to prevent this by adding guard pages in between so that data pointers are not altered.

Kernel mode security:

Kernel mode processes run in a special section of memory reserved for them. Microsoft has tweaked the user mode processes in Windows 8 so that they cannot access the kernel address space which means the lower 64k of process memory is not accessible by user processes.

UEFI Secure Boot:

Drivers and applications that start along with the operating system are assigned keys by Microsoft that is verified by the operating system at startup. If the driver or application does not possess the proper key, it is not allowed to start with the operating system processes. This ensures that malware does not interfere with antivirus programs.

Windows Defender:

Windows defender has been enhanced to identify all types of malware, virus and worm signatures from Microsoft malware protection center. Previously, the database only stored spyware and adware signatures.

Microsoft continues its support for third party antivirus and antimalware vendors while revamping their Widows defender with the help of their security development team.

Microsoft is following a security development lifecycle to ensure they do not encounter problems like those that the Windows XP users experienced in the past. Microsoft has noted the main cause of inadequate malware protection on 75% of the computers.

According to Microsoft, users fail to revamp their trial version after expiry and most of them do not update their security components regularly. Stay tuned for more security related news from Microsoft.

Public Key Infrastructure (PKI) Overview

2012-08-12T00:09:00.005-07:00

Public Key Infrastructure (PKI) Overview

Public Key Infrastructure or PKI can be a very complex but important subject. We’ll give you a PKI overview to help you understand what PKI is and how it can help you. PKI is a loaded term that involves the hardware, software, policies, and standards that are necessary to manage SSL certificates. A PKI lets you:

Authenticate users more securely than standard usernames and passwords
Encrypt sensitive information
Electronically sign documents more efficiently

A PKI allows you to bind public keys (contained in SSL certificates) with a person so in a way that allows you to trust the certificate. Public Key Infrastructures most commonly use a Certiticate Authority (also called a Registration Authority) to verify the identity of an entity and create unforgeable certificates. Web browsers, web servers, email clients, smart cards, and many other types of hardware and software all have integrated, standards-based PKI support that can be used with each other. A PKI is only as valuable as the standards that are established for issuing certificates.

Certificate Authorities

An SSL Certificate Authority (also called a trusted third party) is an organization that issues digital certificates to organizations or individuals after verifying their identity. The information that it verifies is included in the signed certificate. It is also responsible for revoking certificates that have been compromised. Many Certificate Authorities have their root certificates embedded in web browsers so your web browser automatically trusts them. They will sign an entity’s certificate using their trusted root certificate (or an intermediate of it) to create a "chain of trust" so the browser will trust the entity’s certificate. Basically, web browser developers are saying "We trust this certificate authority and they say that this is the entity's public key so, if we use it, we know we are talking to the right entity."

Managed PKI

While the term PKI is a very broad term that covers nearly every implementation of SSL, many SSL providers use the term Managed PKI to describe a system that gives you greater control over issuing, renewing, revoking, and managing SSL certificates while still gaining the advantages of using a trusted CA. Features of a managed PKI system often include:

Automated issuance of SSL certificates
Auditing capabilities
Full lifecycle management
Central management of the certificates across your entire organization

Digital Certificate

2012-08-12T00:06:00.004-07:00

Digital Certificate

What is a Digital Certificate?

In simple terms, a Digital Certificate or Digital ID as it is sometimes known, is the electronic commerce world's analogue of the passport. It is a credential issued by a trusted authority that binds you as an individual to an identity that can be recognised and verified electronically by other agencies. It confers certain rights and obligations on you according to policies exercised by the Issuing Authority. Because it uses cryptographic technology, it provides you with the ability to digitally sign emails, documents or transactions, or to verify the signatures of others. It enables you to make emails, documents or transactions only readable by those that you designate.

In a real passport, various checks on you are made by a trusted representative of the Issuing Authority to ensure that you are who you say you are, and thus establish a binding between you as an individual and the paper document that declares your identity. In the digital certificate world, a trusted representative of the Issuing Authority must be satisfied that you are who you say you are, before a request is made to issue a digital certificate on your behalf. Just as when a government issues you with a passport, it is officially vouching for the fact that you are who you say you are, when a Digital Certificate Issuing Authority gives you a digital certificate for secure email, it is putting its name behind the claim that you are the holder of your e-mail address.

In a real passport, the methods used to ensure the integrity of the binding between you and the paper identity are such things as watermarks, seals, special paper and ink, etc. In the digital certificate world, the method used to ensure the integrity of the binding between an individual or other entity and the public key, is the digital signature of the Issuing Authority.

What is a Root Certificate?

A root certificate is the digital certificate of an Issuing Authority. The public key in this certificate is used to verify the digital signature of the Issuing Authority. The Issuing Authority's digital signature is present in all certificates that it issues. The root certificate therefore, can be used to verify the integrity of any certificate that was issued by it. By downloading the root certificate, the user indicates trust in the Issuing Authority, and therefore trust in the bindings that it creates between real identities and their digital certificates.

How do Digital Certificates Work?

One widely-used tool for privacy protection is what cryptographers call "symmetric" or "secret key" encryption, called that way because one encryption key is used to both encrypt and to decrypt information. This key should obviously be kept secret from anyone not authorised to decrypt the information. Your log-on password, your cash card PIN, and the information you type in to enter your online bank accounts are all examples of secret keys. You share these secret keys only with the parties you want to communicate with, such as the bank or credit card company. Your private information is then encrypted with this secret key, and it can only be decrypted by one of the parties holding that same key.

Despite its widespread use, this secret-key system has some serious limitations. As network communications proliferate, it becomes very cumbersome for users to create and remember different passwords for each situation. Moreover, the sharing of a secret key involves inherent risks. When you give your mother's maiden name over the telephone, how do you know you can trust the party on the other end of the line? Can you be sure it is really the credit card company you are talking to? Can you be sure nobody is maliciously listening in? If you give somebody your mother's maiden name and that person abuses it for their own gain, how can you prove you did not authorise their use?

Digital Certificate technology addresses these issues because it does not rely on the sharing of secret keys. Rather than using the same key to both encrypt and decrypt data, a Digital Certificate uses a matched pair of keys which complement one another. In other words, what is done by one key can only be undone by the other key in the pair. In this type of key-pair system, a user holds onto a "private key" and never gives it to anyone, while widely disseminating a "public key." Any information locked with the public key can only be unlocked by the corresponding private key, and vice versa. Since the public key alone does not provide access to communications, users do not need to worry about who gets hold of this key.

For example, for the purposes of securing e-mail, key pairs can work in the following two ways.
You can digitally sign your e-mail by enclosing an electronic stamp constructed by using your private key. When your recipient gets your message, their computer checks this stamp to see if it can be decrypted using your public key. If successful, the recipient knows that the message can only have come from the holder of the private key.
Someone who wants to send you private e-mail can use your public key to encrypt the message. When you get the e-mail, your computer checks to see if the public key used to encrypt the e-mail is a valid match with your private key. If the match is successful, the message gets decrypted and you can read it. Anyone who receives your e-mail but does not hold your private key will be unable to decrypt and read the message.

.

A Digital Certificate makes it possible to verify someone's claim that they are the rightful owner of a given key, helping to prevent people from using counterfeit or stolen keys to impersonate other users. Used in conjunction with encryption, Digital Certificates provide a more complete security solution, assuring the identity of all parties involved in a transaction.

Because a Digital Certificate uses and supplies us with the tools of cryptographic technology, it provides us with the ability to digitally sign documents or transactions, or to verify the signatures of others. It enables us to make documents or transactions only readable by those that we designate. Because Digital Certificates bind a public key to an individual or organisation, in a trusted manner, we can be sure of the identities behind these operations.

Who needs a Digital Certificate?

Anyone who wants to receive encrypted e-mail so they know nobody else can read it will need a Digital Certificate. Anyone who wants to digitally sign their e-mail so that recipients can feel confident it came from them will also need a Digital Certificate.

How do I get a Digital Certificate?

Your organisation has identified one or more responsible and trusted individuals who will act in the role of Registration Authority. It is their job to ensure that everyone who holds a certificate is in fact eligible to do so, that they are who they say they are, and that all details recorded on the certificate about the holder are accurate. Your Registration Authority is where you need to apply for a certificate. You should also contact them immediately if you suspect that your private key has been compromised or stolen, or if any details about you have changed (email address, name, etc.).

Who manages my organisation's Digital Certificates?

Your organisation has identified one or more responsible and trusted individuals who will act in the role of Registration Authority. It is their job to ensure that everyone who holds a certificate is in fact eligible to do so, that they are who they say they are, and that all details recorded on the certificate about the holder are accurate. Your Registration Authority is where you need to apply for a certificate

Microsoft finally kills Hotmail, introduces Outlook.com

2012-07-31T22:40:00.003-07:00

Microsoft finally kills Hotmail, introduces Outlook.com

Its finally happened. After years of floundering, Microsoft has finally pulled the plug on Hotmail and introduced a preview version of Outlook.com, a new email service which promises users a cleaner user interface, very much like Google’s Gmail. And yes it comes with the compulsory social media integration to services such as Facebook and Twitter.

Is Microsoft trying to compete with Gmail? Totally. In the official Outlook blogpost, Chris Jones wrote,

Webmail was first introduced with HoTMaiL in 1996. Back then, it was novel to have a personal email address you could keep for life – one that was totally independent from your business or internet service provider. Eight years later, Google introduced Gmail, which included 1 GB of storage and inbox search. And while Gmail and other webmail services like Hotmail have added some features since then, not much has fundamentally changed in webmail over the last 8 years – though yesterday’s frustrations about the small size of inboxes are now things of the past.

Clearly Gmail with extra space, chat and now Hangouts, edged Microsoft’s prized Hotmail and it seems the software giant wants to change that.

Outlook.com. Screengrab

Microsoft promises users that it won’t scan their content or sell it to advertisers. This again is a clear reference to Gmail which matches key search words in user emails to show ads.

So what are the key features of Outlook.com?

• Cloud sync: Outlook is cloud friendly and promises that all your email will be available wherever you are. Its linked to your calendar as well. The good thing is that it comes with SkyDrive, so for users sending photos and documents, size is no longer a problem. SkyDrive will ensure that attachment worries are a thing of the past.

• New interface: Microsoft has gone for a cleaner interface. It looks suspiciously similar to Gmail but a change nonetheless. It also promises user that 30 percent more messages will be visible in your Inbox than other services. Yes its one long scroll down in Outlook.com

• Social networks: Outlook.com is touted as the first email service connected to Facebook, Twitter, LinkedIn, Google, and soon, Skype. Recent status updates,Tweets, the ability to chat and video calls are all promised.

• Some apps: Microsoft is also offering free Office Web Apps such as Word, PowerPoint, Excel and OneNote which means you can edit the doc from your inbox.

Will it be enough to trump Gmail? That remains to be seen.

Source:-http://www.firstpost.com

DHCP Process

2012-07-26T20:46:00.000-07:00

DHCP is a very common protocol and we often here about it. DHCP is much more complex than it looks. DHCP IP address assignment process goes through a few steps explained in this article.

DHCP stands for Dynamic Host Configuration Protocol and is used to automatically assign IP configuration to hosts connecting to a network. The Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCPIP network. DHCP is based on the Bootstrap Protocol (BOOTP)A DHCP client makes a request to a DHCP server that may or may not reside on the same subnet. The automatic distribution of IP configuration information to hosts eases the administrative burden of maintaining IP networks. In its simplest form, DHCP distributes the IP address, subnet mask and default gateway to a host, but can include other configuration parameters such as name servers and netbios configuration.

A DHCP client goes through six stages during the DHCP process. These stages are:

Initializing

Selecting

Requesting

Binding

Renewing

Rebinding

The DHCP client starts the DHCP process by issuing a DHCPDISCOVER message to its local subnet on UDP port 67. Since the client does not know what subnet it belongs to, a general broadcast is used (destination address 255.255.255.255). If the DHCP server is located on a different subnet, a DHCP-relay agent must be used. The DHCP-relay agent can take several forms. The ip-helper IOS command is used to set up a DHCP-relay agent on a Cisco router.The DHCP-relay agent forwards the DHCPDISCOVER message to a subnet that contains a DHCP server. Once the DHCP server receives the DHCPDISCOVER message, it replies with a DHCPOFFER message. The DHCPOFFER message contains the IP configuration information for the client. THE DHCPOFFER message is sent as a broadcast on UDP port 68. The client will know that the DHCPOFFER message is intended for it because the client's MAC address is included in the message.

If the client is on a different subnet than the server, the message is sent unicast to the DHCP-relay agent on UDP port 67. The DHCP-relay agent broadcasts the DHCPOFFER on the client's subnet on UDP port 68.

After the client receives the DHCPOFFER, it sends a DHCPREQUEST message to the server. The DHCPREQUEST message informs the server that it accepts the parameters offered in the DHCPOFFER message. The DHCPREQUEST is a broadcast message, but it includes the MAC address of the server, so that other DHCP servers on the network will know which server is serving the client.

The DHCP server will send a DHCPACK message to the client to acknowledge the DHCPREQUEST. The DHCPACK message contains all the configuration information that was requested by the client. After the client receives the DHCPACK, it binds the IP address and is ready to communicate on the network. If the server is unable to provide the requested configuration, it sends a DHCPNACK message to the client. The client will resend the DHCPREQUEST message. If the DHCPREQUEST message does not return a DHCPACK after four attempts, the client will start the DHCP process from the beginning and send a new DHCPDISCOVER message. There is a great diagram of the DHCP process at the "Understanding DHCP" link at the end of this article.

After the client receives the DHCPACK, it will send out an ARP request for the IP address assigned. If it gets a reply to the ARP request, the IP address is already in use on the network. The client then sends a DHCPDECLINE to the server and sends a new DHCPREQUEST. This step is optional, and is often not performed.

Since the DHCP works on broadcast, two pc which are on different networks (or VLANs) cannot work on the DHCP protocol. Does that mean we should have one dedicated server of DHCP in each vlan? No … in Cisco devices IP helper-address command helps to broadcast DHCP messages from one vlan to other vlan.For more detailed discussion on the DHCP protocol go through the below link from cisco.com

http://www.cisco.com/warp/public/473/100.html

CONVERTING DECIMAL TO HEXADECIMAL

2012-07-20T21:50:00.000-07:00

AP Spoofing in IEEE 802.11 Network.

2012-07-15T22:22:00.000-07:00

AP Spoofing in IEEE 802.11 Network.

The access point spoofing (AP Spoofing) is a typical man-in-the middle attack. The attacker suits himself between two nodes and controls all the traffic between them in this attack. This threat is very dangerous as the attacker is able to catch all the information traveling across the network. It is not so easy rather complex to make a man-in-the-middle attack in a wired network because this would require real access to the network. But there is no need of physical existence in wireless network and so preferred by the attacker. The first step is to set up a rogue AP for association between a victim node and legitimate AP. Then the rogue AP is established by copying all the configuration of the legitimate one: SSID, MAC address etc.

The next step is to wait for a new user trying to connect to the network where it gets connection with the rogue AP. The users can connect by themselves with the rogue AP or the attacker can create a denial of service attack to the legitimate AP to interrupt connections and automatically new users get into trap with the rogue AP. In IEEE 802.11 networks, the subscriber nodes select AP by the strength of the receiving signal. The attacker only need to do is to ensure that his AP has greater signal strength as seen by the victim. To accomplish that, the attacker tries to place his AP nearer to the victim than the legitimate AP, or to use a different technique by using directional antennas. The rogue access point is shown in figure below.

Figure: Access Point Spoofing by a Rogue Node.

Thus the victim node gets connection to the rogue AP and continues its works as it does with the legitimate AP since it does not know the real fact. The attacker captures all the necessary information’s starting from passwords when the victim tries to login for different accesses. Getting all the required information’s the attacker achieves the ability to penetrate the legitimate network.

This attack is possible in IEEE 802.11 network because it doesn’t have strong two-way authentication between AP and nodes. AP credentials are usually broadcasted across the network for subscriber nodes. As a result eavesdropping the network becomes easy for the attacker and he can get all the information needed. The user nodes may use WEP authentication to authenticate themselves to the AP which is also vulnerable but still more secure. An attacker needs to eavesdrop a lot of traffic and try cryptanalysis in order to get the password.

Learn QR CODE

2012-07-10T10:32:00.004-07:00

QR Code:

A QR Code (abbreviated from Quick Response Code) is a matrix barcode, also known as a two-dimensional code.

Quick response (QR) codes are among the latest in the stable of marketing tools. These have been devised to effectively bridge the gap between offline and online marketing. QR code was created by Toyota’s subsidiaryDenso Wave in 1994 to track vehicles during the manufacturing process and was initially confined to the automotive industry. With the evolution of smartphones, users got a mobile QR code reader in their pocket, which they could use to scan and read QR codes easily.

Note: To scan the image above, download the free QR reader application on your iPhone or Android device.

What is it?

QR Code, a registered trademark of Denso Wave Inc., is an enhancement over the conventional bar codes placed on objects such as product packaging or containers.

Bar codes store a smaller amount of information than QR codes because these store information only in the horizontal direction. A bar code scannerreads only the width and space between vertical lines and the vertical space (second dimension) is wasted.

QR code vs traditional bar code

In QR codes (2D codes), information is stored in both vertical and horizontal directions. So these can store the same amount of data as a bar code in only a tenth of the space.

A QR code may contain a huge amount of complicated numeric, alphanumeric or binary data. Storing up to 4296 characters, QR codes are internationally standardized under ISO 18004.

The technology of dots

The smallest square dot or pixel element of a QR code is called a module. As with bar codes, it is recommended to have an empty area around the graphic, which makes it easier for devices to read the QR code. This quiet area is ideally four modules wide. The minimum dimensions of a QR code depend upon the resolving power of the cameras that are used to scan the code. According to a Kaywa whitepaper, it is recommended to use a minimum size of 32×32 mm2 (1.25×1.25 inch2), excluding quiet zone, for QR codes that contain a URL. This guarantees that all camera phones can properly read the QR code. The above rule applies to perfectly printed codes that the user has direct access to.

For good reader accuracy, good contrast between the background and the dots colour is very important. The dots should be dark in colour and placed on a light background. The printing specifications of a QR code recommend a high dpi and solid colours.

How it works

A QR code system includes a QR code printer and a QR code scanner. To generate QR code, one needs a special printer and QR code creation software. Applying the right size to the QR code is important to make the code readable.

There are various factors which should be considered while determining the size of a QR code: Symbol version, data capacity, character type, error-correction level and module size based on printer performance.

Symbol version. QR codes have symbol versions from 1 to 40. Each version is differentiated by the number and configuration of modules. ‘Module’ refers to the B&W dots that constitute a QR code. Each version has a maximum data capacity that is decided by the amount of data, the type of characters (numeric, alphanumeric, etc.) and the error-correction level. So the more the data stored, the bigger the size of the QR code.

Error-correction level. QR codes have four levels of error-correction capability, viz, level L, M, Q and H in ascending order. With error correction, the user can read and retrieve data from a damaged QR code.

It is possible to create artistic QR Codes that still scan correctly, but contain intentional errors to make them more readable or attractive to the human eye, as well as to incorporate colours, logos and other features into the QR Code block.

Artistic QR code

Encryption

Although encrypted QR Codes are not very common, there are a few implementations. An Android app, for example, manages encryption and decryption of QR codes using DES algorithm (56 bits). Japanese immigration use encrypted QR Codes when placing visas in passports.

Parity Check

2012-07-08T23:09:00.003-07:00

How they work: parity checks in computer memory

Computers have internal checks to ensure they are working correctly. This article covers checks using a scheme called parity bits to ensure that the computer’s memory is accurate.

It is important for the computer to know of memory failures, to avoid operating on bad data. An undetected memory failure could be catastrophic. Memory is hardware and does fail from time to time. This article is the second in the series on memory.

Parity’s purpose

Memory parity is what helps the computer system detect that its memory has failed. If there is a problem with memory and the value of memory changes, parity can detect the problem and stop the computer.

How parity works

Recall that memory is organized in bytes, which is eight bits. I When memory is manufactured, an additional bit is added to each byte. This is called the parity bit. The actual size of each memory location is therefore nine bits, but the computer only uses eight of the nine bits for data. The parity bit is checked and never sent to the rest of the computer.

Writing parity

Every time a memory address is written, the parity circuit checks each bit of the byte. It counts all 1 bits in the byte. The sum of the 1 bits results either in an even or odd number.

To continue, we must know whether the designers of the memory used even or odd parity. The circuit will work either way. Let’s assume they used even parity. Stay with me; we’re almost there.

The parity bit is then set to a 0 or a 1 depending on the following.

· If the sum of the 1 bits is an even number, the parity bit will be written as a 0. This keeps the parity even, or keeps the sum of all 1 bits an even number.

· If the sum of the 1 bits is an odd number, the parity bit will be written as a 1. This keeps the parity even, or keeps the sum of all 1 bits an even number.

Reading parity

If you haven’t seen the purpose yet, keep reading. After parity is written, the sum of all the bits, including the parity bit, will be even. Then when the given address is read later, its parity is checked by summing all 1 bits including the parity bit. The result better be an even number, or there is a problem.

Examples

Here are a couple of examples of memory values and their parity bits.

Notice that the total sum of all bits for each memory value is always an even number.

DNSChanger Malware

2012-07-08T07:25:00.004-07:00

DNSChanger Malware

DNS (Domain Name System) is an Internet service that converts user-friendly domain

names into the numerical Internet protocol (IP) addresses that computers use to talk to

each other. When you enter a domain name, such as www.fbi.gov, in your web browser

address bar, your computer contacts DNS servers to determine the IP address for the

website. Your computer then uses this IP address to locate and connect to the website. DNS

servers are operated by your Internet service provider (ISP) and are included in your

computer’s network configuration. DNS and DNS Servers are a critical component of your

computer’s operating environment—without them, you would not be able to access

websites, send e-mail, or use any other Internet services.

Criminals have learned that if they can control a user’s DNS servers, they can control what

sites the user connects to on the Internet. By controlling DNS, a criminal can get an

unsuspecting user to connect to a fraudulent website or to interfere with that user’s online

web browsing. One way criminals do this is by infecting computers with a class of malicious

software (malware) called DNSChanger. In this scenario, the criminal uses the malware to

change the user’s DNS server settings to replace the ISP’s good DNS servers with bad DNS

servers operated by the criminal. A bad DNS server operated by a criminal is referred to as

a rogue DNS server.

The FBI has uncovered a network of rogue DNS servers and has taken steps to disable it.

The FBI is also undertaking an effort to identify and notify victims who have been impacted

by the DNSChanger malware. One consequence of disabling the rogue DNS network is that

victims who rely on the rogue DNS network for DNS service could lose access to DNS

services. To address this, the FBI has worked with private sector technical experts to

develop a plan for a private-sector, non-government entity to operate and maintain clean

DNS servers for the infected victims. The FBI has also provided information to ISPs that can

be used to redirect their users from the rogue DNS servers to the ISPs’ own legitimate

servers. The FBI will support the operation of the clean DNS servers for four months,

allowing time for users, businesses, and other entities to identify and fix infected

computers. At no time will the FBI have access to any data concerning the Internet activity

of the victims.

It is quite possible that computers infected with this malware may also be infected with

other malware. The establishment of these clean DNS servers does not guarantee that the

computers are safe from other malware. The main intent is to ensure users do not lose DNS

services.What Does DNSChanger Do to My Computer?

DNSChanger malware causes a computer to use rogue DNS servers in one of two ways.

First, it changes the computer’s DNS server settings to replace the ISP’s good DNS servers

with rogue DNS servers operated by the criminal. Second, it attempts to access devices on

the victim’s small office/home office (SOHO) network that run a dynamic host configuration

protocol (DHCP) server (eg. a router or home gateway). The malware attempts to access

these devices using common default usernames and passwords and, if successful, changes

the DNS servers these devices use from the ISP’s good DNS servers to rogue DNS servers

operated by the criminals. This is a change that may impact all computers on the SOHO

network, even if those computers are not infected with the malware.

Am I Infected?

The best way to determine if your computer or SOHO router has been affected by

DNSChanger is to have them evaluated by a computer professional. However, the following

steps can help you gather information before consulting a computer professional.

To determine if a computer is using rogue DNS servers, it is necessary to check the DNS

server settings on the computer. If the computer is connected to a wireless access point or

router, the settings on those devices should be checked as well.

Checking the Computer:

If you are using a Windows computer, open a command prompt. This can be done by

selecting Run from the Start Menu and entering cmd.exe or starting the command prompt

application, typically located in the Accessories folder within Programs on your Start Menu,

as shown below:At the command prompt, enter:

ipconfig /all

Look for the entry that reads “DNS Servers……….”

The numbers on this line and the line(s) below it are the IP addresses for your DNS servers.

These numbers are in the format of nnn.nnn.nnn.nnn, where nnn is a number in the range

of 0 to 255. Make note of the IP addresses for the DNS servers and compare them to the

table of known rogue DNS servers listed later in this document. If the IP addresses of your

DNS server appear in the table below, then the computer is using rogue DNS.

You can also look for your DNS servers without using the command prompt.

For windows XP machines, click on Start and select My Network Places. Then select Network

Connections. In this example, the wireless connection is used.Click on the connection that is active. This will bring up the Network Connection Status screen.

Click on Support and then Details. Check for the values that correspond to the DNS servers.

If you are using an Apple computer, click on the Apple in the top left corner and choose System

Preferences. Then, from the Apple System Preferences window, choose Network. The Apple Network pane will show a number of possible connections on the left side. Choose

the one that is active for you and click on the Advanced button in the right lower corner.

Then choose DNS from the options to show the DNS servers you are using.

Compare whether your computer has DNS servers listed in the number ranges listed below.

Rogue DNS Servers

85.255.112.0 through 85.255.127.255 To make the comparison between the computer’s

DNS servers and this table easier, start by

comparing the first number before the first dot.

For example, if your DNS servers do not start

with 85, 67, 93, 77, 213, or 64, you can move on

to the next step. If your servers start with any of

those numbers, continue the comparison.

67.210.0.0 through 67.210.15.255

93.188.160.0 through 93.188.167.255

77.67.83.0 through 77.67.83.255

213.109.64.0 through 213.109.79.255

64.28.176.0 through 64.28.191.255

If your computer is configured to use one or more of the rogue DNS servers, it may be

infected with DNSChanger malware.

Home computers with high-speed Internet connections and office computers typically obtain

their IP settings via DHCP from a device on the network. In these cases, the computers are

provided with an IP address, default gateway, and DNS server settings. The IP addresses

usually fall into one of three ranges of private addresses—192.168.0.0 to 192.168.255.255;

172.16.0.0 to 172.31.255.255; and 10.0.0.0 to 10.255.255.255. In most homes, computers

are assigned an IP address in the range 192.168.1.2 to 192.168.1.254, and the default

gateway and DNS servers are set to 192.168.1.1. To determine if your computer is utilizing

the rogue DNS servers, read the next section, Checking the Router.If you are unable to locate your DNS server settings, obtain assistance from the Help

program bundled with your operating system, reputable online sources, or a trusted

professional.

Checking the Router

Small office/home office routers connect your network of computers and devices to your

Internet service provider. The SOHO router may have been purchased and installed by you

or installed by your ISP. Linksys, D-Link, Netgear, and Cisco are common SOHO router

brands, but there are many others.

The DNSChanger malware is capable of changing the DNS server settings within SOHO

routers that have the default username and password provided by the manufacturer. If you

did not change the default password at the time the SOHO router was installed, you must

check the SOHO router settings.

The procedure to access your SOHO router setting varies by manufacturer, so consult your

product documentation. Once you have access to the SOHO router configuration, compare

the DNS servers listed to those in the rogue DNS servers table above. If your SOHO router

is configured to use one or more of the rogue DNS servers, a computer on your network

may be infected with DNSChanger malware.

What Should I Do?

In addition to directing your computer to utilize rogue DNS servers, the DNSChanger

malware may have prevented your computer from obtaining operating system and antimalware updates, both critical to protecting your computer from online threats. This

behavior increases the likelihood of your computer being infected by additional malware.

The criminals who conspired to infect computers with this malware utilized various methods

to spread the infections. At this time, there is no single patch or fix that can be downloaded

and installed to remove this malware. Individuals who believe their computer may be

infected should consult a computer professional.

Individuals who do not have a recent back-up of their important documents, photos, music,

and other files should complete a back-up before attempting to clean the malware or utilize

the restore procedures that may have been packaged with your computer.

Information regarding malicious software removal can be found at the website of the United

States Computer Emergency Readiness Team: https://www.uscert.gov/reading_room/trojan-recovery.pdf.

2012-06-25T00:36:00.002-07:00

Active Directory : Understanding FSMO Roles.

Introduction

Flexible Single Master Operations (FSMO) is a feature of Microsoft’s Active Directory (AD).

FSMOs are specialized domain controller (DC) tasks, used where standard data transfer and update methods are inadequate. AD normally relies on multiple peer DCs, each with a copy of the AD database, being synchronized by multi-master replication. The tasks which are not suited to multi-master replication, and are viable only with a single-master database, are the FSMOs.

The FSMO roles are also called Single Master Operations or Operations Master, FSMO is sometimes pronounced as “fizmo”.

What is the need of FSMO roles?

Active directory is multi master replication model. Meaning clients can register their records to any available Active directory domain controller and have access to resources within active directory NTDS.DIT database.

The purpose of having FSMO roles is being cause by Multi master replication model. In this model there has to be a way of preventing the conflict being happened, such as firing up adsiedit.msc and adding to the same object from different locations, which one would win? The NTDS.DIT DataBase would get confuse, Therefore we needed to have schema master so that regardless where you make the changes within the Domain changes gets okay from Schema Master first than, schema master replicates these changes to all other Domain controllers. This is the primary purpose why Microsoft comes up with FSMO roles (Operations Masters)

Knowing these FSMO roles and understanding them is Curtail for any Windows server administrator who is dealing with Active Directory and Exchange server.

The Five FSMO Roles

There are just five operations where the usual multiple master model breaks down, and the Active Directory task must only be carried out on one Domain Controller. FSMO roles:

1. PDC Emulator

Most famous for backwards compatibility with NT 4.0 BDC’s. However, there are two other FSMO roles which operate even in Windows 2003 Native Domains, synchronizing the W32Time service and creating group policies. I admit that it is confusing that these two jobs have little to do with PDCs and BDCs.

2. RID Master

Each object must have a globally unique number (GUID). The RID master makes sure each domain controller issues unique numbers when you create objects such as users or computers. For example DC one is given RIDs 1-4999 and DC two is given RIDs 5000 - 9999.

3. Infrastructure Master

Responsible for checking objects in other other domains. Universal group membership is the most important example. To me, it seems as though the operating system is paranoid that, a) You are a member of a Universal Group in another domain and b) that group has been assigned Deny permissions. So if the Infrastructure master could not check your Universal Groups there could be a security breach.

4. Domain Naming Master

Ensures that each child domain has a unique name. How often do child domains get added to the forest? Not very often I suggest, so the fact that this is a FSMO does not impact on normal domain activity. My point is it’s worth the price to confine joining and leaving the domain operations to one machine, and save the tiny risk of getting duplicate names or orphaned domains.

5. Schema Master

Operations that involve expanding user properties e.g. Exchange 2003 / forestprep which adds mailbox properties to users. Rather like the Domain naming master, changing the schema is a rare event. However if you have a team of Schema Administrators all experimenting with object properties, you would not want there to be a mistake which crippled your forest. So its a case of Microsoft know best, the Schema Master should be a Single Master Operation and thus a FSMO role.

Note: There is a also an important Global Catalog Role, however it’s not a FSMO role as you can have more than one Global Catalog.

FSMO Role Deployment

Three of the FSMO roles (1. 2. and 3.) are held in each domain, whilst two (4. 5.) are unique to the entire forest. Thus, if you have three domains there will be 3 PDC emulators, 3 RID master and 3 Infrastructure Master, but only 1 Schema Master and Domain naming master.

Which DC is holding FSMO role?

By default, the first domain controller of the domain will be holding all the five operations master roles of the forest. But we can transfer the roles for the load balancing and for the better distribution of Active Directory replication.

We can transfer the Operations Master roles using Graphical interface or Command line interface, which I will discuss in another article.

Here I will tell you how we can identify which AD Domain controller.

RID, PDC, Infrastructure (1. 2. and 3.)

You can discover which server holds the Operation Master by opening Active Directory Users and Computers, Right click your Domain and select Properties, Operations Masters.

Domain Naming Master (4.)

To see the Domain Naming Master (4.), navigate to the little used, Active Directory Domains and Trusts, Right click your Domain and select Properties, Operations Masters.

Schema Master (5.)

The Schema Master (5.) is the most difficult FSMO to find. The reason is the Schema snap-in is hidden by default. Perhaps is this is Microsoft saying - don’t mess with the object definitions. However, you can reveal the Schema and its FSMO settings thus:

1) Register the Schema Snap with this command, RUN regsvr32 schmmgmt.dll

2) Run MMC, File menu, Add\Remove Snap-in, click the Add button and select,

Active Directory Schema

3) Select Active Directory Schema, Right Click, Operations Master.

DMZ(demilitarized zones)

2012-06-13T23:57:00.000-07:00

A DMZ is a secure server that adds an additional layer of security to a network and acts as a buffer between a local area network (LAN) and a less secure network which is the Internet. A DMZ server is known as a Data Management Zone and provides secure services to local area network users for email, Web applications, ftp, and other applications that require access to the Internet. DMZ in networking gets its name from the demilitarized zones, which is land that the military would use as a barrier against the enemy.

How a DMZ Works?

A DMZ is a management server that is placed on the network that contains multiple network interfaces that play specific roles in protecting the local area network (LAN). IT administrators use a 4-port Ethernet card in the firewall to create a series of networks that include an internal trusted network, DMZ network, and the untrusted network which is the Internet.

Multiple DMZ networks are created to reduce the impact of damage to the system in the event that one of the DMZ hosts is compromised for any reason. Although a regular network firewall is installed to provide protection for the local area network, a DMZ establishes rules for protecting the DMZ network from the Internet. It also establishes rules for protecting the local area network from the DMZ in the event the DMZ is compromised. This provides added protection against hackers that try to breach the local area network.

DMZ Host Security

Because the DMZ management server network acts as a buffer zone between the local area network and the Internet, it is a less secure network than the internal network. For this reason, there are added security measures that are taken for a DMZ host which include, disabling unnecessary services, running the necessary services with the privileges reduced, eliminating any unnecessary user accounts, and making sure the DMZ has the latest security updates and patches. Although there are computers that have access to the DMZ, if there is a security breach it will not compromise the entire network like it would if the entire network is accessible to the Internet.

Honeypots

Another method that is used to secure a DMZ network is called a "honeypot" or "honeynet" which is a network of computers that is constructed for the purpose of luring hackers. The hackers are caught and tracked in the computers that are connected to the honeypot which diverts them away from the authentic resources.

The computers that are part of the honeypot are actually virtual machines that are embedded in a single machine. Network administrators then deploy intrusion detection systems and other monitoring systems on the honeypot to discover the identity of the hackers and some of the techniques they are using.

WPA And WEP setup in Wi-Fi Router

2012-06-07T22:38:00.004-07:00

Setting up WEP, WPA or WPA2 personal wireless security on a Linksys wireless router

Wireless security is one of the first things to do in setting up your router. This is the best way to prevent other people from deliberately using your wireless Internet connection.

How do I set up the wireless security of my Linksys router?

To set up wireless security on your router, you need to access its web-based setup page first. Follow the instructions below to know how:

Step 1: Open any web browser (i.e. Internet Explorer). On the Address bar, enter your router’s local IP address then press [Enter]. The default IP address of Linksys routers is192.168.1.1.

Step 2:When the login prompt appears, leave the User name field blank, then enter “admin” on the Password field.

NOTE: If you have set a password before but forgot it, you need to reset the device.

QUICK TIP: The router’s password (which you used in this step) is different from the password of your wireless network. This password is only used to access the router’s web-based setup page.

You will be redirected to the main screen of the setup page.

Step 3:On the setup page, click the Wireless tab then click the Wireless Security sub-tab.

Step 4:On the Configuration View section, click the Manual radio button.

IMPORTANT: For other models, you may immediately scroll down the page until you reach the Wireless Security section.

Choosing the ideal wireless security for your router

Your Linksys router supports four (4) of the most commonly used wireless security types: WEP, WPA Personal, WPA2 Personal and WPA2/WPA Mixed Mode. Here’s a table that best compares the different security types:

Security	Rank	Number of Characters
WEP Wired Equivalent Protocol	Basic	40/64-bit (10 characters) 128-bit (26 characters)
WPA Personal Wi-Fi Protected Access Personal	Strong	8-63 characters
WPA2 PersonalWi-Fi Protected Access 2 Personal	Strongest	8-63 characters
WPA2/WPA Mixed Mode	WPA2: Strongest WPA: Strong	8-63 characters

WPA, WPA2 and WPA2/WPA security modes are highly recommended over WEP for a higher level of security. Using WEP encryption makes your wireless network susceptible to security breaches. Follow the instructions below to know how to set up each security mode.

For WPA2/WPA Mixed Mode

Step 1:On the Security Mode field, select WPA2/WPA Mixed Mode and enter your Passphrase.

NOTE: The Passphrase must consist of at least eight (8) characters and is case-sensitive.

NOTE: WPA2/WPA Mixed Mode is also referred to as PSK2-Mixed for some Linksys routers. Refer to the image below for an example.

Step 2:

Click .

For WPA2 Personal

Step 1:On the Security Mode field, select WPA2 Personal and enter your Passphrase.

NOTE: The Passphrase must consist of at least eight (8) characters and is case-sensitive.

NOTE: WPA2 Personal is also referred to as PSK2 for some Linksys routers. Refer to the image below for an example.

Step 2:Click .

For WPA Personal

Step 1:On Security Mode, select WPA Personal and enter your Passphrase.

NOTE: The Passphrase must consist of at least eight (8) characters and is case-sensitive.

NOTE: WPA Personal is also referred to as WPA Pre-Shared Key or PSK Personal for some Linksys routers. Refer to the images below for an example.

WPA Pre-Shared Key

NOTE: The WPA Shared Key in the image above is the network password you will use to connect wirelessly.

PSK Personal

NOTE: The Pre-shared Key in the image above is the network password you will use to connect wirelessly.

Step 2:Click .

Other things to remember

• For dual-band routers, setting up the wireless security may depend on the exact type of dual-band router that you are

using. Dual-band routers can be either simultaneous or selectable. If the router is selectable, this means that you can

only use one (1) wireless band at a time and set a single wireless network password.

However, if your dual-band router is simultaneous, you can use both 2.4 and 5 GHz wireless bands at the same time. This

also means that you can set two (2) different wireless network names and wireless passwords for each frequency (which

is actually recommended to avoid interference).

15 Killer Windows 7 Keyboard Shortcuts That Might Surprise You

2012-06-07T22:21:00.002-07:00

One of my personal favorites among the new features that Windows 7 came with was the introduction of some awesome and long awaited keyboard shortcuts. I personally use them as much as I can to save time, and I recommend the practice of using keyboard shortcuts to others too.

This article talks about 15 really cool keyboards shortcuts that are specific to Windows 7. I can bet that you don’t know all of them. Check them out, some of them will surprise you for sure.

1. Ctrl+Shift+N to Create a New Folder

Creating a new folder in Windows explorer is something we all need to do on a frequent basis. And until now, there was no default shortcut key available for this task. But Windows 7 changed that.

You could now use Ctrl+Shift+N to quickly create a new folder in Windows or anywhere on your computer where a folder can be created.

2. Ctrl+Shift+Click to Open a Program As Administrator

There are many instances when just clicking on the icon of the application and opening it doesn’t solve your purpose. You need to right click on it and click on “Run as Administrator” so that you can make the required changes to the app.

In Windows 7, this can be done with a keyboard shortcut. You just need to point your mouse cursor on that program and then click on it while pressing Ctrl+Shift keys to open it as administrator.

3. Shift+Right-Click Enhances Send to Menu

The above screenshot shows the default send to menu that I get when I simply right click on a program.

Now, if I press the Shift key, and while having it pressed, I right click on the icon, I get an enhanced send to menu. See the screenshot below to check how it looks.

Nice, isn’t it?

Also check 2 Useful Tools To Add Items & Customize the Windows Right Click Menu.

4. Shift+Right-Click on a Folder to Open Command Prompt

If you do Shift+right-click on a folder, you’ll find an option that says “Open command windows here.” If you love working with the command prompt, this option should come in handy.

5. Win+Space to Quickly Show Desktop

Remember our quick tip on hiding open windows in windows 7 ? Well, this is the keyboard shortcut version of that mouse cursor trick. Pressing the Win key and the space bar simultaneously shows you the desktop immediately.

6. Win+Up/Down/Left/Right for Moving the Active Window

If you intend to quickly move the active window to make space for other apps, you could do that by using the Win key and one of the arrow keys. Each arrow key would move the window in the direction it is meant to.

7. For Dual Monitors: Win+Shift+Left Arrow Key to Move Active Window to Left Monitor

If you are on a dual monitor setup using Windows 7 then you could press the Win+Shift+Left arrow key combination to move the active application window to the left monitor.

8. For Dual Monitors: Win+Shift+Right Arrow Key to Move Active Window to Right Monitor

Similarly, if you need to move the current window to the right monitor screen, just press Win+Shift+right arrow key.

9. Win+T to Get to Taskbar Items

You could use the key combination Win+T to toggle through the applications pinned on the taskbar in Windows 7.

10. Shift+Click on a Taskbar App to Open a New Instance of the App

Let’s say you’ve got a bunch of Chrome windows open. And you need to quickly open a new blank window of the browser. Here’s the way – point your cursor to the chrome icon on the taskbar, hit Shift and click on it. There you go!

11. Win+B to Move Focus to the System Tray

In a previous article, we talked about a technique to add more clocks to the default Windows clock in the system tray. Now, if you need to get there without using your mouse cursor, how’d you do that?

Answer – Win+B. That would move the focus on the system tray, and then you could use the arrow keys to cycle through the items, including the Windows clock.

12. Win+P for Quickly Connecting Your Laptop to a Projector

Windows 7 has a nifty projection menu feature which enables you to quickly connect your laptop to a projector or an extended monitor. Win+P is the keyboard shortcut for that purpose.

13. Win+1, Win+2..so on for Opening Taskbar Programs

Want to quickly open a program that’s pinned to your Windows 7 taskbar? You can press the Win key and the number corresponding to the location of the app on the taskbar.

14. Win+Pause helps you check System Properties

Need to take a quick look at what’s the processor model you are using, or may be check the device manager, or advanced system settings? You could use Win+pause key combination to open the system properties window.

15. Ctrl+Shift+Esc Can Quickly Open Windows Task Manager

I think this was in Vista too, I am not sure. But it’s a cool shortcut nevertheless. Just press the Ctrl key, Shift key and the ESC key simultaneously and you have the task manager pop up right in front!

So that was about the amazing Windows 7 keyboard shortcuts. I hope you find them useful. In fact, learn them if you are on Windows 7. That’s what I did and it has helped a great deal. If I’ve missed a cool shortcut, do share that in the comments

Source:-http://www.guidingtech.com

Ethernet Cable

2012-06-06T23:19:00.001-07:00

Ethernet Cable - Color Coding Diagram

The information listed here is to assist Network Administrators in the color coding of Ethernet cables. Please be aware that modifying Ethernet cables improperly may cause loss of network connectivity. Use this information at your own risk, and insure all connectors and cables are modified in accordance with standards. The Internet Centre and its affiliates cannot be held liable for the use of this information in whole or in part.

T-568A Straight-Through Ethernet Cable

The TIA/EIA 568-A standard which was ratified in 1995, was replaced by the TIA/EIA 568-B standard in 2002 and has been updated since. Both standards define the T-568A and T-568B pin-outs for using Unshielded Twisted Pair cable and RJ-45 connectors for Ethernet connectivity. The standards and pin-out specification appear to be related and interchangeable, but are not the same and should not be used interchangeably.

T-568B Straight-Through Ethernet Cable

Both the T-568A and the T-568B standard Straight-Through cables are used most often as patch cords for your Ethernet connections. If you require a cable to connect two Ethernet devices directly together without a hub or when you connect two hubs together, you will need to use a Crossover cable instead.

RJ-45 Crossover Ethernet Cable

A good way of remembering how to wire a Crossover Ethernet cable is to wire one end using the T-568A standard and the other end using the T-568B standard. Another way of remembering the color coding is to simply switch the Green set of wires in place with the Orange set of wires. Specifically, switch the solid Green (G) with the solid Orange, and switch the green/white with the orange/white.

Ethernet Cable Instructions:

Pull the cable off the reel to the desired length and cut. If you are pulling cables through holes, its easier to attach the RJ-45 plugs after the cable is pulled. The total length of wire segments between a PC and a hub or between two PC's cannot exceed 100 Meters (328 feet) for 100BASE-TX and 300 Meters for 10BASE-T.

Start on one end and strip the cable jacket off (about 1") using a stripper or a knife. Be extra careful not to nick the wires, otherwise you will need to start over.

Spread, untwist the pairs, and arrange the wires in the order of the desired cable end. Flatten the end between your thumb and forefinger. Trim the ends of the wires so they are even with one another, leaving only 1/2" in wire length. If it is longer than 1/2" it will be out-of-spec and susceptible to crosstalk. Flatten and insure there are no spaces between wires.

Hold the RJ-45 plug with the clip facing down or away from you. Push the wires firmly into the plug. Inspect each wire is flat even at the front of the plug. Check the order of the wires. Double check again. Check that the jacket is fitted right against the stop of the plug. Carefully hold the wire and firmly crimp the RJ-45 with the crimper.

Check the color orientation, check that the crimped connection is not about to come apart, and check to see if the wires are flat against the front of the plug. If even one of these are incorrect, you will have to start over. Test the Ethernet cable.

Ethernet Cable Tips:

A straight-thru cable has identical ends.

A crossover cable has different ends.

A straight-thru is used as a patch cord in Ethernet connections.

A crossover is used to connect two Ethernet devices without a hub or for connecting two hubs.

A crossover has one end with the Orange set of wires switched with the Green set.

Odd numbered pins are always striped, even numbered pins are always solid colored.

Looking at the RJ-45 with the clip facing away from you, Brown is always on the right, and pin 1 is on the left.

No more than 1/2" of the Ethernet cable should be untwisted otherwise it will be susceptible to crosstalk.

Do not deform, do not bend, do not stretch, do not staple, do not run parallel with power cables, and do not run Ethernet cables near noise inducing components.

Basic Theory:

By looking at a T-568A UTP Ethernet straight-thru cable and an Ethernet crossover cable with a T-568B end, we see that the TX (transmitter) pins are connected to the corresponding RX (receiver) pins, plus to plus and minus to minus. You can also see that both the blue and brown wire pairs on pins 4, 5, 7, and 8 are not used in either standard. What you may not realize is that, these same pins 4, 5, 7, and 8 are not used or required in 100BASE-TX as well. So why bother using these wires, well for one thing its simply easier to make a connection with all the wires grouped together. Otherwise you'll be spending time trying to fit those tiny little wires into each of the corresponding holes in the RJ-45 connector.

Source:-incentre.net

Know YOur HARD DISK

2012-06-05T10:07:00.001-07:00

This page describes the typical layout of a modern hard drive. You may have heard of file systems such as NTFS, FAT32 or EXT3, which are used by your operating system. Concepts like files and directories are contained in these file systems, so obviously they are very important. But a single physical hard disk can contain multiple filesystems – each on a separatepartition. And a hard disk that contains a operating system must contain some elements that play a role in the boot sequence.

Obviously a lot more is going on under the hood. Let’s take a look.

An image showing the mechanical components of a hard disk. A typical consumer hard disk will usually have between one and five platters.

Hard disks have been around since the 1950′s, but the design has not changed much. The general hard disk design is quite simple, consisting of only a few moving parts. In the picture above you can see:

Platters: Solid disks with a magnetic coating that contains the data. The platters spin at a constant rate when the hard disk is in operation, typically at 3600, 5200 or 7200 rounds per minute (rpm).
Arms: The head stack assembly holds the arms that hold the read/write heads. The stack is rotated by an actuator which is not displayed in the image, causing the arms to position the heads between the hub and the edge of the platter. To achieve great speed and accuracy, the arm and its movement mechanism need to be extremely light and fast. The arm on a typical hard-disk drive can move from hub to edge and back up to 50 times per second

The data is stored on the surface of a platter in areas called tracks and sectors. A sector is displayed in yellow and a track in blue.

Every platter contains many concentric circles – called tracks – that are used to store the data. This radically differs from a CD or DVD, where a single track of data is used, laid out as a spiral. A modern hard disk has tens of thousands of tracks on a platter. The tracks on a hard disk are divided up into smaller segments called sectors. Each sector usually holds 512 bytes of user data, plus as many as a few dozen additional bytes used for internal drive control and for error detection and correction.

The heads that access the platters are locked together on an assembly of head arms. This means that all the heads move in and out together, so each head is always physically located at the same track number. It is not possible to have one head at track 0 and another at track 1,000. Because of this arrangement, often the track location of the heads is not referred to as a track number but rather as a cylinder number. What you should take away from this is that they are essentially the same.

This image shows a cylinder. A cylinder is formed by the tracks that are physically located directly above each other.

In the past, hard disks used to work pretty much exactly as described above. Modern hard disks use methods such as zoned bit recording to improve performance, but these details are only known by the disk controller.

The logical geometry of a hard disk is the logical structure that programs see when communicating with the hard disk’s controller – which is located on a logical board inside the hard disk. In all but the earliest hard disks the physical geometry is a lot more complicated than the logical geometry. Luckily, only the hard disk’s engineers have to deal with the complicated nature of the physical geometry; they are hidden from the operating system and the user.

In the case of early IDE/ATA hard disks the BIOS provides access to the hard disk through an addressing mode called CHS,where “CHS” stands for “cylinder, head, sector”. CHS addressing starts at (0, 0, 1). In old computer system the maximum amount of addressable data was very limited – due to limitations in both the BIOS and the hard disk interface. Some well-known resulting limits are the 502 MB and the 8.4 GB barriers. The CHS addressing mode was declared obsolete in the ATA-5 standard, replacing it with LBA addressing.

Modern hard disks use a recent version of the ATA standard, such as ATA-7. These disks are accessed using a different addressing mode called: logical block addressing or LBA involves a totally new way of addressing sectors. Instead of referring to a cylinder, head and sector number, each sector is instead assigned a unique “sector number”. In essence, the sectors are numbered 0, 1, 2, etc. up to (N-1), where N is the number of sectors on the disk. In order for LBA to work, it must be supported by the disk, the BIOS and operating system. The current 48-bit LBA scheme, introduced in 2003 with the ATA-6 standard, allows addressing up to 144 petabytes (144,000,000 gigabytes)..

The BIOS, working with the system chipset on the motherboard and the system I/O bus, controls which types of modes can be used with the hard disk to actually transfer the data. Originally, systems used the BIOS as an intermediary for every byte of transferred information. Modern operating systems implement direct disk access (Direct Memory Access), and do not use the BIOS subsystems, except at boot load time. A detailed description of the modes of transfer between the hard disk and volatile memory is out of the scope of this page, but the prevalent mode in 2011, UDMA, is a good place to start reading.

When an x86 PC is powered on, the BIOS will select a storage device from which to boot. From this device, the BIOS reads a boot sector - called the Master Boot Record (MBR) – which contains the primary boot loader. The MBR is a 512-byte sector, located in the first sector on the disk (sector 1 of cylinder 0, head 0). This is equal to LBA 0. After the entire MBR is loaded into RAM, the BIOS yields control to it.

The layout of the MBR, located in the very first sector of the hard disk.

The first 446 bytes of the MBR contain executable code – the primary boot loader.
The next 64 bytes hold a Partition Table which describes the partitions – or volumes – of a storage device. In this context the boot sector may also be known as a partition sector.
The last two bytes of the MBR contain a magic number. If the value is equal to 0xAA55 then the BIOS will assume it is dealing with a valid MBR. If it is not 0xAA55 the BIOS will produce an error message.

The Partition Table contains a maximum of four entries. Each entry specifies a primary partition, but one of the entries can specify an extended patition. Extended partitions are discussed later. The entries have the following format:

Byte Offset	Field Length (Bytes)	Meaning
00	1	Boot Indicator Indicates whether a partition is the system partition that contains the operating system. Legal values are: 0×00 = Do not use for booting 0×80 = System partition Only one entry can be marked as the system partition.
01	3	Starting CHS These values pinpoint the location of a partition’s first sector, if it’s within the first 1024 cylinders of a hard disk. Because sectors are 512 bytes, this boils down to a maximum of 8.4 GB. When a sector is beyond that point, the CHS tuples are normally set to their maximum allowed values of 1023, 254, 63; which stand for the 1024th cylinder, 255th head and 63rd sector, due to the fact that cylinder and head counts begin at zero. These values appear on the disk as the three bytes: FE FF FF (in that order).
04	1	Partition typeThis byte defines the type of filesystem that was used to format the volume. An operating system can use this field to determine what file system drivers to load during startup. For example, the NTFS filesystem commonly used by Windows NT has partition type 0×07. A list of well-known types can be found here.
05	3	Ending CHSThe CHS address of the last sector in the volume. The rules apply as for the starting sector field. The start and end sectors of a volume can be calculated using the Relative Sectors and Total Sectors fields.
08	4	Starting Sector (LBA) This value uniquely identifies the first sector of a partition just as Starting CHS values do. But it does so by using a 4-byte LBA. This means it can locate up to 2.19 TB – or 2 TiB. When you obtain all 4 bytes of this value (as stored on a little-endian computer), the byte-order must first be reversed. So, if the value in the MBR is 3F 00 00 00, this becomes: 00 00 00 3F. This means that the partition begins at sector 0x3F, which is LBA 63 (or the 64th sector on the disk). This is the first possible boot sector for any drive having 63 sectors per head/track.
12	4	Number of SectorsThis field specifies the exact amount of sectors in the volume. As with the starting sector field, it allows for a size of up to 2.19 TB.

The contents of a typical master boot record are displayed below. Note that the code section also contains some human-readable strings – these strings are used by the machine instructions to display messages depending on the code flow at runtime.

Due to the size of the MBR’s partiton table, there is a limit of 4 primary partitions. To get around this issue, engineers came up with a special partition type: the extended partition. A hard disk may contain a maximum of one extended partition. The extended partition can be subdivided into multiple logical partitions. In DOS/Windows systems, each logical partition may then be assigned an additional drive letter. In the MBR’s Partition Table, extended partition entries usually have a Partition Type of either 0x05 or 0x0F; depending upon the size of the disk.

When the operating system encounters an extended partition type in the Partition Table entry, it will use the Starting Sectorfield to locate the first sector of the extended partition. In that sector it will look for a structure called the Extended Boot Record(EBR). This is a descriptor for a logical partition.

EBRs have exactly the same structure as the MBR; the only difference is that a some fields in the EBR go unused. The only used fields are the first and second Partion Table entries, along with the mandatory boot record signature (or magic number) of 0xAA55 at the end of the sector. This results in the following layout:

Byte Offset	Field Length (Bytes)	Meaning
0	446	Code area. Generally unused and filled with zeroes.
446	16	Partition table’s first entry. This entry points to the logical partition belonging to this EBR. Starting Sector = relative offset between this EBR sector and the first sector of the logical partition. Usually 63 sectors. Number of Sectors = total count of data sectors for this logical partition.
462	16	Partition table’s second entry. This entry will contain zero-bytes if it’s the last EBR in the extended partition. Otherwise, it points to the next EBR in the EBR chain. Starting Sector = relative address of next EBR within extended partition. Number of Sectors = total count of sectors for next logical partition, starting the count at the EBR.
478	16	Partition table’s third entry. Unused, filled with zeroes.
494	16	Partition table’s fourth entry. Unused, filled with zeroes.
510	2	Mandatory boot record signature (magic number): 0xAA55

So each logical partition in the extended partition is preceded by an EBR, and the EBR’s are chained together. The operating system will follow the chain until it reaches the end. The complete hard disk layout might look something like this:

An example disk layout containing 3 primary partition, followed by 1 extended partition with 2 logical partitions.

Note that every filesystem contains a Boot Sector of its own. This is called the Volume Boot Record (VBR). In the boot sequence the MBR is processed first, and eventually the VBR of the partition that contains the OS is processed.

We conclude this page with some food for thought: the contents of a Master Boot Record. Can you disassemble the code?

Example content of a Master Boot Record. Displayed are: hexadecimal (left) and ASCII (right).