The Lone Sysadmin

Out-of-Office Messages are a Security Risk

Bob Plankers — Sun, 03 Feb 2019 19:31:55 +0000

Every once in a while I get asked why I don’t have an out-of-office message for my email or voice mail. Truth is, I’ll often monitor my email even when I’m out, though I often practice good operations discipline by not responding. Just as intermittent problems with computer systems are hard to deal with, a staff member that’s supposed to be gone but isn’t acting like it is just as confusing. Humans can, and should, drain-stop and remove themselves from clusters for maintenance, too. Sometimes I’m really out of the office, though, crawling around in the backcountry wilderness or on an island somewhere. I’ll do it if I have to, but even then I don’t like setting an automatic response. ...

The post Out-of-Office Messages are a Security Risk by Bob Plankers appeared first on The Lone Sysadmin.

Free, Like a Puppy

Bob Plankers — Fri, 25 Jan 2019 00:06:04 +0000

I’ve found that things that are free of charge are often not a good deal. TANSTAAFL, or “There ain’t no such thing as a free lunch.” You’re always paying in some way. Maybe the piece of hardware is marked up more to cover the development cost of the “free” software that comes with it. Perhaps it’s the drug dealer model, where the first one is free to get you hooked. Sometimes you’re the product, and the “free” thing is spying on you with the hopes of making more money from ads or sales later. Certainly nearly every “free” web service is structured that way. Beyond monetary cost, though, you paying for things with your time. “Free” things often fall into ...

The post Free, Like a Puppy by Bob Plankers appeared first on The Lone Sysadmin.

Retrieve an SSL Certificate from a Server With OpenSSL

Bob Plankers — Mon, 26 Nov 2018 18:21:33 +0000

I was setting up VMware vRealize Automation’s Active Directory connections the other day and I needed the public SSL certificate for the AD DCs to authenticate correctly. You can use OpenSSL to get that information. I used a Linux shell but this should be do-able from a Mac or with OpenSSL installed on Windows, too. If you wanted to read the SSL certificates off this blog you could issue the following command, all on one line: openssl s_client -showcerts -servername lonesysadmin.net -connect lonesysadmin.net:443 < /dev/null In this case you’ll get a whole bunch of stuff back: CONNECTED(00000003)depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3verify return:1depth=1 C = US, O = Let's Encrypt, CN = Let's ...

The post Retrieve an SSL Certificate from a Server With OpenSSL by Bob Plankers appeared first on The Lone Sysadmin.

What You Need to Know About Upgrading to an iPhone Xs or Xr

Bob Plankers — Wed, 21 Nov 2018 21:35:17 +0000

I just got a new iPhone Xs Max. I had an iPhone 6s which I liked a lot, but it’s been a few years and with more travel I thought I’d enjoy having a better device with me. There are a few things that bit me in the duff. Some two-factor authentication (2FA) apps like Duo or Google Authenticator store their data in the iPhone Secure Enclave, which isn’t backed up to iCloud or via iTunes. That means that when you switch devices (or if you lose your device) you could lose access to your accounts, or it’ll be a serious pain to regain access (which is the point of 2FA). So don’t trade in your old phone until you’ve ...

The post What You Need to Know About Upgrading to an iPhone Xs or Xr by Bob Plankers appeared first on The Lone Sysadmin.

CODE Keyboard

Bob Plankers — Tue, 06 Nov 2018 17:42:54 +0000

“You spent $150 on a keyboard?” – My wife There are two kinds of people in technology: those with an opinion about their keyboard, and everybody else. I happen to be one of the first. I grew up using the IBM Model F and M keyboards. They have a spring in the key switches that buckles as you press down. That gives you two things: a prominent clicking sound from the keypress, and solid tactile feedback from the key. You definitely know when that key switch actuated. Years ago I had to give up my Model M keyboards. They’re built to last but it was getting harder to find working ones, it was getting inconvenient to adapt them to USB ...

The post CODE Keyboard by Bob Plankers appeared first on The Lone Sysadmin.

Fixing X11 Forwarding Over SSH and with Sudo

Bob Plankers — Fri, 06 Jul 2018 21:34:51 +0000

X11 forwarding over SSH not working? Not setting $DISPLAY correctly in your shell? Having problems with X11 and sudo? Yeah, me too. Total pain in the duff. Here’s what I do to fix it. I’m thinking about Linux when I write stuff like this but a lot of this has worked on AIX and Solaris, too. Make sure your SSH client supports X11 Forwarding and that it’s turned on. I use SecureCRT but I know it works in PuTTY as well. Once you turn it on in your client & save the settings you will need to reconnect, the forwarding is established with the connection. Ensure xauth and xterm are installed. You need xauth for this to work, and xterm ...

The post Fixing X11 Forwarding Over SSH and with Sudo by Bob Plankers appeared first on The Lone Sysadmin.

Fixing Veeam Backup & Replication Proxy Install Errors

Bob Plankers — Mon, 02 Jul 2018 21:07:03 +0000

Every once in a while I struggle a little to add a new Veeam Backup & Replication hot-add proxy. If you’re like me and seeing proxy install errors maybe some of these will fix you up. This is what worked for me on Windows Server 2016 when I was getting error 0x00000057, “Failed to create persistent connection to ADMIN$” and some other unhelpful messages. If you’re using a hardened Windows installation all bets are off, since the goal of hardening is to intentionally disrupt remote access. I’d get it running with as close to a stock Windows installation as possible and then work from there if you need to secure things further. There are also ways to manually install the Veeam ...

The post Fixing Veeam Backup & Replication Proxy Install Errors by Bob Plankers appeared first on The Lone Sysadmin.

vSphere 6.7 Will Not Run In My Lab: A Parable

Bob Plankers — Thu, 24 May 2018 15:12:16 +0000

“Hey Bob, I tried installing vSphere 6.7 on my lab servers and it doesn’t work right. You tried using it yet? Been beating my head against a wall here.” “Yeah, I really like it. A lot. Like, resisting the urge to be irresponsible and upgrade everything. What are your lab servers?” I knew what he was going to say before he said it. “Dell PowerEdge R610s.” I was actually surprised it was that new, and rack-mountable. “Yeah, you’re out of luck. CPUs before the E3/E5/E7 family didn’t have VT-x extensions in them to make virtualization easy so VMware had to do this thing called binary translation. vSphere 6.5 was the last release that they supported that on because, frankly, it’s slow ...

The post vSphere 6.7 Will Not Run In My Lab: A Parable by Bob Plankers appeared first on The Lone Sysadmin.

Midnight is a Confusing Choice for Scheduling

Bob Plankers — Wed, 23 May 2018 14:54:02 +0000

Midnight is a poor choice for scheduling anything. Midnight belongs to tomorrow. It’s 0000 on the clock, which is the beginning of the next day. That’s not how humans think, though, because tomorrow is after we wake up! A great example is a statement like “proposals are due by midnight on April 15.” What you actually said: proposals aren’t welcome after April 14. What you probably meant: you want the proposals before the date is April 16. There’s a 24 hour difference there, and if you enforce the deadline accurately people are going to complain because they were all thinking the second thing (before April 16). Similarly, this is a problem in change notices and customer communications. When you say ...

The post Midnight is a Confusing Choice for Scheduling by Bob Plankers appeared first on The Lone Sysadmin.

No VMware NSX Hardware Gateway Support for Cisco

Bob Plankers — Wed, 14 Mar 2018 17:26:30 +0000

I find it interesting, as I’m taking my first real steps into the world of VMware NSX, that there is no Cisco equipment supported as a VMware NSX hardware gateway (VTEP). According to the HCL on March 13th, 2018 there is a complete lack of “Cisco” in the “Partner” category: I wonder how that works out for Cisco UCS customers. As I continue to remind vendors, virtualization environments cannot virtualize everything. There are still dependencies on things like DNS, DHCP, NTP, and AD that need a few physical servers. There will also always be a few hosts that can’t be virtualized because of vendor requirements, politics, and/or fear. Any solution for a virtual environment needs to help take care of those ...

The post No VMware NSX Hardware Gateway Support for Cisco by Bob Plankers appeared first on The Lone Sysadmin.