Category: Tech

Anything and everything I write that has something to do with tech. Maybe it’s a post about the time I blew up that server in 2003 because I didn’t know what bridged networking really meant. Sorry Roger!

Here is a plate full of HTML whitewashing

I’ve been fighting the good fight about a pure CSS website complete with properly aligned
DIV’s and everything for years. I am *SICK* of it. I do NOT have enough time to design this page properly, and I won’t until I somehow make it pay more than my full-time job. Since that isn’t going to happen anytime soon, I have been reminded again how my fight in the DIV vs. TABLE is a losing battle. When did I get suckered into thinking that a pure DIV rendering would score me points on the web because someone might notice I put some extra work into my site.
Since I’ve been playing wtih Internet Explorer 8 beta I have noticed yet again how Firefox has been paying more attention to W3C standards than I wanted to admit. If the first step is admitting you have a problem, then I need to admit I have a problem. The
nightmare on this page has grown beyond my capacity for control. It isn’t going to stop. I don’t think I can hold on much longer. The
TABLE’s are coming.

Here is an awesome slide presentation on more of the technical items that are changed with IE8 and what other part-time web designer’s need to know.

What You Need To Know About IE8 and Standards

Interesting problem with Exchange 2007 not finding a different

Late in the middle of the night one of the domain controllers in the same AD site as the Exchange servers stopped functioning (TBD why) and the Exchange servers continued to try using that particular DC/GC to perform lookups.

The DC wasn’t accessible via most means and the event logs in the CAS servers had a few items that were descriptive, but not terribly helpful:
___

Event Type: Warning
Event Source: MSExchange ADAccess
Event Category: Topology
Event ID: 2116
Date: 2/13/2009
Time: 3:24:40 AM
User: N/A
Computer: HUB/CAS_server
Description:
Process IISIPM72AE0B7E-9F63-4D30-80F3-A58AB1DEDB01 -AP “MSEXCHANGEOWAAPPPOOL (PID=6904). The domain controller DC.domain.local is running Windows (Unknown Operating System) (Unknown Service Pack). Exchange Active Directory Provider requires that domain controllers are running Windows Server 2003 Service Pack 1 or later versions of Windows.
___

So of all the questions I need to ask M$ this morning is why didn’t Exchange start using the other 3 domain controllers we had available? They were in fact out of site, but functioning perfectly fine. During the AD Topology discovery immediately after the 2116 Event was the standard AD Topology event, but it indicated that the DC’s OS being unknown is NOT enough for Exchange to want to switch to doing lookups on another GC. Pity.
___
Event Type: Information
Event Source: MSExchange ADAccess
Event Category: Topology
Event ID: 2080
Date: 2/13/2009
Time: 3:24:44 AM
User: N/A
Computer: HUB/CAS_servers
Description:
Process IISIPM72AE0B7E-9F63-4D30-80F3-A58AB1DEDB01 -AP “MSEXCHANGEOWAAPPPOOL (PID=6904). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
(Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version)
In-site:
Domain.ad.local1 CDG 1 7 7 1 0 0 0 7 0
Domain.external.com1 CDG 1 7 7 1 0 1 1 7 1
Out-of-site:
Domain.ad.local2 CDG 1 7 7 1 0 1 1 7 1
Domain.ad.local3 CDG 1 7 7 1 0 1 1 7 1
Domain.external.com2 CDG 1 7 7 1 0 1 1 7 1
Domain.external.com2 CDG 1 7 7 1 0 1 1 7 1
Domain.ad.local4 CDG 1 7 7 1 0 1 1 7 1
Domain.external.com24 CDG 1 7 7 1 0 1 1 7 1
___

The biggest security flaw I’ve seen and my first official “hack”

This wonderful set of utilities gsecdump and msvctl have allowed me to test the hash injection attack that has been around for some time now. The utilities don’t work on vista and 2008, but my XP workstation was an easy target.

There is some general scrambling about now and there is a lot of emphasis on “everyone panic!”

In an environment as large and heterogeneous as the one I currently work in, there is complete disparity between practice and theory. This is on multiple levels and particularly on security. I felt that from the start security was a bit of a joke consider the lack of firewalls, proxies, and patching that happens. The nonchalance about keeping antivirus up-to-date and utilizing the management tools that *are* available to at least keep a watchful eye on things. I sighed a bit of relief when I met one of the security engineers here. He’s a young guy in his 20’s or 30’s and generally types at mach 1 via a bash shell. He likes his mac and I suspect he is a paranoid mofo and doesn’t keep a single worthwhile thing on his computers. Unfortunately this guy is extremely busy configuring the few firewalls we do have and generating security certificates. This pretty much leaves a group of very brilliant but exhausted windows admins trying to do the best we can.

So one of us found a “hack” that has been apparently well known enough over the last few years that we all completely missed this one.

Windows by default keeps the NTLM hash available on a local system after a user logs on. If a domain admin logs onto a system it stores the NTLM hash in the local SAM database.

So any local administrator on this server can run the gsecdump utility and get a list of all NTLM hashes that are left lying around in the SAM. You can use that hash as a parameter to msvctl and run an application using the credentials of that compromised account. Pretty quick to figure out that the domain is a wide open sea of green for any with a desire to cruise on through.

I forgot how much I enjoyed a logical discussion with other geeks about the best way to approach an encompassing and very serious issue.