Determine SSL ciphers running on your web server

SSL Digger - Nice free tool from FoundStone (division of McAfee) for determining what SSL versions and encryption ciphers your web server supports.  If you are running a crucial web server you might want to turn off the weak ciphers and SSL version (SSL2).  The browser and server are supposed to negotiate the highest cipher and SSL version, but some ciphers have already been proven to be weak and vulnerable to crack/attack.

www.foundstone.com  It's kind-of hard to navigate the site: click on resources, then on the left side, "free tools". You should see it under the "Foundstone S3i™ Tools".

Disable SSL2 and weak ciphers in IIS

How to disable SSL protocols and encryption ciphers in Microsoft IIS. For IIS (IIS6 and IIS5):
The ciphers and SSL protocols must be disabled via registry entries; thus a reboot is required after changing the settings. If I ever find some free time, I may create a GUI utility to easily enable/disable these cryptos.

See the following documents:

Description of the Secure Sockets Layer (SSL) Handshake - http://support.microsoft.com/kb/257591
TLS/SSL Tools and Settings - http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/3f98fdd9-ed64-49f7-9c20-a2d4581dfbea.mspx
How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services - http://support.microsoft.com/kb/187498
How to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll - http://support.microsoft.com/kb/245030/

The following are the registry entries I made to make one of my servers secure (Grade A by SSL Digger):

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:ffffffff

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]
"Enabled"=dword:ffffffff

Adding CPU / RAM to ES45 Alpha Server

1.      shutdown, turn off and unplug power
2.      insert  hardware  -  see pages 129-140 of the ES45 manual:  http://h18002.www1.hp.com/alphaserver/download/ek-es450-ug-b01.pdf
3.      at chevron >>>  show config | more    and    show memory
4.      After boot:
  psrinfo –v  (processor info)
  vmstat -P  (Physical memory info)
  dxsysinfo -dash  (X windows display of CPU / memory activity)
5.      If you receive a “too many users logged on already” you may have to add the License PAK codes that were shipped with the cpu.  As root, run lmfsetup and enter the codes from the PAK.  After successfully entering the codes, it will ask to run an “lmf reset”, say yes and it will load the licenses into the kernel cache.

rDirectory - make AD web browsable

They've got a Free Community edition for those with small/limited needs, like creating an employee directory:

rDirectory: A Smart Choice for Your Evolving Directory Needs: "Simply put, rDirectory turns Active Directory into your enterprise-wide platform for securely publishing, accessing and maintaining information about virtually any directory-based corporate resource."

tail multiple log files in Win32 environments

Not just another tail command, but can match keywords, and can send mail notifications.
Tail for Win32 - Home Page

Updating to FireFox 1.5 on Linux (Ubuntu)

These same instructions can be tweaked for other distros as well:
FirefoxNewVersion - Ubuntu Wiki

Linux Distrobution Guide

http://distroguide.box.sk - Main Page - Distro Guide

Security Warning disabled

My company has a lot of sites in it's trusted sites zone in order for users to download files from these sites. It kills me when I use my Windows XP SP2 machine and IE. I'd do a google search and one of the results was a link to microsoft. When I clicked the link, I'd get a Security Warning message: The current Web page is trying to open a site in your Trusted sites list. Do you want to allow this?

What was weird about it was that I had NO, not one, site listed in the trusted sites zone. I later found this was because of group policy. A few days later after group policy refreshed on my machine, the sites showed up in the trusted sites list.

To remove this warning, in the trusted sites zone, open the custom settings under Miscellaneous, "Web sites in less privileged web content zone can navigate into this zone." set to enable.
See: Security Warning appears when you try to navigate to a Trusted site from a webpage

Read AND Write NTFS volumes from Linux - Captive

The best solution to writing NTFS formatted volumes in Linux; it uses the native ntfs.sys driver and therefore is very safe:

Jan Kratochvil: Captive: The first free NTFS read/write filesystem for GNU/Linux: "Captive: The first free NTFS read/write filesystem for GNU/Linux"

Packet capture tools

Open source and free packet sniffer/capture tools:
http://www.winpcap.org/ Also provides WinDump tool which is
based/proted from tcpdump. Reading the Windump FAQ first, even before
the manual, is essential.
And of course the big one: http://www.ethereal.com/

Kerberos Token Size and logon problems

Your kerberos ticket can't be bigger than 12000 bytes by default as it will cause logon issues. This is typically cuased by being a member of too many groups.

Microsoft Certified Professional Magazine Online Column: The Group that Broke the Camel�s Back

Gmail browser cache full message

Message from gmail after logging in:  Your browser's cache is full and may interfere with your Gmail experience.  Fix this   Hide

This only happens when using Gmail via the secure https method: https://mail.google.com/mail

caused by the Advanced option in Internet Explorer (in IE: tools/internet options/Advanced tab, security section) setting:  "Do not save encrypted pages to disk"  When this option is checked, gmail believes the cache is full because the pages won't be saved to disk, thus gmail thinks the cache is full.  Uncheck the box or ignore/hide the error message.

Renaming device files in Tru64

On Tru64, it sucks when a faulty device is replaced and the new device now uses a different device file.  The example below is how to delete the old device from hardware manager's database and how to rename the device special files using dsfmgr.

 

for reference: man hwmgr_ops

 

First, delete the old device:
# hwmgr show scsi -type tape
  -get hwid of old device
  -in this case tape1 was hwid 165
# hwmgr delete -id 165
 hwmgr: Delete operation was successful
 
Second, move the new device file to the old name.
# dsfmgr -m tape2 tape1

Alpha Server performance

Quick way to gauge how a CPU upgrade will increase performance on your
Alpha box:
http://h18002.www1.hp.com/alphaserver/performance/perf_by_name.html

Frontpage error submitting form

Problem:  Can't submit frontpage developed form.  The error message in the browser is: Frontpage error.  In the application event log on the server hosting the frontpage extended web the following two entries will appear:

Event Type:     Warning
Event Source:   FrontPage 5.0
Event Category: None
Event ID:       1000
Description:
Microsoft FrontPage Server Extensions:
      (OS Error #13 Message: Permission denied)

Event Type:     Warning
Event Source:   FrontPage 5.0
Event Category: None
Event ID:       1000
Description:
Microsoft FrontPage Server Extensions:
   http://frontpageserver - Error #2005d Message: The server extensions were unable to access the file "service.lck". Please check the file permissions.


Solution:  http://frontpageserver/_vti_bin/_vti_adm/fpadmdll.dll?page=webadmin.htm   Click on 'Check server health' choose 'Tighten security', detect and fix for the web or subweb that is experiencing the problem

That solved the issue I was experiencing.

Good vi tutorial

http://www.nuxified.org/vi_survival_guide

I like the % command which moves the cursor to the next matching bracket or paren. set showmatch to have it move to the beginning match when closing the bracket.

New Dell and Sonic Update Manager

Brand new Dell Dimension 1100; after removing a bunch of the bundled software, I kept getting a Windows Installer message after bootup asking for the Sonic Update Manager disk.  "1" was listed in the "look in"/disk location.  The solution can be found here:  http://forums.us.dell.com/supportforums/board/message?board.id=sw_other&message.id=48777&view=by_date_ascending&page=2

Which points to the following:  http://consumer.installshield.com/kb.asp?id=Q111006

I just downloaded and ran the first program listed.  Then ran the second program listed on the installshield.com web page.  The message never reappeared since....

Source of tech news: digg.com

www.digg.com  is a great source for lots of science / technology news.  A number of the links that I've posted on this blog have be found via digg.com

Open source Linux home theatre software: freevo and A/D converter

Home theatre software which Incorporates lots of open source projects including MythTV: http://freevo.sourceforge.net/about.html

How to build a Linux analog to digital converter:  http://linuxgazette.net//118/chong.html

Gmail 'operation' aborted in IE

Using Gmail, I have come across some emails that kill Internet Explorer if I open them.  The emails that do it for me are ones from financial institutions, but I've heard that others have the same issue with emails from different origins.  What happens is that when you open the 'bad' message, IE pops up it's "Security Information" box and says: "This page contains both secure and nonsecure items.  Do you want to display the nonsecure items?".   It doesn't matter if you select Yes or No, because IE will give an error message: "Internet Explorer cannot open the Internet site https://mail.google.com/mail/.   Operation aborted"   Then once you click OK, you get either an "Action canceled" or "The page cannot be displayed" errors.

This seems to happen only when using gmail via SSL:  https://mail.google.com/mail   You can view the message without any problems via gmail and standard http - http://mail.google.com/mail   The problem only seems to happen in IE;  using https://mail.google.com/mail  via FireFox, I have no problems opening the emails.  Another way around the issue is to open the email in a new window: turn on the keyboard shortcuts for gmail and then do a shift-o to open the message in a new window; it will open just fine that way.   Sometimes just trying to open the message after a few times will get it to open successfully.  Another thing that works is to open the message first using the standard http interface: http://mail.google.com/mail,  then without closing the browser, change the URL to secure http - https://mail.google.com/mail  then view the message without a problem.

The above was tested using fully patched IE6 on Windows XP, SP2  and using FireFox 1.5.  It may act the same way with different versions of both IE and firefox.