Melbourne Trip
Yes, I am flying to Melbourne Office. Nice!!
I am doing Domain Controller hardware refresh and Proxy server replacement.
I am doing Domain Controller hardware refresh and Proxy server replacement.
Create SSL Certificate
If you want to get a FREE SSL certificate, you can get it from CAcert. All you need to do is to have your CSR ready.
As per my previous blog about creating CSR, all you need to do with openssl (Linux or cygwin) is:
%> openssl req -new -nodes -keyout private.key -out public.csr
Submit the public.csr to the CAcert, it will give you the public key of your SSL certificate (save it as public.cer)
Now you need to convert both your public and private key to PKCS12 format:
%> openssl pkcs12 -export -out cacert.p12 -in public.cer -inkey private.key
You then will have cacert.p12 which you could import to IIS
As per my previous blog about creating CSR, all you need to do with openssl (Linux or cygwin) is:
%> openssl req -new -nodes -keyout private.key -out public.csr
Submit the public.csr to the CAcert, it will give you the public key of your SSL certificate (save it as public.cer)
Now you need to convert both your public and private key to PKCS12 format:
%> openssl pkcs12 -export -out cacert.p12 -in public.cer -inkey private.key
You then will have cacert.p12 which you could import to IIS
Fix MBR with Linux boot loader
If for some reasons your MBR is corrupted, you won't be able to boot back to your OS.
Boot from the Linux installation CD and type:
%> linux rescue
It starts mounting your linux installation partition to the /mnt/sysimage. Then type:
%> chroot /mnt/sysimage
Now you are in the shell within the parent directory. It depends on your boot loader, if it is GRUB, then do:
%> grub-install /dev/sda
For SCSI disk or
%> grub-install /dev/hda
for IDE disk
If you have LILO, then do:
%> /sbin/lilo
Boot from the Linux installation CD and type:
%> linux rescue
It starts mounting your linux installation partition to the /mnt/sysimage. Then type:
%> chroot /mnt/sysimage
Now you are in the shell within the parent directory. It depends on your boot loader, if it is GRUB, then do:
%> grub-install /dev/sda
For SCSI disk or
%> grub-install /dev/hda
for IDE disk
If you have LILO, then do:
%> /sbin/lilo
Unload application disabled /greyed out in IIS
In IIS6 application unloading / recycling is handled differently. You may notice that the "Unload" button is greyed out or disabled in the Application Settings area. This is because the application is in native IIS 6 mode using application pools. Synonymous to unloading the application in IIS 5 is the concept of recycling the application pool in IIS6, see the Application Pools folder in IIS manager (inetmgr). The only time the Unload button will work is if the IIS web service is running in IIS 5.0 isolation mode and the Application Protection is set to either Medium or High.
Microsoft Ready Summit 2006
Yes, Microsoft Ready Summit 2006 today @ Darling Harbour - Sydney.
The keynote was great, Microsoft Australia Managing Director, Steve V, was talking the evo products.
Cool thing about EVO:
Vista Bitlocker
Vista built-in shadow copy
Vista Search Engine - able to save the search result as a dynamic content folder
Vista Deployment Service
Groove Server
Group policy for blocking device installation - get rid of USB drives
Windows Firewall group policy enhancement - 3 profiles: Domain, Private and public
Exchange 2007 Managed folders - automatic archive emails
Exchange 2007 Unified Messaging - voice mail inbox capability
Network Access Protection - quarantine network for un-healthy machine, incorporate IPSec and Health Certificate
Sharepoint 2007 Rocks!!!
www.microsoft.com.au/readysummit
Microsoft Partner Roadshow 2006
I am attending the Microsoft Partner Roadshow '06 today at Darling Harbour - Sydney.
They were talking about Vista, Office 07 and Exchange 2007 and the benefit of Microsoft Partner.
Links:
http://www.microsoft.com.au/partner/evo
Windows Scripting Links
link will be posted here:
Script Center:
http://www.microsoft.com/technet/scriptcenter/default.mspx
Using WMI:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/using_wmi.asp
WMI Reference:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/wmi_reference.asp
WMI Explorer:
http://www.ks-soft.net/hostmon.eng/downpage.htm
Script Center:
http://www.microsoft.com/technet/scriptcenter/default.mspx
Using WMI:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/using_wmi.asp
WMI Reference:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/wmi_reference.asp
WMI Explorer:
http://www.ks-soft.net/hostmon.eng/downpage.htm
MCSE Messaging+
Today is the final day for Microsoft certification for me.I've passed 70-285 and get my MCSE Messaging+ certification.
Getting the .spc and .pvk files for Code Signed certificate
Getting code signed
Something that has bothered me for a while is the hassle in putting together all the pieces to sign my download files. I finally got around to looking it all up, and it isn't easy as you have to piece all the things together. I hope that this will give you an insight into how it can really work, since I managed to actually achieve what I wanted and sign my code. This article is a list of the steps I had to take, and you will probably need to review the commands yourself if you have problems.
The process
Get a certificate from http://www.ascertia.com/onlineCA/Issuer/CerIssue.aspx who will do a free code signing certificate. Obviously any alternative is good, but this will prove the concept for you, and you can go buy another from them or elsewhere later. The email address is included in the certificate, so use a sensible one you are happy for the world to see. Accept the installation of the certificate into the browser as it won't be emailed even though they say it will. Make sure you chose exportable.
Then get the Microsoft code signing stuff (codesigningx86.exe) from the MSDN web site (google will find its current location).
Use the certmgr to view your certificate and export it. Export it as a certificate (.cer file), and with the key (.pvk) file.
Use cert2spc to convert the cer file into an spc file. That's the first half of the process done. Now you need a key file compatible with the signcode application.
From http://support.globalsign.net/en/objectsign/transform.cfm:
How to transform your certificate to a pvk + spc combination.
Export your certificate to a pfx file (be sure to check "Include all certificates in the certification path if possible"). (The latter will help ensure it is accepted by more systems.
Install openssl. You can find compiled binaries on www.openssl.org (but get the Windows build from http://www.shininglightpro.com/ http://www.shininglightpro.com/download/Win32OpenSSL-v0.9.7d.exe)
Extract your private key from the pfx file.
->openssl pkcs12 -in-nocerts -nodes -out
The pfx password will be asked.
Download the pvk transform utility. This file can be found at http://support.globalsign.net/en/objectsign/PVK.zip.
-> pvk -in-topvk -out
Extract your certificates from the pfx file.
openssl pkcs12 -in-nokeys -out
The pfx password will be asked.
Transform your pem file to a spc file
->openssl crl2pkcs7 -nocrl -certfile-outform DER -out
Something that has bothered me for a while is the hassle in putting together all the pieces to sign my download files. I finally got around to looking it all up, and it isn't easy as you have to piece all the things together. I hope that this will give you an insight into how it can really work, since I managed to actually achieve what I wanted and sign my code. This article is a list of the steps I had to take, and you will probably need to review the commands yourself if you have problems.
The process
Get a certificate from http://www.ascertia.com/onlineCA/Issuer/CerIssue.aspx who will do a free code signing certificate. Obviously any alternative is good, but this will prove the concept for you, and you can go buy another from them or elsewhere later. The email address is included in the certificate, so use a sensible one you are happy for the world to see. Accept the installation of the certificate into the browser as it won't be emailed even though they say it will. Make sure you chose exportable.
Then get the Microsoft code signing stuff (codesigningx86.exe) from the MSDN web site (google will find its current location).
Use the certmgr to view your certificate and export it. Export it as a certificate (.cer file), and with the key (.pvk) file.
Use cert2spc to convert the cer file into an spc file. That's the first half of the process done. Now you need a key file compatible with the signcode application.
From http://support.globalsign.net/en/objectsign/transform.cfm:
How to transform your certificate to a pvk + spc combination.
Export your certificate to a pfx file (be sure to check "Include all certificates in the certification path if possible"). (The latter will help ensure it is accepted by more systems.
Install openssl. You can find compiled binaries on www.openssl.org (but get the Windows build from http://www.shininglightpro.com/ http://www.shininglightpro.com/download/Win32OpenSSL-v0.9.7d.exe)
Extract your private key from the pfx file.
->openssl pkcs12 -in
The pfx password will be asked.
Download the pvk transform utility. This file can be found at http://support.globalsign.net/en/objectsign/PVK.zip.
-> pvk -in
Extract your certificates from the pfx file.
openssl pkcs12 -in
The pfx password will be asked.
Transform your pem file to a spc file
->openssl crl2pkcs7 -nocrl -certfile
ESX Server Guest OS NIC 10MB Only
If your guest OS on ESX Server is only using 10 MB NIC, install the VMWare tools and change the network driver to vmxnet from your ESX Management console
MCSE - Finally
I have passed my last elective exam: 70-284 with score 820.
This is it. I am officially a Microsoft Certifiied System Engineer!! what a relief!! After 7 exams.
I might do the 70-285 to get the MCSE+messaging and Citrix or SQL2005 after that :)
(or Checkpoint or CCNP or Ethical hacker)?
This is it. I am officially a Microsoft Certifiied System Engineer!! what a relief!! After 7 exams.
I might do the 70-285 to get the MCSE+messaging and Citrix or SQL2005 after that :)
(or Checkpoint or CCNP or Ethical hacker)?
IIS Integrated Windows Authentication
Have you ever encounter a pop-up windows asking for username and password when you try to access an intranet site hosted on IIS with Integrated Windows Authentication even though you are login to your windows with domain account?
IE determines the URL address whether it is local or not by checking the URL if it is contain a dot (.) or not. If the URL contains a dot, it assumes the URL is not local, thus it won't pass the user domain credential to the server (what for?).
You can avoid this issue by putting the URL in your IE setting's Local Intranet Sites
IE determines the URL address whether it is local or not by checking the URL if it is contain a dot (.) or not. If the URL contains a dot, it assumes the URL is not local, thus it won't pass the user domain credential to the server (what for?).
You can avoid this issue by putting the URL in your IE setting's Local Intranet Sites
Change IIS Compression with C#
With Exchange SP2 on your front-end Exchange server, you might need to disable the dynamic and static compression with IIS to support GPRS for Windows Mobile Direct Push email.
You can either edit the Metabase.xml file and change the configuration directly like here or you can edit the configuration on the fly using the C#
Here is the code:
cscript C:\Inetpub\AdminScripts\adsutil.vbs set w3svc/1/root/Microsoft-Server-ActiveSync/DoDynamicCompression false
cscript C:\Inetpub\AdminScripts\adsutil.vbs set w3svc/1/root/Microsoft-Server-ActiveSync/DoStaticCompression false
You can either edit the Metabase.xml file and change the configuration directly like here or you can edit the configuration on the fly using the C#
Here is the code:
cscript C:\Inetpub\AdminScripts\adsutil.vbs set w3svc/1/root/Microsoft-Server-ActiveSync/DoDynamicCompression false
cscript C:\Inetpub\AdminScripts\adsutil.vbs set w3svc/1/root/Microsoft-Server-ActiveSync/DoStaticCompression false
Squid Reverse Proxy Redirect HTTP to HTTPS
To redirect HTTP traffic to HTTPS traffic when use Squid as the reverse proxy, use the following ACL in your squid.conf
acl httpPort myport 80
http_access deny httpPort
deny_info https://url.domain.com httpPort
acl httpPort myport 80
http_access deny httpPort
deny_info https://url.domain.com httpPort
Squid Proxy using parent with SSL
Squid can use cache_peer as the parent of the connection and uses SSL as the protocol. If the SSL certificate is self signed, you can use sslflags to bypass the verification:
cache_peer webmail.infomedia.com.au parent 443 0 no-query default ssl sslflags=DONT_VERIFY_PEER
cache_peer webmail.infomedia.com.au parent 443 0 no-query default ssl sslflags=DONT_VERIFY_PEER
Problems with Exchange server Activesync and Windows
Workaround - Problems with Exchange server Activesync and Windows
Mobile 5.
Facts:
Windows Mobile 5.0 ActiveSync connection to Exchange 2003 via Orange or O2 GPRS network in the UK (may also be seen on other networks)
Error code 0x8503001A appears during sync and sync fails Exchange SP2 applied Sync works fine locally using Wifi or remotely via cradle/usb/internet link
Windows Mobile 2003 works fine in all cases Forms Based Authentication has been enabled at some point, with http compression.
After many hours of troubleshooting, I have found a workaround to the 0x8503001A sync problem that many people are experiencing.
The answer is that HTTP compression is enabled for Activesync in the IIS Metabase when SP2 is installed, and in conjunction with a (presumed) bug in Exchange where the IIS Metabase configuration is not
restored to previous settings after turning off FBA High compression,
causes the above problem.
These instructions will restore Activesync functionality for those
experiencing the issue.
First make a backup of the MetaBase:
Open IIS Manager Right click on server->AllTasks->Backup/Restore Configuration...
Click Create Backup
Give the backup a name (e.g. 'Backup before fix')
Click OK, Close
Then enable direct Metabase Edit
Open IIS Manager Right click on server and go to Properties
Check "Enable Direct Metabase Edit"
Click OK
Load notepad and open C:\WINDOWS\SYSTEM32\INETSRV\METABASE.XML
Look for
IIsWebVirtualDir Location="/LM/W3SVC/1/ROOT/Microsoft-Server-ActiveSync"
and just below it, you will see:
DoDynamicCompression="TRUE"
DoStaticCompression="TRUE"
Change both of these to FALSE (NB there are more of these throughout the METABASE.XML file, be sure only to change these two)
Save the Metabase.xml file back and restart IIS: Start->Run->IISRESET
Enjoy!
------------
Further information... In Metabase.xml, SP2 changes the above settings from FALSE to TRUE for ActiveSync. Presumably Compression is disabled overall until you enable FBA with Compression. The following line in
the METABASE.XML file acts as an overall ON/OFF switch for compression and also has the effect of providing a workaround (at the expense of losing http compression elsewhere, e.g. for OWA):
Look for the line HcNoCompressionForHttp10="FALSE"
Change FALSE to TRUE (the setting before enabling FBA with compression)
If you don't want OWA/FBA with any compression, I would safely assume you want to change the above line.
In fact, I would suggest that the Compression setting under Forms Based Authentication should be independently settable (not as a sub-option to FBA!)
There is a bug in all versions of Exchange which means once that
compression is enabled, disabling via the FBA screen doesn't reverse
the changes completely (as an SP2 install on a system that NEVER had FBA/compression enabled, will still function correctly).
The question for Microsoft is, how are compressed HTML packets getting corrupted by the mobile networks - obviously some NAT/Transparent Proxy in the way, but it's a weird one... And needs fixing (as well as the
"disabling compression doesn't actually do it" bug)!
Subscribe to:
Posts (Atom)