openvpn and virtualbox

Hi guys, I have a linux machine on which I occasionally run Windows XP in Virtual Box. All runs wonderful, except for the openvpn in XP, which can't connect to the vpn server running on a remote machine. The vpn client works from linux ... as far as I read until now it seems to be a problem of port forwarding ... I keep getting this error: TCP/UDP: Incoming packet rejected from 10.0.2.2:1194, expected peer address: (allow this incoming source address/port by removing --remote or adding --float) , but have no idea how to fix it.

From serverfault hyperboreean

• I suspect that Kamil is right.

  Change your networking in VirtualBox to Bridged instead of NAT, and I think this will work a lot better.

  From Matt Simmons

• Also note things like this in the VirtualBox 3.1.2 user manual, section 6.3.3 "NAT Limitations" on page 94:

  Protocols such as GRE are unsupported: Protocols other than TCP and UDP are not supported. This means some VPN products (e.g., PPTP from Microsoft) can- not be used. There are other VPN products which use simply TCP and UDP.

  In case it helps, one thing I've done in the past, is setup openvpn on the host. This way, all the guests using NAT have access to the vpn tunnel.

  Christopher Cashell : That shouldn't matter in this case. OpenVPN is pure TCP or UDP, at least as far as the host/transport is concerned.
  From Stéphane

How paranoid should I be with external IIS web servers accessing unauthenticated internal wcf services?

Environment:

• web and app servers are Windows Server 2003 Enterprise / IIS 6
• Web Server is behind a firewall - ports 80 and 443 are open to the world.
• Between the WebServer and the AppServer traffic goes through a firewall and only port 80 is open
• The webserver external website makes calls to WCF services on the app server. These WCF service calls are completely unauthenticated - but perform very critical data updates to a database server.

I assume (correct me if I'm wrong) that compromising the webserver would require an attack along port 443 or 80 from the outside world - thus it would require an IIS exploit to compromise the server.

Questions:

1. How bad is this configuration when dealing with critical data?
2. If the webserver is compromised, is there anything that can be done to mitigate its impact and for most scenarios prevent arbitrary invocation of the WCF services?
3. Is there a list of the "typical" impacts of historic IIS vulnerabilities?

From serverfault Nathan

• You are missing an important point. Attacks are not only done from outside. So if someone compromises the firewall, they can invoke the WCF service. Second scenario would be that someone mimics to be the webserver, that will fool the firewall and that someone would invoke the WCF service. Since you said the data is critical, the risk is bigger than the cost for the authentication.

  Nathan : How would someone "mimic to be the firewall"? Are you simply referring to ip address spoofing or something else?

  Peter Schuetze : I was not talking about that someone mimics to be the firewall. But, that someone with insider knowledge and access to your internal network is attacking the system. This way, you avoid the firewall between the outside world and the webserver. IP spoofing might be one of the scenarios. THe whole attempt with my answer was to shift the focus from 'all' attacks come from the outside to attacks can come from outside and inside (e.g. emploiyees and contractors).
  From Peter Schuetze

• Ensuring that domain and server isolation is set up will secure the traffic between the 2 servers. As long as your developer is using the proper injection prevention techniques, The only way I could see being able to invoke the WCF would be though a remote code execution vulnerability. There aren't too many of those and even if unpatched I think they all use the same rights as your worker process identity (which according to best practice should be locked down).

  I would highly reccomend that you take a look at the WCF security guidelines from the patterns and practices group, It's pretty easy to implement security for WCF (simple message signing comes to mind) that would not require that the traffic be authenticated (however domain and server isolation automagically implements that without impact to the application)

  Nathan : Doesn't the worker process identity have access to invoke the WCF Services by necessity? In that case, from a remote code execution vulnerability standpoint is anything really gained from authenticating the WCF services?

  Jim B : no, the worker process identity has the ability to send messages, assuming the server is compromised somehow, the best an attacker can do is send an unsigned message since he would have to be able to know how to invoke the applications code to correctly send a signed message. Regardless of platform, if your app is compromised you are hosed (which is why the guide focuses on app security since windows server security is pretty easy to set up). To put this in perspective, every large data breach in the past 5 years could have been prevented by simply implementing domain and server isolation
  From Jim B

Balancing between load and site stability (500 errors) with max-procs in lighttpd

I have a rather large dynamic site running off a single lighttpd powered box (1.3 million page views per day).

But Im frequently getting random 500 errors on the site, which sometimes go away within a second or 2... or sometimes not going away until lighttpd service is restarted.

If I set the max-procs to something low... like 2-4..... the server load is relatively low.... about 2-3 (at least for the hardware and the level of traffic), yet Im getting VERY frequent 500 errors. If I raise the procs to like 6-8, the server load doubles.... but I get less of these hiccups.

I currently settled at 6... which works out okay, but I still get quite a few of these intermittent 500 errors... with a non-recovering one every few days that requires a lighttpd restart.

What can I do?

The site is php/mysql powered.

From serverfault Yegor

• This problem may be the one that they have documented on the lighty site.

  Why is my PHP application returning an error 500 from time to time?

  Yegor : Interesting. Will try this out.
  From sybreon

How do I find out how an Active Directory group is being used?

Here's the scenario. I have an Windows 2003 Active Directory security group that was created in 2007, and no one remembers what it is for. Is is possible to find out what permissions in our AD implementation are assigned to this group? (Is it controlling folder permissions, is used to delegate user creation, is it doing nothing?)

We're using Windows 2003 as the AD controllers. The AD controllers are also the root DFS servers, but we're using Openfiler to server the actual SMB/CIFS shares.

The group isn't a member of anything, and the only people in the group at part of the IT staff. I tried accesschk from the sysinternals toolset, but it's not being helpful. Are there any other tools I should look at?

From serverfault quinnr

• If there are not too many people in that group, just deactivate that group and see what happens. It helps to tell anybody in that group what you are doing, so you can quickly investigate when something doesn't work anymore. Don't do that on your last day before you go on vacation. ;)

  The assumption is that you don't user user accounts (from you staff) for automated processes.

  quinnr : Right. :) That's where I'm at. I just hoped there was a more elegant way then doing a scream test. Thanks for your answer!
  From Peter Schuetze

• ShareEnum and AccessEnum would be the tools I'd use to try looking for Share/NTFS permissions related to the group.

  http://technet.microsoft.com/en-us/sysinternals/bb897442.aspx

  http://technet.microsoft.com/en-us/sysinternals/bb897332.aspx

  You should also consider that it's entirely possible that users were added to a security group only for the purpose of placing that group in an OU that has a group policy applied.

  GPMC is the quickest way I know of to find out what a group policy actually does.

  http://www.microsoft.com/windowsserver2003/gpmc/default.mspx

  Sorry if I tend to think outside the box first but we did say "no one remembers what it is for". It's entirely possible that no tool will show what the group is for as the group may exist but the permissions or policy that were applied in the past may have been removed.

  quinnr : I know what you're talking about, and it's quite handy. I'm looking for something that will walk through AD and report privileges and permissions assigned to AD Objects. I'm surprised MS hasn't written a tool for this. Thanks for the answer.

  Brian Desmond : What does GPMC reall have to do with this?

  pplrppl : What part of "no one remembers what it is for" did you not get. There are MANY possible uses for a group in active directory and not all of them are permissions based.
  From pplrppl

verisign certificate into jboss server SSL

Hi all, i'm trying to enable jboss to uses ssl protocol using a previously generated certificate from verisign, i imported both certificate, server certificate and ca certificate into the keytore file, and i configured the server.xml to use that keystore and activate ssl protocol, then when i run the jboss, I got this error "certificate or key corresponds to the SSL cipher suites which are enabled"

Question, reading some post on internet, i found that every example was made it generating a Certificate Request, it stricly necesary to do that if i already have the server certificate and that CSR has to be imported into the keystore as well ? at this point i'm very confused about this issue, i tried almost every solutions posted in several forums but till now i haven't any luck !! can you give me some tips in order to solve this problem.

thanks in advance

this are my keystore file: Keystore type: jks Keystore provider: SUN

Your keystore contains 2 entries

j2ee, Dec 29, 2009, trustedCertEntry, Certificate fingerprint (MD5): 69:CC:2D:2A:2D:EF:C4:DB:A2:26:35:57:06:29:7D:4C ugent, Dec 29, 2009, trustedCertEntry, Certificate fingerprint (MD5): AC:D8:0E:A2:7B:B7:2C:E7:00:DC:22:72:4A:5F:1E:92

and my server.xml configuration:

From serverfault $pageUsers[$entry.posts[0].author].name

• When you generate the certificate request in the store then the public/private keypair is generated in the store. These keys are required for SSL Encryption to work. It sounds to me like these were generated on the other system and not are not in your store.

  Usually you can transport certificates and keys around in a file format called pfx but the java keytool stuff doesn't seem to do much with this and as you suggest would like you to generate a new keypair/certificate and then go from there.

  It does seem possible however to import a whole keystore into your new keystore so if you have the old machine/keystore this may be a possibility.

  http://download.java.net/jdk7/docs/technotes/tools/solaris/keytool.html

  From Mark Sutton

• Finally i found a solution for this problem, as you said i need to have my private key, server certificate and ca certificate into my keystore, in this post they explains how to import this 3 existing elements (as in my case) into the keystore using a very useful tool called keyman. http://www.jguru.com/faq/view.jsp?EID=532461

  cheers,

  From $pageUsers[$post.author].name

Looking for a virtualization guide, looking to virtualise SBS 2008 and Server 2008 machines

I would like to "play" around and find out more about Virtualisation, mainly for Microsoft servers and PC's.

Any good guides or blogs would be great

thanks!

From serverfault MikeT505

• TechNet has several deployment guides available.

  From Joe Internet

Remote Desktop settings not being applied for user

We have a number of Win 2003 servers for which we have Remote Desktop enabled. Each user has their profile edited so that they can only connect for 2 hours maximum and have 30 minutes idle time, after which they are disconnected and the session closed. On one server however, the administrator account does not have the maximum session limit working. We can stay connected for days if we want. Originally this was how it was setup, and we later changed the profile for all users so that there are limits. We have rebooted the server a couple of times since, and the Management Console shows the limits. If we are idle for too long we are disconnected.
Other users are having all the limits observed.
Any suggestions?

From serverfault Anthony K

• Check the group policies if you have conflicting configurations. Also have a look at this: http://support.microsoft.com/?kbid=940122

  From Martin P. Hellwig

• You may find Resultant Set of Policy (RSoP) snap-in useful in resolving your issue. Essentially it allows you to check policies in effect for a given user or computer in Active Directory environment.

  From Taras Chuhay

• I am not sure if I am getting the question right but here goes. So you are saying that at one time this server was set up with no limits on terminal sessions, but now you set the limits and all users that connect to this server have the limits applied to their session?

  And the problem is that the administrator account is not having the limits applied?

  If that is the case it could be Remote Desktop for Administration in Windows Server 2003.

  I could be way off base here, I am just not understanding what you are asking.

  http://support.microsoft.com/kb/814590

  From $pageUsers[$post.author].name