Saturday, February 21, 2015

Windows System File Checker

System File Checker is a utility in Windows that allows users to scan for corruptions in Windows system files and restore corrupted files. This article describes how to run the System File Checker tool (SFC.exe) to scan your system files and to repair missing or corrupted system files in Windows 8.1, Windows 8, Windows 7 or Windows Vista. If a Windows Resource Protection (WRP) file is missing or is corrupted, Windows may not behave as expected. For example, some Windows functions may not work, or Windows may crash.

Run the System File Checker tool (SFC.exe)

To do this, follow these steps:
  1. Open an elevated command prompt. To do this, do the following as your appropriate:
    To do this, click Start, type Command Prompt or cmd in the Search box, right-click Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.
    A screenshot for this step.
  2. At the command prompt, type the following command, and then press ENTER:
    sfc /scannow
    A screenshot for this step.


    The sfc /scannow command will scan all protected system files, and replace corrupted files with a cached copy that is located in a compressed folder at %WinDir%\System32\dllcache.
    The %WinDir% placeholder represents the Windows operating system folder. For example, C:\Windows.

    Note Do not close this Command Prompt window until the verification is 100% complete. The scan results will be shown after this process is finished.
  3. After the process is finished, you may receive one of the following messages:
    • Windows Resource Protection did not find any integrity violations.

      This means that you do not have any missing or corrupted system files.
    • Windows Resource Protection could not perform the requested operation.

      To resolve this problem, perform the System File Checker scan in safe mode, and make sure that the PendingDeletes and PendingRenames folders exist under %WinDir%\WinSxS\Temp.
    • Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

      To view the detail information about the system file scan and restoration, go to How to view details of the System File Checker process.
    • Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

      To repair the corrupted files manually, view details of the System File Checker process to find the corrupted file, and then manually replace the corrupted file with a known good copy of the file.

Wednesday, February 18, 2015

Sendmail v8.12

Sendmail  v8.12 is the first release of Sendmail to draw a distinction between the Message Submission Process (MSP) and the Mail Transfer Agent (MTA) portions of the email equation. Simply put, the MSP is the procedure used by local processes when they wish to emit email from the local machine. The MTA is the process which handles receiving email from other systems and either relaying it onwards or delivering it locally. In other words, the MTA is the process that listens on 25/tcp and the thing we want to shut off.
The problem is that the default behavior of the MSP is to attempt to deliver outgoing email by talking to the MTA over the system's internal loopback interface. This means that if we shut off the local MTA, then the default MSP will be unable to send email out of the system! This is not a feature.
It turns out that the MSP doesn't have to emit email by talking to the local MTA over the loopback interface. It can talk to any mail server on the network that the administrator desires. In this mode, the MSP is acting very much like the nullclient configuration that we discussed in the previous section. The macro configuration file is only slightly more complicated:

 include(`cf/m4/cf.m4')
 define(`confCF_VERSION', `Submit')
 define(`__OSTYPE__', `')
 define(`confTIME_ZONE', `USE_TZ')
 define(`confDONT_INIT_GROUPS', `True')
 FEATURE(`msp', `mailhost')
Again, set the pathname on the first line and the name of the machine on the last line as appropriate for your site. The configuration file produced from the above macros should be installed as /etc/mail/submit.cf on your systems.
Note that you can also simply hack the submit.cf file provided by your vendor. Just look for the line that reads

 D{MTAHost}[127.0.0.1]
Just replace [127.0.0.1] with the name of your new relay host. For example,

 D{MTAHost}mailhost
Save your changes, and you're done!
The split between MTA and MSP is also reflected in how the Sendmail daemon is started at boot time. When using Sendmail v8.12, two daemons are normally started by the system boot scripts:

 /usr/sbin/sendmail -bd -q15m
 /usr/sbin/sendmail -Ac -q15m
The first line looks identical to the normal Sendmail invocation for Sendmail v8.11 and earlier-- this is the MTA process that is listening on 25/tcp for incoming email, and which processes a queue of messages received by this process. The second line invokes a daemon for the MSP. This daemon doesn't listen on any port for incoming messages: its sole duty is to process a separate MSP queue for messages generated on the local machine but which could not be delivered immediately because the MSP's mail relay was unavailable for some reason.
So in v8.12 Sendmail, the MSP has its own message queue and its own daemon for flushing that queue on a regular basis. This means that on email "client" type machines the MTA daemon is completely unnecessary and can be shut off completely. In order to get this to happen, however, it will probably be necessary to hack the default boot script provided by your vendor. I have yet to find a vendor who has a simple configuration switch for disabling the MTA process without disabling the MSP. In fact, most vendors in my experience don't even realize that you can run the MSP without a local MTA.

Tuesday, February 10, 2015

NagiosQL

NagiosQL is a web based administration tool designed for Nagios, but might also work with forks. It helps you to easily build a complex configuration with all options, manage and use them. NagiosQL is based on a webserver with PHP, MySQL and local file or remote access to the Nagios configuration files.
The main features are:
  • create, delete, modify and copy settings
  • create and export configuration files
  • create and download configuration files
  • easy configuration import
  • auto backup configuration files
  • consistency checks
  • syntax verification
  • user management
  • instant activation of new configs
  • many translations
  • easy Installation wizard
  • MySQL database platform

Monday, February 2, 2015

FreeBSD - Security Tips

Security has always been a major topic alongside with Open Source systems. A weak entry-point in any system may allow hackers to gain access to critical servers and information and then cause a backdoor or heavy damage in the entire network.

FreeBSD
When applying security measures to a system, it is highly advised to start by securing the basic system configurations, and then up to secure the network layer so that it complies to the system policy and the organization’s security procedures. Many corporations already have a security policy that covers all configurations of  the internal technology devices. The policy should include the security configuration of workstations, user desktops, mobile devices, phones and servers.
There are some general and became-traditional steps that FreeBSD admins are always doing, such as employing password hashes & password policy enforcement or activating the Binary verification where a specific software application, intrusion prevention system (IDS), that is natively supported by FreeBSD, is to verify every change in the system files and report them to security teams. However, It is essential that you create a security plan, not just activating default procedures that hackers really know, to secure your server immediately upon installation. Do not leave it up without first securing it. Here are the basic recommended concepts, you need to do in order to secure your server:
  • Run only the services you plan on using
  • Use only the services that are necessary
  • Use secure passwords
  • Force users on your machine to use secure passwords
  • Restrict root access to a minimal set of services
  • Restrict access to these services via tcpwrappers
  • Restrict access to your box using IP Firewall services (ipfw)
  • Log events on your machine and understand what logs are being kept
  • Install some type of system change detection software, so that you can tell if your server has been compromised
  • Back up your server’s data so that if it is compromised, you can reinstall from scratch, but still have your data available
  • Finally, physical security is important. The more people who have physical access to the machine, the less secure your server is
There are some services you should not ever run, At the top of this list, is Telnet. You should access your servers using Secure Shell (SSH) as all information is encrypted. Telnet is very insecure since it passes all information in clear text across the network. In addition, other common services with this problem include FTP, POP, and IMAP. If you are just starting out as an ISP, this is your chance to work with SSH and SCP clients for your users, as well as encrypted POP and IMAP email clients, or secure Webmail servers using SSL.