Bailiwick in DNS requests

So a month or two ago Dan Kaminsky discovered one of the most severe flaws from the last recent years, perhaps even since the internet boom.
With the flaw, hackers can redirect internet traffic by answering maliciously to your DNS requests.
Dan has written a nice article on his blog.
More details and patches you can find on the Microsoft sites.

Since I realised I knew nothing about how this exploit actually functioned, I read up on it last week, in a spare minute and came across something I never heard of before: bailiwick.

So I decided to spend a little more time on this and did some research on the "bailiwick" thing.
This is what I found out:

There are two important precepts to remember about content DNS server bailiwick:

1. Bailiwick is in the eye of the beholder.
Bailiwick is not inherent in the content DNS servers themselves. Content DNS servers don't know anything about their bailiwicks. The bailiwick of a content DNS server cannot be obtained from the server itself. The DNS protocol does not provide it with any way of knowing who issues the referrals that cause resolving proxy DNS servers to come to it, or what those referrals are.

It is only the resolving proxy DNS servers following that referral that know what the referrals are. It is the resolving proxy DNS servers that track the bailiwicks of the content DNS servers that they send queries to, and apply them as they process the responses.

2. Bailiwick applies only fleetingly, and multiple bailiwicks can apply to a single content DNS server.
The bailiwick of a content DNS server applies only to the query resolution at hand. A content DNS server can have many bailiwicks because it is referred to for information on names in several different domains. If multiple queries are being resolved for names in these different domains, it can indeed have those bailiwicks simultaneously.

For example: If the content DNS servers listening on IP addresses 207.228.252.101 and 209.81.71.60 serve up information on names in both the "scitechsoft.com." and the "openwatcom.com." domains, because they are owned by people who own both of those domains, then they will have the bailiwick "scitechsoft.com." when the "com." servers refer resolving proxy DNS servers to them for information on names in "scitechsoft.com.", and the bailiwick "openwatcom.com." when the "com." servers refer resolving proxy DNS servers to them for information on names in "openwatcom.com.".
For another example: The Verisign/Network Solutions content DNS servers serve up information on names in "com." and "net.". Their bailiwick is "com." or "net.", depending from the query being resolved at the time, and hence from what domain the "." content DNS servers actually issued the referral pointing at them in the first place.

The complete article on it, you can find here.

Very interesting stuff, if I can say so myself ... :)

Microsoft offers cooperative technical support on Validated Virtualized Environments!

What's the biggest concern when virtualizing your environment? No, not performance, not scalability, not management, not costs, ...
Instead, it's the fact that when you have a serious problem, not linked to the fact that the servers are virtualized, you are not covered by the Microsoft support program.

Now, thank to the SVVP (Server Virtualization Validation Program) program you don't have to worry about that anymore. ESX 3.5 U2 is the first VMware hypervisor being covered by the program. Providing VMware customers who run Windows Server and Microsoft applications with access to cooperative support from Microsoft and VMware.

Thus, eliminating one of the biggest factors why enterprises were reluctant to virtualize mission critical servers.

Message from VMware:
Microsoft’s Server Virtualization Validation Program enables VMware and other software providers to test and validate their virtualization software to run Windows Server 2008 and previous versions of Windows Server. Under this program, Microsoft offers cooperative technical support to customers running Windows Server on validated, non-Microsoft server virtualization software, such as VMware ESX 3.5 update 2.

The rest of the article you can read here.

Extracting the details from a CSR certificate request

I'm sure that those of you that have already created, configured and implemented certificates before know the importance of filling in the correct details when creating the certificate request.

The other day I had to create one to secure a website for a customer. But there were a few issues. They had a root certificate authority in place (somewhere in the states), but the site where I was at (Belgium) didn't have any information for me on what I needed to fill in. Viewing the time difference, I couldn't just pick up the phone and call ...

Instead I found this great site that allows you to paste an existing CSR into a tool they created and it extracts all the information you need:
1. Common name
2. Organisation
3. OU
4. City
5. State/Country
6. Country

Very, very cool and handy.

The website you can find here: Check your CSR

Enjoy!

Free PowerShell commands for Active Directory

The good people of Quest have done it again...
On their site, you can freely download a set of predefined Windows PowerShell commands for Windows Active Directory management.
Together with a complete admin guide of 231 pages!

You can download the sources for this on the Quest site.

Here below is a sample script to create AD user accounts:

After you get it installed, you can start a regular PowerShell session and type:
Add-PSSnapIn Quest.ActiveRoles.ADManagement
This will extend the PowerShell for AD.

First we save the plaintext password as a AsSecureString:
PS C:\Users\yl.admin\Documents\PS> $pw = read-host "Enter password" -AsSecureString
Enter password: ********

Then connect to the targeted domain:
PS C:\Users\yl.admin\Documents\PS> Connect-QADService -service 'xyzdcs01.xyz-stage.com' -ConnectionAccount 'xyz-stage\administrator' -ConnectionPassword $pw

Once you establish the connection to AD, you can import the csv file which has the below format:
Name Description
Svc_SP_IntrAP Intranet content web application pool
Svc_SP_IntrSSPAP Intranet farm shared services provider application pool

PS C:\Users\yl.admin\Documents\PS> import-csv C:\myworkspace\user.csv |%{new-qadUser -ParentContainer 'OU=Service Ac
ts,DC=xyz-stage,DC=com' -name $_.name -samAccountName $_.name -description $_.Description}

The accounts specified will show up in your AD.

A collection of all Administrative Templates (ADMX) for Windows Server 2008

Administrative template files in Windows Server 2008 and Windows Vista are divided into ADMX (language-neutral) and ADML (language-specific) files. ADML files are XML-based ADM language files that are stored in a language-specific folder. By default, the %Systemroot%\PolicyDefinitions folder on a local computer stores all ADMX files, and ADML files for all languages that are enabled on the computer.

Microsoft has released the beginning of this week a complete set with all ADMX Administrative templates for WS08.
The set can be downloaded here.

Administrative templates provide Group Policy setting information for the items that appear under Administrative Templates. Group Policy tools use Administrative template files to populate policy settings in the user interface. This allows administrators to manage registry-based policy settings.

A list of the most common Powershell cmdlets for Exchange 2007 (E2K7)

As you all know, the Exchange Management Console for E2K7 is basically only a graphical interface that launches PowerShell commands.
You'll all know the frequently used cmdlets like: Set-Mailbox, Get-DistributionGroup, Disable-Mailbox, ......

But it was hard to find a clear overview of all cmdlets and their actions and parameters. But that has changed, Microsoft has published a "Quick reference" that lists the most commenly used cmdlets together with the actions you can perform with them.
It's displayed in a structural overview that let's you quickly find what you need (examples included).

You can download the Quick reference from the Microsoft website.

Installing SQL Reporting Services uses wrong credentials

For a project I'm leading we were installing a SQL Reporting Services server, no simple feed I found out ...

Everything went fine, until I had to enter the credentials to connect to the SQL instance I had created on a different SQL server.

Little inside info: the reporting server I'm trying to configure is located in our DMZ zone and will be accessed by our external client.
First, the domain in the DMZ is different than the domain we use internally, so both servers were located in different domain.
Secondly, because the client connects to the reporting and thus also to the SQL server, we have removed the SQL permissions of the server administrator and created a specific SQL account for the client which has sysadmin & dbowner rights. That should be sufficient.

Now, coming to the credential step in the reporting wizard, I give up the account & password, but I receive an error message stating that "Login failed for user 'NT AUTHORITY\ADMINISTRATOR'".

Appearently this happens when you want to install SQL Reporting Services on a different server than the SQL server, which is recommended by the way ... (IIS should not be installed on a database server for performance reasons).
By default the credentials of the person logged into the server is what is used for installing the databases, only later is the account you specify in the installation wizard used for running Reporting Services ... GO FIGURE!!

Now, there are 2 things you can do (I had to use both in combination with eachother)
1. Locate the template.ini file and behind the values RSSETUPACCOUNT= and RSSETUPPASSWORD= specify the account and password that has the SQL priveledges.
2. Launch the setup.exe or .msi with the same parameters from a command screen, making it: “C:\RS\setup.exe“ RSSETUPACCOUNT=sa RSSETUPPASSWORD=sapwd.

To install services packs, it's the same procedure.

Hope this helps you out as well as it did for us ...

VMware tools: ESX StorageView

I've already posted on my blog about the MightyCare ESX Patcher. Now with ESX 3.5 it's become a bit obsolete, but those guys are still working on some pretty cool stuff that you can freely use in your virtual environment.

I've downloaded and installed their MCS Storageview tool, which displays all the logical partitions (so not just the vmdk files) of all your running virtual machines on ESX 3.x or VC 2.x.
The tool can also display how much of the logical partition is free space, so the admin can decrease the partitions if needed.


The tool can be downloaded here. You'll see on the page that there are more cool tools to download, such as the snapshot checker.

VMware tools: ESX Config check: security best practices

This tool is a cool, FREE utility that can scan the security of VMware ESX 3.5 hypervisor configurations compared to the VMware Infrastructure 3 Security Hardening guidelines.

Tripwire ConfigCheck ensures ESX environments are properly configured, offering immediate insight into unintentional vulnerabilities in virtual environments and provides the necessary steps towards full remediation when they are not.

Features:
- Ensure recommended ESX configurations
- Discover possible vulnerabilities
- Deploy virtualization safely and securely
- Increase security posture of the entire enterprise
- Easily implement security and compliance best practices
- Reduce configuration drift

This handy freeware can be downloaded here.

Direct connect: the DMZ killer

Very interesting article I read on bink.nu ...

Using Vista and WS08, you can use the IPsec features of IPv6 and NAP to create direct connectivity to the corporate servers while working remote without having to create VPN's or hastle with gateways.

Basically, a home user will have access to AD, file servers, ... without any further configuration, as long as he uses a trusted computer account AND user account.


Original story:
Last Friday, Steve Riley - security architect at Microsoft did an excellent session about various security subjects in Amsterdam. One of the subjects was a technology that I only knew of as highly secret within Microsoft and probably one of the biggest changes in network security to come.

Imagine that corporate end users are able to take their corporate mobile systems to any Internet connected place and work with corporate resources without a VPN or gateway. This enables the users to connect to Active Directory, have their clients managed while at home or traveling. At the same time users get full access to the corporate network without the hassle of extra client software or gateways.

Direct Connect uses IPv6 with IPSec to create save direct connectivity to servers on corporate networks for trusted clients. This is quite a revolutionary approach, as it enables clients from the Internet to bypass the DMZ. The concept relies on IPSec authentication and encryption. Microsoft's new IPSec implementation in Windows Vista and Server 2008 allow IPSec connections to be based on both computer and user credentials, combined with Network Access Protection for system health enforcement. The only thing an edge router has to do, is filter incoming traffic to allow only IPSec initiation requests and subsequent IPSec traffic. Any standard router can do just that.

Steve Riley pointed out that you can build a Direct Connect infrastructure with standard products currently available from Microsoft and that Microsoft will provide more information in the near future. He also mentioned that Microsoft marketing is not yet thrilled, because no extra licenses will be needed to build a Direct Connect infrastructure.

Microsoft is currently running a (secret) pilot with Direct Connect that enables participants to use their corporate laptops to directly work with systems on the corporate network from the Internet.

I told Steve I can't wait for the white paper "How to build a Direct Connect infrastructure" and get instant access to my home systems from any place in the world.