Trust Relationship Problems

One of the workstations in a domain was displaying "Trust Relationship Between Workstation and Domain has Failed" or something similar whenever a user tried to logon. I was able to logon via the local admin and access the network. This problem is caused by the shared secret or password used by Kerberos that had gotten out of sync with the domain controller. This particular machine has had some problem with hibernating in the past and is not used on a daily basis so that kind of makes sense. Googling the problem results in many hits that advise you to remove the machine from the domain and then rejoin it. This sounds a little heavy handed and at least one person agrees with me. I attempted the solution using netdom.exe and ran into a few issues and then making a command decision I figured it would take less time to leave and rejoin the domain then to mess with anything else. I can learn something new another day. After the reboots, the problem was solved and users could login normally. I should look at that hibernate problem while I am here....

Disable SSTP Certificate Revocation Check

Windows 7 supports a number of different types of VPN protocols. PPTP and IKE can be problematic when attempting to connect through a router that is conducting NAT. SSTP gets around that problem by tunneling over an SSL session. In order to enable SSTP, the server must have a certificate with a hostname that matches the certificate and the CRL URL must be reachable by the client. These are not always easy to accomplish when using a self signed certificate. In my case I had everything working except for the CRL URL. The client was unable to check the CRL so it rejected the connection. An interesting form of Denial of Service could be implemented by denying access to CRLs, but that is a bit of a digression. On the client computer, create a DWORD value NoCertRevocationCheck under HKLM\System\CurrentControlSet\Services\Sstpsvc\Parameters Set the value = 1. This will disable the certificate revocation check and enable the connection to proceed.

Smoothwall Enhanced Firewall Log Module

I really love my Smoothwall firewall. It offers good security using an older computer and it is infinitely customizable. One of the big strengths of Smoothwall is that with a little bit of Perl you can make it do almost whatever you want. There is a large ecosystem of third party modules that allow you to customize the functionality of your Smoothwall box.

One of the modules that I use is the enhanced firewall log. It is currently at version 1.4.3 and it enhances the normal log viewer and allows you to sort on different values and adds color coding to the entries.

This module has worked fine for me up until today. I was having some issues reaching some sites on the Internet and it appeared the firewall was the issue. I logged into the Smoothwall and it was slow to respond. The box had an uptime of a little over 9 months so I decided to reboot it. After the reboot was complete the firewall log was giving me an HTTP 500 error. Every other page was fine.

The error log showed:

Premature end of script headers: firewalllog.dat,
 at /httpd/cgi-bin/logs.cgi/firewalllog.dat line 409

After some Internet searching I found the following link in the Smoothwall communities.

Copy and paste of relevant information that fixed my problem.

he enhanced firewall logs mod with the CIDR capabilities assumes that all of the data the first field of the ipblock file will be numeric but it doesn't test it... my fix adds two lines and gets us around this problem... at least at the stage of reading the data from the ipblock file

 in /httpd/cgi-bin/logs.cgi/firewalllog.dat, near line 57, you should find

# Added by fwlogmod

use Socket;

use Net::CIDR;

# END added by fwlogmod

right after that, add

use Scalar::Util qw(looks_like_number);

so the block looks like this (until the maintainer possibly adds this to their released code)

# Added by fwlogmod

use Socket;

use Net::CIDR;

# END added by fwlogmod

use Scalar::Util qw(looks_like_number);

then down near line 217 you should find

open (ACTIVEBLOCKFILE, "/var/smoothwall/ipblock/config");

@ll=;
close(ACTIVEBLOCKFILE);
foreach $lll (@ll) {
            chomp($lll);
            @ittt=split(/,/,$lll);
            $cidrstr= $ittt[0];

between those last two lines, add

next if !looks_like_number($ittt[0]);  ## make sure it is a number!

so the whole block now looks like this

open (ACTIVEBLOCKFILE, "/var/smoothwall/ipblock/config");

@ll=;
close(ACTIVEBLOCKFILE);
foreach $lll (@ll) {
            chomp($lll);
            @ittt=split(/,/,$lll);
            next if !looks_like_number($ittt[0]);  ## make sure it is a number!
            $cidrstr= $ittt[0];

save and done... now if the first field of the ipblock file is not numeric, your firewall log viewer won't blow up on you.

Windows Update Error 800B0109

This Windows update error 800B0109 means that the WSUS signing certificate is not trusted. Windows 7 64 bit will not install the update if the certificate is not trusted. If this happens to a regular home user who gets updates via Microsoft you should check really hard to make sure you do not have some malware that has hijacked you WSUS process.

However is my case I used System Center Updates Publisher to push out Adobe updates and I created my own self signed certificate which is not trusted by the clients. I either need to add that certificate to the trusted store on each computer or create a new cert using my CA that is already trusted by the clients.

Because the root goal of this exercise was to eliminate visiting each client for Adobe updates, I will try the CA route and see how it goes.

Yet Another Exchange Activesync Issue

A user received a new Android tablet and they wanted to sync their email with the Exchange 2010 server. After configuring everything phone side the phone never displayed the security setting warning and displayed a loading sign that never ended.

On the server side, the exchange server was spewing event id 1008 into the event log.

Other users had no problem, but this was the first time this user had attempted to sync with exchange.

To make a long story short and after some googling I found,  Cannot sync iPhone with Exchange ActiveSync.
This article talks about a permissions problem on the server. The solution was to verify that the user has the "Include inheritable permissions from this object's parent" checked on the Active Directory user's permissions.

1. Open "Active Directory Users and Computers" (dsa.msc).
2. Go to "View" and make sure "Advanced Features" is checked, if it isn't - check it.
3. Find the problematic user and open its "Properties" (right click --> Properties).
4. Go to the "Security" tab and click on the "Advanced" button.
5. Verify that the "Include inheritable permissions from this object's parent" checkbox is checked. If it is, you may try to reset the user's permissions by clicking on the "Restore defaults" button.

After fixing the permissions and then newly adding the email account on the tablet, everything worked but the initial sync did seem to take a little while. It is interesting that this is the same root cause of a similar problem I had before.The interesting thing is that I checked this on all of the users last time and I also checked all of the users again this time. Probably I missed this one user the last time around though....

Cannot install to GPT partition

I was attempting to install Windows 7 to a laptop using a flash drive.
The first problem I ran into was that the laptop would not detect my usb flash drive and I could not set the DVD as the boot drive. In the bios I found a setting called csm or something like that. I enabled that setting and on the next boot, the bios detected the usb drive and the DVD drive.

In the Windows 7 installer I attempted to choose the partition for the install but I was greeted with the error, "windows cannot be installed on this disk. The selected disk is of the GPT partition style."

Cutting to the chase, I had to delete all of the partitions before the installer would allow me to install Windows 7.

Removing Duplicates in MySQL

I inherited a database that had some performance problems.

To improve performance on one of the tables we added a few indexes based on common searches for that table. The problem was that there were a number of duplicates that prevented creation of the indexes.

To fix this problem I ran the following query all at once in phpmyadmin as temporary tables only last the duration of the connection.

CREATE TEMPORARY TABLE bad_temp AS SELECT DISTINCT * FROM bad_table;
 
DELETE FROM bad_table;

INSERT INTO bad_table(email,nid,timestamp) SELECT email,nid,timestamp FROM bad_temp;

DROP TABLE bad_temp;

This took care of the problem and I was able to add the index.

ALTER TABLE `good_table` 
ADD PRIMARY KEY (`email`, `nid`, `timestamp`)

A nod to Database Journal that gave me the idea.