Cisco 7800 Enable HookSwitch

         For some reason there is no information on how to turn on the HookSwitch on for a Cisco 7800 without Cisco unified communication manager.  After a long support call, and much digging, it turns out that you CAN enable the hookswitch without Cisco unified communication manager.  Go to the phones webpage (Firefox worked best), Login as Admin, click on advanced (top right), goto the Voice tab, Click on the User tab, Scroll to the Audio Volume section, Change the drop down for electronic HookSwitch Control to Yes.  That's it!

Finally! Open WIFI encryption is coming.

I have been waiting for a very long time for a wifi standard that allows encryption across an "open wifi" connection.  Normally when you connect to an Open SSID there is no authentication or encryption.  This means any data that is transmitted in the clear is readable by anyone in the area.  This is less of a problem in todays world of HTTPS but it is still enough of a concern that I hate using open wifi anywhere without a VPN.  I also shy away from setting up any clients with open wifi for their customers and instead suggest that they have a wifi code posted.  Well we are finally getting "open wifi" with encryption!  WPA3 includes a new feature called Opportunistic Wireless Encryption (OWE).  I won't bother trying to explain it, because I'm not qualified, but I have linked a video below.  In short it allows encryption without authentication.  So you can offer a wifi signal that anyone can join and still offer the security of encryption in the air.  Please note that because there is no authentication there is also no guarantee that what you are connecting to is actually the ssid you think it is.  Hopefully we can see some verification like SSL uses in the future.  Maybe letsencrypt can help us out there with free certs??

https://www.youtube.com/watch?v=E2r5QkgQpUM

PFsense on Xenserver 6.5

PFsense has a few issues with XenServer. First the nic offloading on FreeBSD is not compatible with the virtual nics on XenServer. This causes very slow throughput on the virtual nics. Second PFsense doesn't see the xn nics as supporting Vlans even though they do.  And last XenServer tools needs to be installed.

So first disable the offloading on the nics.  

1.

First find the UUID of the virtual interfaces for the VM running PFsense, type the following in the XenServer console: 

xe vm-vif-list uuid=VMUUID

Then using each of those UUIDs

2.

xe vif-param-set uuid=VIFUUID other-config:ethtool-tx="off"
xe vif-param-set uuid=VIFUUID other-config:ethtool-rx="off"

http://think-brick.blogspot.com/2016/02/pfsense-on-xenserver-enable-vlan.html

Next you must trick PFSense into allowing vlans on the xen nic.

This needs to be done in the PFSense webpage

1.

Go to Diagnostic -> Edit File

2.

Load file /etc/inc/interfaces.inc

3.

Add the "//hack for XenServer" to the file after the "//hack for some lagg modes", and before the "return false;":

// hack for some lagg modes missing vlanmtu, but work fine w/VLANs
if (substr($iface, 0, 4) == "lagg")
return true;

 // hack for XenServer xn interfaces
if (substr($iface, 0, 2) == "xn")
return true;

return false;
} 

Last install XenServer tools

1. 

pkg install xe-guest-utilities

2.

echo "xenguest_enable=\"YES\"" >> /etc/rc.conf.local

ln -s /usr/local/etc/rc.d/xenguest /usr/local/etc/rc.d/xenguest.sh

3.

service xenguest start

That's it!  Your done...  BUT WARNING!!! If you upgrade to a newer version that overwrites interfaces.inc PFsense may not boot.  At this point I plan on Backing up my config and taking a snapshot each time I test an upgrade.  If the upgrade breaks things then i'll install from scratch and run the above fixes then restore my config.  Not fun, no... But until they start better supporting XenServer we don't have much of an option.

References:

Disable nic offloading

https://forum.pfsense.org/index.php?topic=85797.0

Enable vlans

http://think-brick.blogspot.com/2016/02/pfsense-on-xenserver-enable-vlan.html

Install XenServer tools

https://blog.feld.me/posts/2014/07/pfsense-on-citrix-xenserver/

Install issues with XenServer 6.5 on a HP DL380 G5 or Cisco MCS7800

After having to install XenServer 6.5 on a Cisco MCS7800, which is just a re-branded HP DL380 G5, I wanted to list post install steps that must be taken.

1.  For some reason a local storage area is never created during install.  So step one is to create it.

xe sr-create content-type=user type=ext device-config:device=/dev/cciss/c0d0p3 shared=false name-label="Local storage"

2.  Make it default by right clicking on Local storage and choosing default using XenServer manager GUI.

3.  And finally, because the local storage was never created an import template was never generated

cd /opt/xensource/packages/files/transfer-vm./install-transfer-vm.sh

That should fix the issues of not having local storage, not having default storage, and not having an import template.  If I come across other tweaks that are needed with this system i'll add them to the list.

http://discussions.citrix.com/topic/362083-populating-local-storage-on-xenserver-65/page-3

Soti MobiControl Dynamic Template

Well, I just created my first ever Github project.  It's a template for use with Soti's MobiControl.  If you have ever used MobiControl then you know that the Lock Screen design/templates are VERY limited.  You basically have to hand write HTML and use their tags (ex. ) in the HTML to insert each and every entry in the Lockdown policy.  This is very cumbersome for anyone, let alone those who are not really good with HTML.  

Once you have finally created a good working template you better hope that you never need to add or delete an item from the lockdown policy.  If you do your going to have to go into the the HTML and manually add/remove the references to the correct lockdown tag. You better hope that it doesn't screw up your layout.  Or worse you decide to use a different device with a different screen size!  You may as well start over....

With that in mind I created a template that uses CSS and JavaScript to automatically adjust for the screen size, number of lockdown entries, and the header and footer text/image.  It also automatically uses the exe icon if you don't manually set an image for your entry (yeah you had to specify that in the HTML manually).  This new template will make it really easy to add and delete entries in the lockdown policy without ever having to touch the HTML.  Oh and did I mention it handles device rotation!?  Yep... That too.

If your using MobiControl and want to check it out, or are just interested in device orientation through CSS, or any of the other tweaks I used.  Check it out at https://github.com/mobilebob/Soti_Dynamic_Template

Description:
A Soti MobiControl template, that's dynamic. A mobile phone style template that changes automatically depending on how many entries you have in your lock screen. It keeps you from having to change the HTML every time you want to change the lock screen entries. It's also dynamic for screen size and changes based on device orientation. Uses CSS and Javascript

Ghetto-fi your VMware backups (VMware backups for free)

If you are using VMware on the cheap (free), then you are probably missing some great functionality.  For one, backups!  Sure you can backup your data inside the VM (and you should!), but how about bare metal full VM backups?  If you like the idea but hate the cost check out ghettoVCB.  It's a great script that has some limited community support.  Basically it runs several shell commands to snapshot your VM which unlocks your main VMDK file.  Then makes an FTP connection out, and copies the entire VM (minus the snapshot of course) to a destination of your choosing.  Then if you have any need for the backup you can simply import the VM and your back up and running.  Lots of great uses for this and it's FREE!

https://communities.vmware.com/docs/DOC-8760

https://github.com/lamw/ghettoVCB

Offline Files not coming back online when reconnecting to the network

So here's the problem we had. User has offline files on his H: drive (Home drive), so that he can access them while traveling.  If the user boots up his laptop and logs in, and THEN connects via VPN or work wireless, he can't access his H: drive at all.  He can still see his offline files, but they stay offline and all other files are not accessible.  Also if he disconnects his laptop goes to a meeting then comes back and docks he is unable to get access to his H: drive until he reboots.  The only way to get the files back online and have access to the rest of his H: drive is to log-in WHILE having a live network connection to the office.  After a bit of research I found the answer via mcseRob (See link below).

The short version is that the user needs read access to the folder that the share is pointed to, not just a sub-folder that his H: drive is pointing to.  Windows checks to see if the files are back online by checking the share itself!  So when it checks and doesn't have read access to the share it thinks the files are still offline.  So a quick fix is to give all users read access to the share itself.

For our situation we ONLY give read access to the share and not all the sub folders below.  This does allow everyone to see the sub-folder names, which may reveal user names.   But follow the link below for some possible fixes to that problem.

Source: http://social.technet.microsoft.com/Forums/windows/en-US/dccf79c0-af86-43e9-99c6-20a21c22c38c/offline-files-the-work-offlinework-online-button-disappears-from-windows-explorer-after-the?forum=w7itpronetworking

Enable Windows 7 admin shares for local accounts (c$, etc)

If you are frustrated by the lack of access to admin shares in Vista or Windows 7 here is a reg hack to re-enable those shares. This will allow local accounts (On the host machine) to access admin shares. By changing this registry setting you are DISABLING UAC remote restrictions!

Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows\CurrentVersion\Policies\System Name: LocalAccountTokenFilterPolicy Data Type: REG_DWORD
Value: 1

Please be aware that this is a security hole if your systems are not patched (Not to mention zero day attacks). Use with discretion and without blame (Me that is).

From Microsoft:

How UAC remote restrictions work 

To better protect those users who are members of the local Administrators group, we implement UAC restrictions on the network. This mechanism helps prevent against "loopback" attacks. This mechanism also helps prevent local malicious software from running remotely with administrative rights.

Source: http://support.microsoft.com/kb/951016/
Other Source: http://en.wikipedia.org/wiki/Administrative_share

Check to see if a VBS script has Admin rights

Came across a problem today where we were running a VBS script that was obviously designed expecting UAC to be turned off.  In looking for a way to elevate the script to Admin before running, I found some code to force the script to run as administrator without having to reghack each PC.  It took a combination of sites to get the code, but here it is.

On Error Resume Next
key = CreateObject("WScript.Shell").RegRead("HKEY_USERS\s-1-5-19\")
If err.number <> 0 Then
 Set objShell = CreateObject("Shell.Application")
 objShell.ShellExecute "wscript.exe", Chr(34) & _
 WScript.ScriptFullName & Chr(34), "", "runas", 1
 WScript.Quit()
End If


If you insert that code at the beginning of your script it will first check to see if the script has Administrative rights (Either through UAC, or XP admin) and if it doesn't it will relaunch the script using runas administrator.

Warning: I haven't tested this in Windows XP.  I know that the Check part will work, but don't know about the relaunch.


Reghack to get Run As Administrator in the context menu for .VBS files:
http://www.sevenforums.com/tutorials/152967-run-administrator-add-vbs-file-context-menu.html

UAC elevation code:
http://www.winhelponline.com/articles/185/1/VBScripts-and-UAC-elevation.html

Check for Admin rights code:
http://csi-windows.com/toolkit/csi-isadmin

Edited: 9-4-15 Thanks Hh Lohmann

Driver Backup

If you have ever had to reload a Windows system and dreaded looking for CD's or figuring out what drivers to use, then this is the program for you!

DriverBackup! backs up all of your drivers and gives you a nice .bat file to run to install everything when you reinstall is complete. Haven't tried it yet but next chance I get I will definitely be using this. Oh and it's FREE.

http://sourceforge.net/projects/drvback/

Came across another tool that looks promising.

http://www.slimdrivers.com/

VNC Server for CE 5.0 and up

If you have ever needed a VNC server on a CE 5 or greater device then efonvnc is for you. It's a basic VNC server with a few basic functions. It has worked well for me and it's free!

http://sourceforge.net/projects/efonvnc/

Fix WinXP Explorer settings not being saved

Today I came across a problem where the users explorer settings were not being saved on reboot. Settings like Screen resolution, monitor setup, and icon placement. I first made sure he wasn't using a temporary profile. Then I deleted the following registry keys:

HKCU_ software\microsoft\windows\shellnoroam\bagmru

And

HKCU _software\microsoft\windows\shellnoroam\bags

That will force windows to recreate them and should fix any corruption that would have been causing this problem. It would be smart to make sure that the local user has read/write access to those registry keys, but you will find that out when you try to delete the keys :)

Source:
http://www.techsupportforum.com/microsoft-support/windows-xp-support/10283-windows-explorer-settings-not-being-saved.html

Use any webpage as your screen saver FREE

Looking for free screen savers is a virtual !MINE*FIELD@
Screen Saver sites in general tend to be full of "free" (Shareware != free) and spyware laden screen savers for download. So when I started looking for a free screen saver that would display a webpage, I cringed a little. I did some Google searching and found someone posted the following site on Digg (Yes it is useful once in awhile). This screen saver is FREE and as far as I can tell doesn't include any spyware. I haven't fully tested it, but it seems like a nice simple screen saver that allows you to display any website or anything that can be displayed in IE. Check it out and let me know what you think.

HTML Screensaver:
http://myweb.tiscali.co.uk/djmclean/htmlscreensaver.html

Side note: I wanted to display a nice full screen weather map while in screen saver mode. http://www.wunderground.com/auto/wxmap/

Boot to any device even if the BIOS doesn't like it

PLoP is a boot manager that can be installed or booted to via just about any boot device, and allows you in turn to boot from any other boot device.

What does that do for you?
Well you can use a boot floppy with PLoP to boot to a USB on an old computer that normal can't boot to USB. You can also boot PLoP off a CD or install it as a boot menu for windows or linux.

It might come in useful if you are wanting to try out the new chrome OS on USB, or maybe just trying to boot from CD on an old computer that can only boot from floppy.


http://www.plop.at/en/bootmanager.html

Thanks Steve for finding this and sending it on!

Lots of Logs

Linux/Debian:

This entry is one of those notes I talked about in my intro.

I was trying to forward my logs from a firewall that I setup using IPTables to a splunk server, and I ended up learning a good bit about the logging system. I'm sure I have not done things in the most efficient manner but for my purposes it worked well.

First I started logging some things using IPTables. I logged at the info level. As soon as I restarted the firewall the log messages started flooding my console. I logged in with putty and continued from there.

First to forward the logs I edited /etc/syslog.conf
I added:
kern.* @192.168.1.5 (Replace IPAddress with that of the server you are forwarding to)

This will forward all alerts coming from the kernal. You could be much more specific or do a *.* to forward EVERYTHING. See man syslog.conf for more information.

Next I restarted sysklogd:
/etc/init.d/sysklogd restart

That did it. The logs were forwarding just fine to the splunk server.

At this point I was getting all of my logs from the firewall showing up on my console, which made the console basically useless. First I checked my syslog.conf to see if there was an entry that was sending those logs to the console, but there weren't any. So I did some digging and found a few sites that talked about printk. It seems that printk controls what gets sent to your console along with any entries in syslog.conf that may point to your console.

So to fix it I typed:
echo "4 1 1 7" > /proc/sys/kernel/printk

That fixed the info level logs showing up on my console and to fix it for future reboots I edited /etc/sysctl.conf and added:
kernel.printk = 4 4 1 7

I then restarted sysklogd again:
/etc/init.d/sysklogd restart

A strange thing happened though. The alerts weren't showing up on the console or in the log files. I messed around for quite a while and finally fixed the problem by restarting klogd:
/etc/init.d/klogd restart

Update: It looks like depending on the version of klogd, and some other things I'm not yet aware of, when you restart klogd it might reset printk = 7 1 1 7 (Happened on one server but not the other). To fix this run "/etc/init.d/klogd stop" then run "/sbin/klogd -c 4" then run "/etc/init.d/klogd start"

That fixed things. Everything seems to work well now. Check out these web sites for further information and reference.

Information about changing printk
http://old.nabble.com/Suppressing-kernel-%27printk%27s.-td15280888.html

More information about printk
http://www.de-brauwer.be/wiki/wikka.php?wakka=printk

Great information about IPTables
http://www.faqs.org/docs/iptables

Edit PDF files using Open Source tools.

I recently found out that OpenOffice 3.0 has a PDF Import Extension that will allow a user to import a PDF and possibly edit it. It depends on how the original document was created but it may be of use if you need to edit a PDF document.

After downloading the Extension open OpenOffice, go to Tools, and select Extension Manager. Add the extension you downloaded earlier. Once you have installed the extension, you can open the pdf file using file open. Make sure you change the file type to PDF first. You can open the document in either Draw (The default) or Impress. Once you are done editing the document can be exported back out as a PDF.

PDF Import Extension:
http://extensions.openoffice.org/en/project/pdf-import-apache-openoffice (updated)

OpenOffice:
http://www.openoffice.org/

OpenOffice Portable (So you don't have to install anything)
http://download.cnet.com/OpenOffice-org-Portable/3000-2064_4-10526815.html

PC Repair Flow Charts

There are logical steps to fixing PC problems, but sometimes you just draw a blank.
These flow charts might be what you need to give yourself a kick start.

http://www.fonerbooks.com/pcrepair.htm

I came across this site at one of my favorite blogs Lifehacker.

http://lifehacker.com/5350446/computer-repair-flowchart-troubleshoots-common-hardware-problems

Copy it... Period!

If you have ever dealt with a corrupted hard drive you have come across this problem. You are trying to move files from the old/corrupted hard drive and as you are copying you hit a bad file. The copy job stops leaving you at a loss for what has copied and what hasn't. I have spend many an hour digging through file lists making sure I copied everything I was able to. Well I had that very same problem today and I decided that someone out there must have solved this problem. Sure enough.

Y-Copy is a great free program that will continue to copy files even if one has failed. It keeps a log of files that have failed so you can let the user know what just didn't make it off the drive.

http://www.ruahine.com/download.html

Note: I first found another application that was supposed to do the same thing. It was actually part of the PC Repair System USB Key (That I wrote about before). Encopy is a good app, but I didn't like the interface or the usability as much as I did Y-Copy. There are many more features in Encopy so if you find Y-Copy lacking in options check it out.

http://www.micware.110mb.com/micp.htm

Fix corrupted software installs

If you have ever gotten caught with an installation that has crashed or have had problems uninstalling an application, this tool might be of some help. Many programs use "Windows Installer" to install themselves, and sometimes during installation or later when you are trying to uninstall you find that the installation information in Windows has been corrupted. This will sometimes keep the program from being reinstalled or uninstalled. The Windows Installer CleanUp Utility will clean out corrupted Installer data allowing you to reinstall the product (It does not remove the program).

http://support.microsoft.com/kb/290301

[Thanks Tim for pointing me to this]

If it's uninstall your having problems with check out the Uninstall Everything article for a great uninstall utility that will remove even corrupt installations.

A couple of FREE data restore utilities

I came across a couple of new data restore utilities that look very promising.

The first is called PhotoRec. I have seen lots of photo recovery programs but this one is open source and looks to be a very full featured program. I haven't tested it yet but I will definitely come back to this one the next time i'm in need.

http://www.cgsecurity.org/wiki/PhotoRec

The second is called TestDisk. The feature list is quite impressive, and again it's open source. This one is a hard drive recovery program. It focuses on recovering partitions, and boot sectors. Again I haven't tested it but I like the look of the feature list and will try it soon.

http://www.cgsecurity.org/wiki/TestDisk