Exchange 2000/3 Security vulnerability

Snippet from MS-05-021 -

A remote code execution vulnerability exists in Microsoft Exchange Server that that could allow an attacker to connect to the SMTP port on an Exchange server and issue a specially-crafted command that could result in a denial of service or allow an attacker to run malicious programs of their choice in the security context of the SMTP service.

Further info and links for download can be found here

How to prevent chkdsk from running on a cluster resource

I had a customer calling me tonight with a problem on their Windows 2000 Cluster (They had to bring it down due to maintenance of their SAN and when it was brought online one of the groups failed to come online).
The disk resource was in a state of 'Online pending' and it was impossible to stop it (As you might now a resource in a pending state can't be configured or brought in a offline, online or failed state - either through the GUI or through the Cluster command).
It wasn't immediately appearent what the problem was either from looking in Eventviewer or in the cluster log (Found in %SystemRoot%\Cluster\Cluster.log). But we remembered that last time the Cluster was brought down (Due to a power failure) the Cluster wanted to run a Chkdsk on the largest volume (1.2 TB RAID 5 - I don't even want to guess how long that takes - maybe some of you have experience in that ?).
Furthermore, we could see that it created a log file called ChkDsk_Disk1_SigXXXXXXX.log. We then found that each time that the disk resource was being started it brought up an empty Command Prompt (Named Chkdsk) on the Console (Not at the RDP connection ;-) - but it didn't seem to start running and the logfile stopped growing after a few minutes. Additionally, the Disk's drive letter and description dis- and reappeared from the Parameters tab on the disk resource.
We tried to stop the Cluster Service (Net Stop ClusSvc) which timed out so I ended up killing the process with Kill.exe (TaskKill in Windows Server 2003). When we restarted the Service the Disk Resource once again ended in a state of online pending.

Due to the critical nature of this Cluster, we had to find a way to bring this resource online without needing to run ChkDsk. There are basically two settings/registry keys that defines how Chkdsk is run on a Cluster one is SkipChkdsk (Value of 1 means Skip - 0 is default) and the other one is ConditionalMount (If SkipChkdsk equals 0 - then a value of 0 will fail the disk resource and the default value of 1 will run 'Chkdsk /f' against the resource before bringing it online). As the Disk resource in question was in a pending state I was unable to configure it through the Cluster.exe command 'Cluster Clustername res "Disk X:" /priv ConditionalMount=1' so I had to once again "kill" ClusSvc and then change the registry key containing this setting. All registry keys for a Microsoft Clusters resources are contained within the HKLM\Cluster\Resources\'GUIDs' keys - and I found the correct key by searching for the correct description of the disk resource and verifying that it had the correct disk signature (Found by using Diskpart - Detail Disk) and changing the ..\Parameters\ConditionalMount REG_DWORD value to 0. After this I restarted the Cluster Service and the disk resource failed immediately. After this I used the "correct" way to set the SkipChkdsk value namely through the Cluster command and brought the Disk resource and the group online (Remember you cant configure these properties when the resource is 'pending' or the cluster service is stopped).

Problem solved (Well not really - more like symptom solved - I guess we need to revamp the Cluster when we upgrade it to 2003 SP1 anyway).

More resources can be found here and KB article 223023 describes the ConditialMount and SkipChkdsk in further detail.

Two-Factor Authentication: Too Little, Too Late

Two interesting essays/posts on two-factor authentication and their limited usage (At least according to well-known security expert Bruce Schneier). The first article/essay discusses his view on the limitations of two-factor authentication (Doesn't prevent Phishing and Trojan attacks) and the second post gives further explanation of his original essay (And includes some interesting comments too)

Internet Zone is stored along a downloaded file

This is cool and fun stuff! At least for me :)
Stumbling on the article called Description of how the Attachment Manager works in Windows XP Service Pack 2 when looking for other stuff, it caught my attention when I read this: When you save files to your hard disk from a program that uses the Attachment Manager, the Web content zone information for the file is also saved with the file. For example, if you save a compressed file (.zip) that is attached to an e-mail message to your hard disk, the Web content zone information is also saved when you save the compressed file. Later this The Web content zone information is saved together with the files only if the hard disk uses the NTFS file system, made me realize, that the information must be saved in an NTFS stream. I set on to reveal the information saved, so I started by using Streams from Sysinternals to list the steams -
C:\> streams TweakMCE.msi

NTFS Streams Enumerator v1.1
Copyright (C) 1999 Mark Russinovich
Systems Internals - http://www.sysinternals.com

TweakMCE.msi:
:Zone.Identifier:$DATA 26

Seeing the contents of a steam is not straightforward, but more can do it. Note the file name syntax -
C:\> more < zoneid="3">
Finally, the zone number can be translated to a name with reg -
C:\> reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ ..
CurrentVersion\Internet Settings\Zones\3" ..
/v DisplayName

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\Zones\3
DisplayName REG_SZ Internet

Windows 2000 -> 2003 upgrade kills DNS replication of secondary DNS zones!?

I just want to tell you about an odd little problem that I found during a Windows 2000 to Windows 2003 domain upgrade project with one of my customers (Actually my all-time favourite customer ;-) The project included consolidation of their Domain Controllers/DNS Servers in to fewer servers and upgrading a Top Level Domain and later their primary domain. During our planning/testing phase, we decided to in-place upgrade the excess servers to Windows Server 2003 before demoting them and reinstalling the servers on new iron ('Cause in our experience 2003 handles the process of demoting a DC much better than Windows 2000).When we upgraded the Domain Controllers in our lab environment, we found that the secondary DNS zones on these servers didn’t receive any updates from their primaries. Oddly there weren’t any errors during normal operation or when using “Transfer from Master”; but zone transfers first started working when we deleted/recreated the secondary zones. At first we thought this was a “lab error” – but during the real world implementation we checked this again and found the same problem (Although this time we found that “Reload from Master” and a little patience also solved the problem).

Using a custom view from an SMS report

This is possible to create you own custom view in SQL and use it in an SMS report. Just did it. Could not find any info on it, so the method might be unsupported. This is how you do it -

• Create the view in the SQL Database (SMS_sitecode)
• Use a name that does not conflict with existing or future names and that follows the SMS conventions. E.g. v_MyCompany_name
• From the view permission, enable select access to the webreport_approle

In the SMS report SQL you can now reference the view. Note that it does not appear in the list. I do not know how that can be done. Also beware of any security side-effects. Depending on what you do in the view, you may be able to bypass the SMS security so the report user could get access to data he/she should not see.
This is completely unsupported, so the risk is on you!

SMS Scripting Guide

Was released the other day. Get it from MS Downloads. Contains some very good examples. One I found particular useful was the Status Filter Rule example. Add it to your scripting arsenal.

IIS Diagnostics Toolkit

New on MS Download -
The IIS Diagnostics Toolkit is a combined release of popular tools used by today's IIS users. These tools include tools aimed at resolving problems related to Secure Socket Layer (SSL) issues, permission or security problems, gathering data for your SMTP server included with IIS, as well as the famous Log Parser utility used to sift through hundreds or thousands of log files very quickly. The toolkit consolidates all the tools into a convienant download and is supplemented by updates every 90-days to ensure that users have the most current diagnostics tools at their fingertips.

Windows 2003 SP1 released / known SCW/Exchange issue

As you might have seen the final version of SP1 for Windows Server 2003 has been released and can be downloaded from here. Others have reviewed the enhancements and new functionality in SP1 so I won't dig into that - but I wanted to inform you about a known issue with the Security Configuration Wizard and Exchange.
There is an issue with the Security Configuration Wizard when Exchange isn't installed in the default %ProgramFiles%\Exchsrvr directory which potentially could block the TCP Ports used by Exchange. The solution to the problem is simple - you should manually specify the path to the Exchange executables when SCW displays [Not found!] next to one or more of the processes in the Network Security Section.
According to my contact at Microsoft there will be posted detailed info about this issue on http://blogs.technet.com/exchange/ in the near-term future (Update - here's a link to the blog posting on You Had Me At EHLO)

Exchange server is not supported on virtual servers

To my surprise, Microsoft does not support Exchange in a virtualized environment - not even in their own Virtual Server/PC. Read the support statement in this KB. Consequently, you should stick to using virtual technology in testing scenarios.

Windows Update Services RC available

According to a mail I received from Mickeysoft today the Release Candidate for Windows Update Services is finally publicly available. New features since Beta 2 are -

• Replica mode for WSUS server hierarchies, making them easier to manage.
• SSL connections between WSUS servers and clients, providing an even more secure end-to-end environment.
• Automatic Update policy to allow non-administrators to receive update notifications, offering greater flexibility in organizations where logged on users are commonly not administrators.

I haven't had the time to test it so no comments from me (Except that I and many of my customers are eager to get the FINAL product) - but check it out for yourself by registering for download here.

Bart's bootable Windows XP CD/DVD

A little but very useful "lifesaver" that provides a WinPE like environment but with a larger and more extendable featureset via the plugins available from Bart's homepage and others like the Ultimate Boot CD for Windows that builds on BartPE. It's very useful for many purposes as for example recovering systems from Virus attacks or creating snapshots of existing systems - check out the feauture set for yourself on his homepage.

Lighter Side Dept. - Best IT Advertisement?

Check out this LiveVault "Institute for Backup Trauma" ad starring John Cleese. Never mind the product – which may or may not be good - but if you are a Phyton/Cleese fan this is a “must”.

Extracting files from MSI

I wanted to be able to extract files directly out of an MSI file. Sometimes, I simply do not want to power up the correct OS version or install a product just to get to the files within. I tried doing it with ORCA (from the platform SDK) – but couldn’t figure it out. I also tried some of the other platform SDK msi*.exe tools – again without luck. Maybe someone can tell me how? Next I tried to investigate whether the MSI could be accessed by SQL. Again, I failed to find the necessary information. Finally, I got it. I looked at the Project Windows Installer XML (WiX) toolset. I downloaded the wix i386 binaries and extracted the ZIP file. Then I ran –
Dark.exe file.MSI file.XML /x .
The result of this conversion (file.XML) and extraction (/x) is a file.XML (which I have no use for) and the binary files contained within the MSI file.
Thanks to the people working with WiX.

Default owner of objects varies between Windows XP and Windows Server 2003

As a follow-up to my earlier post on Protecting your administrative permissions, I noticed an update from Aaron explaining how the default owner varies depending on whether you are using Windows XP or Windows Server 2003. Read the rest here.

Warning about importing Exchange MPs in MOM 2005

I came across a Microsoft KB about a bug in the import management pack process. It seems like only packs sharing common rule groups have the problem. The Exchange MPs are such a case.

Network Traffic Analyzers

I always install Netmon on my servers - just in case I need it - which I often do. Not from an operation perspective, but for debugging and analyzing stuff. The other day, I was debugging some Kerberos problems in combination with SAP and Active Directory - but Netmon was not able to decode the packages...
Luckily, I know another product which I often uses at my own PC – Ethereal. Download it and the required library winpcap from here. You only need winpcap if you want to capture packages – to analyze, only Ethereal is needed.
Netmon pros –
- Microsoft supported and security patched
- Part of OS
Ethereal pros –
- Live view of captured packages including live filtering
- Can read files saved by Netmon
- Can decode more protocols – like Kerberos
- Free

Give it a go – it is worthwhile.

SIDF - Adding Sender ID Framework DNS Records

To enable mail receivers to validate that your emails are legitimate, you have to add SIDF. SIDF are a merger between Microsoft’s caller ID and SPF (Sender Policy Framework). SIDF is implemented on the sender and the receiver side. On the sender side you have to add and maintain some DNS TXT records. On the receiver side you simply need an email server checking the stuff. The receiver does not use SIDF to do a pass/no-pass decision. Instead, the result is put into the normal spam detection algorithms. If you do not publish SIDF information, you should expect your mails to be ‘suspected’ more and more as SIDF becomes more widespread and as email administrators starts to squeeze the spam rules forcing SIDF to be required.

A good place to start is the www.microsoft.com/senderid site. I think this is a very good presentation, so start with it. Afterwards, you can use the Microsoft Sender ID Framework SPF Record Wizard to generate your SPF record.

If you add the stuff in Microsoft DNS, remember to select ‘Other new’ record type, Text (TXT) and leave the name field blank. This will result in a line in the GUI like –
(same as parent folder) Text (TXT) SPF data

You can check the SPF of my company with –
nslookup "-set type=txt" inceptio.dk

Go and declare your email domains!

Software Updates for Dell Server Hardware Using SMS 2003

On MS Downloads.
This solution accelerator helps SMS administrators effectively and efficiently deploy software updates for Dell server hardware using Systems Management Server (SMS) 2003 and the SMS 2003 Inventory Tool for Dell Updates.

ISA 2004 Standard Edition SP1 Available on MS Downloads

Get it here. Is it a MSP file. The update contains both updates to the server component and the firewall client. Check out the changes in the readme.