VMware Certified Professional - Data Center Virtualization

Recently I began the VMware vSphere : Install, Configuration, Manage course which is one of prerequisite courses required in order to take the VCP5-DCV exam.

The VCP5-DCV certification covers installing, configuring and managing a vSphere 5 environment with vCenter. 

Anyone with any experience with VMware or virtualization in general knows that the VCP5 is a very sought after and respected certification.

I had the opportunity to take the course at an extremely discounted rate so I took advantage of it right away.  The course covers the majority of the exam content, but not all.  So significant self-study and lab work is required in order to pass the exam.

The study materials I am using to supplement the course are as follows:

• The Official VCP5 Certification Guide
• Mastering VMware vSphere 5.5
• VMware vSphere 5.1 Documentation

 In order to fully cover the topics on the exam and gain hands on experience a lab is required.

There are two main options for building home lab.  First, build a physical lab consisting of physical ESXi hosts, shared storage and then virtualize the rest of the infrastructure.  Second, build a nested lab consisting of a fully virtualized infrastructure.  I chose the latter.

Since I already had a physical host running ESXi 5.1, I chose to virtualize my vCenter, iSCSI SAN, and domain controller.

I utilized FreeNAS for the iSCSI SAN.  It is simple and straight forward to setup and does the job very well.

Due to the limitation of the CPU in my ESXi 5.1 server, I had to elect to run the ESXi 5.5 hosts in VMware Workstation on my desktop which is capable of nested virtualization.  With this setup I am able to run a full vCenter environment along with virtual machines.

Here are some sample screen shots and a simple network diagram:

 

Juniper Networks Certified Associate (JNCIA) - Junos

Today after a long period of study I passed the JN0-102 exam and earned the JNCIA - Junos certification.  This is my first Juniper certification and will surely not be my last.

The JNCIA - Junos the first in the Junos certification track from Juniper.  It is the precursor to the JNCIS, JNCIP and JNCIE certifications in the Enterprise, Security and Service Provider certification tracks.

During my preparation for the exam, Juniper updated the JN0-101 exam to the JN0-102, removing some topics and introducing others.  I chose to take the JN0-102, which I shouldn't have since I hadn't studied the new topics thoroughly enough. 

I made the decision to take the JN0-102 based on the fact that Juniper had said the study materials for the old and new exams were the same and the exams were very similar.  However, once reading the detailed exam topics the night before the exam I learned otherwise.

I managed to pass the exam, but I know I would have done better on the JN0-101 exam.

Some topics the exam covers are routing, Junos operation, and subnetting.

Some of the resources I used for preparation are as follows;

• JNCIA-Junos study guides available for free from Juniper's Learning Portal
• Junos OS For Dummies
• Junosphere along with Juniper's Day One guides

The exam was straight forward with no real trick questions.

The Junos platform is more powerful and flexible to Cisco IOS in my opinion.  Features such as automatic archiving of configurations to a remote server, scheduled committing of configuration and the ability to rollback configurations to prevent locking one's self out of a device are some key features that I like.  The configuration syntax and methodology takes sometime to get used to if you're coming from a Cisco background and the Juniper equivalent to a Cisco configuration is usually longer.  But once you get used to it, you'll appreciate the power of Junos. 

For those thinking of taking the exam, be sure to take and pass the Pre-Assesment test on Juniper's website.  Once doing so you'll be given a 50% discount voucher code for the exam.

Parsing a Configuration File Using Bash

Here's a simple way to use a configuration file with a Bash shell script.

#Specify configuration file at command prompt
CONF_FILE=$1

#Read variables from conf file
ADDRESS=$(grep ADDRESS $CONF_FILE | awk -F= '{ print $2 }')
USERNAME=$(grep USERNAME $CONF_FILE | awk -F= '{ print $2 }')
FILETODOWNLOAD=$(grep FILETODOWNLOAD $CONF_FILE | awk -F= '{ print $2 }')
DOWNLOADPATH=$(grep DOWNLOADPATH $CONF_FILE | awk -F= '{ print $2 }')
LOGPATH=$(grep LOGPATH $CONF_FILE | awk -F= '{ print $2 }')
LOGRETENTION=$(grep LOGRETENTION $CONF_FILE | awk -F= '{ print $2 }')

Configuration file:

ADDRESS=192.168.88.20
USERNAME=sheldon
FILETODOWNLOAD=Downloads/*download.txt
DOWNLOADPATH=.
LOGPATH=logs/
LOGRETENTION=-1

The script uses grep and awk to parse the configuration and assign the directives in it to the variables in the script.

MCITP: Enterprise Messaging Administrator on Exchange 2010

Today I passed the 70-663 Designing and Deploying Messaging Solutions with Microsoft Exchange Server 2010 and thus obtained the MCITP: Enterprise Messaging Administrator on Exchange 2010, my second MCITP certification.

This was not an easy exam.  The exam covers everything having to do with Exchange Server 2010 SP1 except Unified Messaging.  While the focus of the 70-662 exam is configuring Exchange,  the focus of 70-663 is Designing and Deploying Exchange.  Do not think that this exam is not technical as it has a good amount of technical content so do not forget what you learned from 70-662.

The majority of my preparation was done by reading the TechNet Library for Exchange 2010 and taking two Microsoft courses that came with my TechNet Professional subscription.  My recommendation is to utilize TechNet and the Exchange team blogs to cover the material as well setup a lab environment.

This certification took almost a year for me to complete due to many set backs, but I am glad it is over with.

Next in line is the CompTIA Linux+ and LPIC-1 combination and possibly a SQL Server 2008 certification or VMware VCA.

Create User Accounts From A csv File In Linux Using Python

Here's a script that I wrote that creates user accounts and home directories from a csv in Linux using Python.

This is a common system administration task that be done using shell scripts but is much easier using Python.

Python has a handy csv module that parses csv files so you do not have to worry about it yourself.

I plan to focus my studies on Linux after I complete the MCITP: Enterprise Messaging Administrator 2010 certification.  So there will be more scripts to come.

#!/usr/bin/python
#pyuseradd.py
#Read users from a csv file and create accounts and home directories.
#Sheldon Alman - sheldonalman@gmail.com
#csv file format : firstname, lastname, username, password
import sys, csv, subprocess

if len(sys.argv) != 2:
    print "Usage: " + str(sys.argv[0]) + " filename"
else:
    filename = str(sys.argv[1])
    with open(filename,  'rb') as csvfile:
        accounts = csv.reader(csvfile)
        for row in accounts:
            subprocess.call(['useradd', '-m' , '-s' + '/bin/bash','-c' + row[0] + row[1] ,  row[2]])
            subprocess.call('echo ' + row[2] +":" + row[3] + " | " + "chpasswd",  shell=True )

OpenVPN

Recently I decided to implement a client access VPN solution that I had been meaning to do for a long time.

I had looked at other solutions like the Windows 7 built in PPTP VPN and pfSense and finally settled on OpenVPN.

The main reason behind my selection of OpenVPN is it's multiple platform support.  The server is available for pretty much any modern OS that one would use, as is the client.  It is also integrated into many open source router and firewall distributions.

There are two versions of OpenVPN available.  The community edition and the commercial edition.  The community edition is available via most repositories for popular Linux distributions and is also available for Windows.  The commercial version is available via OpenVPN's website in many different flavours, including a virtual appliance.

The main differences between the community and commercial editions are that the community edition offers no support while the commercial does, and the commercial edition is easily configured via  a web GUI while the community is generally configured via configuration files.  Furthermore, the commercial edition requires a license per user to connect to the server, however it does come with two free licenses for testing purposes.

I elected to go with the commercial version due to it's ease of setup.  The setup simply involved downloading the Debian Linux based virtual appliance and importing it on to my ESXi 5.1 server.  After going through the simple setup, the server was up and running and I was connected.

OpenVPN utilizes SSL for it's encryption but is not a "true" SSL VPN.  It runs it's own propitiatory client and server.  The client can be downloaded from the server itself but logging in as a registered user and downloading the client for your chosen OS.

Many VPN modes are support including Layer 2 VPN, routed VPN and a NAT VPN where hosts on the private subnet are automatically NAT'd so that hosts on the OpenVPN subnet can access them.

My setup simply involved me port forwarding ports 443 and 1194 to the OpenVPN VM and connecting.  I elected to configure it so that only traffic that needs to access my private network is routed over the VPN and not all Internet traffic.

I plan on looking into the open source version to see what it has to offer, but the commercial version is a great way to get started if you have a small setup.

Update: 
In order to get the Layer 2 VPN to work when using ESXi you have to set the vswitch that the OpenVPN server is associated with to accept promiscious mode packets.  More details can be found here : http://www.jeremycole.com/blog/2010/03/11/openvpn-bridge-under-vmware-esxi/.  Be advised that the Layer 2 VPN is only supported on Windows clients as of now.

Exam 70-662 MCTS: Microsoft Exchange Server 2010, Configuring

70-662 is the first of two exams required to obtain the MCITP: Enterprise Messaging on Exchange 2010.

As the title states, the focus of the exam is configuring Exchange 2010.  The exam topics cover all aspects from installation to granular configuration scenarios.  One noted absence is Unified Messaging.

The exam itself was quite challenging and one needs to know all covered topic very well since they are all equally weighted for the most part.

Trainsignal videos and TechNet were my primary sources of study.  I also setup a lab environment with multiple Exchange servers to get hands on experience.

My recommendations for this exam is to read through TechNet documentation, spend significant time in the Exchange Management Console and Exchange Control Panel and finally know the PowerShell command-lets very well.

On to 70-663.

Update Exchange 2010 Transport Rule From Text File Using Powershell

Here's a short script that reads the contents of a text file and updates the signature of all outgoing email with the contents of the text file.  Useful for delegating the task of maintaining corporate signatures to non-admins.

if (test-path C:\sig.txt )
{
 $signature = Get-Content "C:\sig.txt"
 set-TransportRule -Identity 'External Email Disclaimer' -Name 'External Email Disclaimer' -Comments 'Appends disclaimer to all email that is sent externally.' -ApplyHtmlDisclaimerLocation 'Append' -ApplyHtmlDisclaimerText $signature -ApplyHtmlDisclaimerFallbackAction 'Wrap'
}
else
{
 write-eventlog -logname Application -source MSExchangeTransport -eventID 999 -entrytype Error -message "The signature script failed to run" -category 1 -rawdata 10,20
}

Get Mailbox Sizes & Item Count In Exchange 2010

Here are a few command-lets that output Mailbox sizes and Item counts in Exchange 2010:

Display sizes and item count for all mailboxes:
get-mailbox | Get-MailboxStatistics  | ft DisplayName, TotalItemSize, ItemCount

Display sizes and item count for a specific mailbox:

Get-MailboxStatistics [username] | ft DisplayName, TotalItemSize, ItemCount

More Powershell

Here are a few quick Powershell scripts I created to take care of some daily tasks that came up.

Output list of installed software into a text files, one text file per IP and one master file with all hosts:

$ip = get-content C:\10.10.1.0.txt

foreach ($i in $ip)
{
    wmic  /node: $i computersystem get name >> C:\installList.txt
    wmic  /node: $i os get name`,version >> C:\installList.txt
    wmic  /node: $i product get name`,version >> C:\installList.txt
    wmic  /node: $i computersystem get name >> C:\$i.txt
    wmic  /node: $i os get name`,version >> C:\$i.txt
    wmic  /node: $i product get name`,version >> C:\$i.txt
   
}

Convert a dynamic distribution group to a regular distribution group in Exchange 2010:

$employees = Get-DynamicDistributionGroup "(dynamic group)" #This is the dynamic group to be read from
$groupName = Get-distributiongroup "(regular group name)" -erroraction 'silentlycontinue' #This is the group to be modified. Continues if there are any errors encountered.

#if the group exists, remove it and re-create it.  If it doesn't exist, create it.
if ( $groupname )
{
    remove-distributiongroup "(regular group)" -Confirm:$false #disables confirmation of group removal.
    new-distributiongroup "(regular group)"
    set-distributiongroup "Employees" -customattribute11 "(whatever attribute you use to populate the group)"
}
else
{
    new-distributiongroup "(regular group)"
    set-distributiongroup "(regular group)" -customattribute11 "(whatever attribute you use to populate the group)"
}
Get-Recipient -RecipientPreviewFilter $employees.RecipientFilter | export-csv C:\filename.csv #prints pertinent information about members of the group and exports it to csv

import-csv C:\filename.csv | foreach { Add-DistributionGroupMember "(regular group)" -member $_.name }
Remove-item C:\filename.csv -Confirm:$false #remove csv file if necessary

Remember to Enable IPv6 With Exchange 2010

As the title says.  Remember to enable IPv6 when using Exchange 2010.

After powering on my Exchange 2010 servers after a power outage, I found that a few Exchange services wouldn't start on the Hub Transport/Client Access server.

After a few reboots and running some diagnostics.  I decided to build a backup server that I had.  I received the following error while installing Exchange 2010 SP2:

After doing some research I found that Exchange 2010 requires IPv6 to be enabled and that a IPv6 address (unique-local) must be assigned to interfaces on all servers.  After doing this, all of the services that failed to start on the original Hub Transport/Client Access server started without an issue.

Metasploiting Metasploitable

In my quest to become a IT Security professional I've been playing around with the purposely vulnerable Linux distribution Metasploitable 2.

Metasploitable 2 is produced by Rapid 7, the company behind Metasploit.  If you don't know already, Metasploit is a penetration testing framework that allows for development of exploits and execution of general penetration testing tasks.  Metasploitable 2 is designed with several vulnerabilities in order for one to learn how Metasploit and learn about penetration testing in general.

I decided to give exploiting the backdoor vulnerability in vsftpd 2.3.4 a try.

First I began with a nmap scan against the host to verify that it was running the vulnerable version of vsftpd.

I then setup Metasploit for exploitation of the vulnerability. 

The PAYLOAD command sets the payload to be sent to the target, in this case an interactive shell  that allows one to run commands on the target.  The RHOST command sets the IP address of the target host.

I then ran the exploit and got root on the box.

Metasploitable 2 and other distros like it make penetration testing accessible for those who don't get to do it for a living.   It also gives one the opportunity to learn how to use the various security tools without risk of getting into any trouble.

Anonymizing With Tor

While using the Internet, one may wish to anonymize their activities as much as possible.  Tor is a tool that allows for some anonymity.

In it's simplest form, tor is a tool that routes TCP traffic through a series of nodes while encrypting it so that the destination host cannot determine where the traffic originated.  The tor website has a much more technical description of it along with various tools and applications that allow you to use it.

Of course one can see how a tool like this can be useful for security enthusiasts for both good and bad.

tor creates a proxy server on the local host that allows all traffic pointed to the it to be routed through the tor network.  However, if an application cannot be configured to use a proxy, then a tool like tsocks can be used to direct the application's traffic through the tor proxy.

On a Debian based system tor and nmap can be installed by using the familar apt-get install tor tsocks

Once installed, all one has to do is edit the /etc/tsocks.conf file and change the server_port entry to specify tor's port 9050 as the server port and the server entry to 127.0.0.1.  tor itself should need no configuration at all.

To use applications through tor, either configuration the application to use a proxy at 127.0.0.1:9050 or if the application doesn't support proxy use, just run it by pre-pending tsocks to the command (i.e tsocks nmap scanme.nmap.org).  Keep in mind that tor only supports anonymizing of TCP traffic and not UDP and ICMP.

One popular usage of tor is to anonymize nmap scans.  You simply run nmap via tsocks as follows: tsocks nmap <host> -PN  .  The -PN argument is required so that nmap doesn't perform a ping scan which will reveal your IP address. 

I would provide examples, but I would have to change my network configuration in order to perform a pcap to show tor actually doing it's thing.

One caveat of tor is that it's quite slow do to the way it routes your traffic through three hops before it gets to the destination host.  A tool called tortunnel routes your traffic only through one exit node which will improve performance, but reduce anonyminity.

Learning Exchange 2010

Currently I am working with Exchange 2010 in my home lab.

I have set up a Exchange 2010 organization in the following manner using VMware ESXi 5.1:

The following are some notes on some issues I ran into with working through various lab exercises.

Configuring of routing between sites:
Set a persistant route on NYDC1 and NYDC2 to 10.1.1.0/24 via Teal so traffic could get back to CHIDC1.

Set a static route on wireless router to 10.1.1.0/24 via Teal (192.168.1.106) on the LAN interface so that NAT'd traffic to the internet would know where to be sent.

After removing persistant route from NYDC1 and NYDC2, replication to CHIDC1 stopped working. 

After running a packet capture on teal it was found that replication traffic was going out from CHIDC1 but not going back to it.  No traffic was going back to CHIDC1 at all from NYDC1 and NYDC2.  This caused issues with install Exchange 2010 SP2 on the mailbox server.

dcdiag reported replcation errors.  When replicated was forced via sites and services, a schema mismatch was found.  After waiting for 15 - 20 mins, the schema mismatch resolved itself and Exchange 2010 SP2 installation completed successfully.

What is strange is that there is a static route on my router that points to the network that CHIDC1 is in, so it should forward traffic to it, however it did not seem to work properly for NYDC1 and NYDC2.

Removing public folder database:
Tried the following and ran into permissions errors: http://technet.microsoft.com/en-us/library/bb201664.aspx

Ensured administrator to public folder management group and gave administrator AllExtendedRights on \non_ipm_subtree public folders.  Still wasn't able to remove system public folders.

Found that all mailbox databases were using public folders (get-mailboxdatabase | ft name, publicfolderdatabase).

Used ADSIedit to remove public folder configuration from mailbox databases and to delete the public folder database. (http://exchangeserverpro.com/remove-default-public-folder-database-exchange-mailbox-database)

Troubleshooting OWA not working:

Found that OWA wasn't accessible after upgrade to Exchange 2010 SP2.

Found that all Exchange services weren't started on mailbox and client access server.  Started/restarted all services.  Didn't fix issue.

Checked event logs and found that there was an error in the web.config file for the OWA IIS site.  Tried commenting out the line with the error and tried using the backup web.config file, neither fixed issue.

Checked in Exchange installation log and found that the Service Pack 2 installation hadn't completed successfully.  Re-installed service pack 2 on the client access/hub transport server and rebooted.  Fixed issue.

Later found that OWA access was timing out.  Believe that I restarted Microsoft Exchange RPC Client Access service to fix the issue.

Later found out that mail wasn't being sent within the organization.  Restarted Microsoft Exchange Information Store service to fix the issue.

I'm still working through the material so most likely there will be more to follow.

Idle Scanning With Nmap

As is it has become quite obvious, nmap is one for my favourite tools and I'm trying to learn as much about it is possible.

While reading through the nmap documentation I came across the technique known as idle scanning.

Idle scanning allows you to scan a target without sending any traffic to it.  This is done by using what's called a zombie host to bounce your traffic off of so that the traffic appears to come from the zombie host and not you.  The way it works is very clever and this page on the nmap site explains how it works in detail.

The main issue with a performing idle scans is to find a zombie host that is completely stagnant and increments it's IPID in the way that nmap requires for idle scans to work.  The following command utilizing one of nmap's scripting engine scripts will discover if a host supports the IPID feature in the way that nmap can use it for idle scanning;  nmap --script=ipidseq -v <host>.  If the Host script results returns all zeros, then the host cannot be used for idle scanning, if it returns incremental, it can be.

I set out to test idle scanning on my test network.  I tried using a Debian Linux VM as a zombie host but found that it's IPID sequence was all zeros.  I tried a Windows Server 2008 R2 VM with success.

Here are the results:

1) The IP address of the attacking machine:

 2) The IP address of the zombie host:

3) The IP address of the target host:

4) The scan being run and the results:

In order for the scan to work there needs to be a non-firewalled port on the zombie host that both the attacking and target host can connect.  The -Pn option is used to prevent a ping scan so that no ICMP traffic is sent to the target.  If ICMP traffic is sent it would reveal your IP address.

5) A Wireshark capture from the target host showing that the traffic is coming from the zombie host:

As you can see, idle scanning is a very useful technique.  It's main caveats are that it cannot really differentiate between closed a filtered ports, it can take significantly longer than a normal scan and it may be difficult to find a idle host to use as a zombie host.