#windows 2008

How to Deploy Windows Server 2008 VM on Nutanix AHV

Deploying a Windows Server 2008 VM on Nutanix AHV is a straightforward process, but it requires certain steps to ensure that everything functions smoothly. This guide will walk you through the necessary steps for a successful deployment.

Key Steps:

Creating the VM in Nutanix AHV

Configuring VM resources (CPU, RAM, etc.)

Installing Windows Server 2008 OS

Ensuring compatibility with AHV drivers

Find detailed steps here: hyperhci.com

Parches y soluciones de Windows para vulnerabilidad SMB tipo Ransomware

Los informes indican que el hacker o grupo de hackers detrás de la campaña de WannaCry está obteniendo acceso a los servidores corporativos mediante la explotación de una vulnerabilidad crítica de Windows SMB.

Microsoft publicó una actualización de seguridad para la vulnerabilidad MS17-010 el 14 de marzo de 2017. Además, Microsoft lanzó parches para los sistemas operativos Windows XP, Windows 8 y…

How to find Windows uptime?

Option 1: 1. Go to “Start” -> “Run”. 2. Write “CMD” and press on “Enter” key. 3. Write the command “net statistics server” and press on “Enter” key. 4. The line that start with “Statistics since …” provides the time that the server was up from. The command “net stats srv” can be use instead. Option 2: Uptime.exe Tool Allows You to Estimate Server Availability with Windows NT 4.0 SP4 or Higher…

New Post has been published on http://www.securityinet.com/connect-locally-local-domain-local-network-microsoft-hyper-v-server/

Connect locally (local domain or local network) to Microsoft Hyper-V server

Connect locally (local domain or local network) to Microsoft Hyper-V server

  Hello friends ,

I had some very interesting problem when i try to connect to my hyper V server with in a local network.

When i try to connect from workgroup i get this massage :

You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

  The only thing that saved me is this post ,

Remember :) connecting via local domain (workgroup) is very problematic if you don’t follow those steps :

  Part 1 :

http://blogs.technet.com/b/jhoward/archive/2008/03/28/part-1-hyper-v-remote-management-you-do-not-have-the-requested-permission-to-complete-this-task-contact-the-administrator-of-the-authorization-policy-for-the-computer-computername.aspx

Part 2:

http://blogs.technet.com/b/jhoward/archive/2008/03/28/part-2-hyper-v-remote-management-you-do-not-have-the-requested-permission-to-complete-this-task-contact-the-administrator-of-the-authorization-policy-for-the-computer-computername.aspx

  IMPORTANT!!!! You need to do this step in the following scenarios:

Client and server are both in a workgroup

Client is a workgroup and server is in a domain

Client is in a domain and server is in a workgroup

Both client and server are in domains, but there is NO TRUST between them.  

You DO NOT NEED TO DO THIS STEP if the client and server are in either the same or trusted domains.

Update 14th Nov 2008. I’ve just released a script which does all this configuration in one or two command lines:HVRemote

Time Server The PDC emulator of a domain is authoritative for the domain time. The PDC emulator at the root of the forest becomes authoritative for the enterprise, and should be configured to gather the time from an external source. All PDC FSMO role holders follow the hierarchy of domains in the selection of their in-bound time partner. Here is how you sync your AD that has the PDC Role with external source so your clients/servers can always sync time through AD.

W32tm /config /syncfromflags:manual /manualpeerlist:"time.ucla.edu time2.ucla.edu time3.ucla.edu time4.ucla.edu" W32tm /config /reliable:yes Net Start W32Time W32tm /config /update W32tm /resync

Please note to chanage time.ucla.edu time2.ucla.edu ... to your own campus time server or one of nist free time server below: http://tf.nist.gov/tf-cgi/servers.cgi

Check Configuration:

w32tm /query /configuration

All Other DCs and Servers Run the following:

A la fin de ce How-to vos clients seront authentifié automatiquement au proxy via leur ticket de session kerberos. Les clients hors domaine se verront refuser l'accès.

  Procédure déploiment Squid : How-to basé sur une centOS6 x86_64 minimal iso :

Une fois l'installation effectué (Pour un réseau comportant un nombre important de clients pensez a dédier une partition au cache ainsi qu'aux logs lors du partitionnement.)

éditer les repository afin d'avoir accès a certains paquets nécessaire :

On importe les clés GPG avec :

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY*

On active les repository RPMforge et EPEL sur le système :

rpm --import http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt

Switch dans le dossier /tmp et download des paquets :

cd /tmp

wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

rpm -ivh rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

(Si le lien est down, trouver les repo correspondant a la version de l’os : http://packages.sw.be/rpmforge-release/ )

Du fedora paske c’est bien :

rpm -–import https://fedoraproject.org/static/0608B895.txt

wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

rpm –ivh epel-release-6-8.noarch.rpm

yum install yum-priorities

On edit le fichier des repo avec vi ou nano hein :

vi /etc/yum.repos.d/epel.repo

Et nous y ajoutons, a la section [epel] la ligne :

priority=10

Une fois les repo editer, yum install des divers packages que nous allons utiliser :

yum install samba.x86_64 httpd.x86_64 nscd.x86_64 nss-pam-ldapd.x86_64 krb5-server.x86_64 krb5-libs.x86_64 krb5-workstation.x86_64 squid.x86_64 ntpdate.x86_64 squidguard.x86_64 samba-winbind.x86_64

!!!! RESPECTER LA CASSE DANS LES FICHIERS DE CONFIGURATION !!!!

On commence par modifier /etc/ntp.conf afin d’y ajouter les serveurs de temps du domaine (squid est très sensible a la synchronisation horaire : )

# Use public servers from the pool.ntp.org project.

# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#server 0.centos.pool.ntp.org

#server 1.centos.pool.ntp.org

#server 2.centos.pool.ntp.org

server dc.domain.local

server dc.domain.local

( ntpdate dc.domain.local pour synchroniser sur le CD)

On passe a la configuration de /etc/samba/smb.conf :

#======================= Global Settings =====================================

[global]

WORKGROUP = DOMAIN

password server = 192.168.0.1

password server = 192.168.0.1

realm = domain.local

security = ads

idmap config * : range = 16777216-33554431

winbind separator = +

template shell = /bin/bash

winbind use default domain = true

#winbind offline logon = true

kerberos method = dedicated keytab

dedicated keytab file = /etc/krb5.keytab

#guest account = nobody

#socket options = TCP_NODLAY SO_RCVBUF=8192 SO_SNDBUF=8192

client use spnego = yes

encrypt passwords = yes

# ----------------------- Network Related Options -------------------------

#

#

; workgroup = DOMAIN

server string = Samba Server Version %v

; netbios name = PROXYNAME

; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24

; hosts allow = 127. 192.168.12. 192.168.13.

# ----------------------- Standalone Server Options ------------------------

#

# Scurity can be set to user, share(deprecated) or server(deprecated)

#

# Backend to store user information in. New installations should

# use either tdbsam or ldapsam. smbpasswd is available for backwards

# compatibility. tdbsam requires no further configuration.

#security = user

passdb backend = tdbsam

# ----------------------- Domain Members Options ------------------------

; security = domain

; passdb backend = tdbsam

; realm = DOMAIN.LOCAL

; password server = dc.domain.local

#============================ Share Definitions ==============================

[SAMBA]

path=/etc/samba

browseable=yes

writeable=yes

valid users=@DOMAIN/UO

admin users=DOMAIN/adminproxy

# A publicly accessible directory, but read only, except for people in

# the "staff" group

; [public]

; comment = Public Stuff

; path = /home/samba

; public = yes

; writable = yes

; printable = no

; write list = +staff

Puis a l’install de kerberos :

Avec un yum install krb5-server krb5-workstation

Et a l’edition de ses fichiers de configuration /etc/krb5.conf

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = PROXYNAME.LOCAL

dns_lookup_realm = true

dns_lookup_kdc = true

all_weak_crypto = true

default_keytab_name = /etc/krb5.keytab

ticket_lifetime = 24h

#renew_lifetime = 7d

#forwardable = true

default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5

default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5

permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5

clockskew = 300

[realms]

DOMAIN.LOCAL = {

kdc = dc.domain.local

kdc = dc2.domain.local

admin_server = DC.DOMAIN.LOCAL:749

admin_server = DC2.DOMAIN.LOCAL

kpasswd_server = DC.DOMAIN.LOCAL

kpasswd_server = DC2.DOMAIN.LOCAL

default_domain = domain.local

}

[domain_realm]

.domain.local = DOMAIN

domain.local = DOMAIN

et /var/kerberos/krb5kdc/kdc.conf :

[kdcdefaults]

kdc_ports = 88

kdc_tcp_ports = 88

[realms]

DOMAIN.LOCAL = {

master_key_type = aes256-cts

acl_file = /var/kerberos/krb5kdc/kadm5.acl

dict_file = /usr/share/dict/words

admin_keytab = /etc/krb5.keytab

supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal

}

Et enfin a /etc/nsswitch :

passwd: files ldap winbind

shadow: files ldap winbind

group: files ldap winbind

#hosts: db files nisplus nis dns

hosts: files dns

# Example - obey only what nisplus tells us...

#services: nisplus [NOTFOUND=return] files

#networks: nisplus [NOTFOUND=return] files

#protocols: nisplus [NOTFOUND=return] files

#rpc: nisplus [NOTFOUND=return] files

#ethers: nisplus [NOTFOUND=return] files

#netmasks: nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers: db files

netmasks: files

networks: files

protocols: db files

rpc: db files

services: files

netgroup: files ldap

publickey: nisplus

automount: files nisplus

aliases: files nisplus

A cette étape, tout est prêt pour que le serveur puisse rejoindre le domaine.

Initialiser kerberos avec un compte du serveur présent dans les admins du domaine Active Directory

Grâce à la commande :

kinit [email protected]

Création de la base de données Kerberos avec des « stash » file qui assure la connexion a la DataBase AD avec :

kdb5_util create –s (attention… ca prend du temps, ne surtout pas appuyer sur entree pendant la création car un mot de passe vous sera demandé a la fin du processus. Si il trouve qu’il lui manque des infos, teste celle-ci, mais en théorie les fichiers de conf sont assez bien renseigné.

msktutil -c -b "CN=COMPUTERS" -s HTTP/proxyname.domain.local -k /etc/squid3/krb5.keytab --computer-name PROXYNAME-L --upn HTTP/proxyname.domain.local --server dc.domain.local --verbose --enctypes 28)

Et pour finir, nous inscrivons le serveur au domaine :

net ads join –u [email protected] –S DC.DOMAIN.LOCAL

(Nous testerons avec wbinfo –u qui renverra la listes des utilisateurs de l’ad, et wbinfo –g les groups. Nous testons que notre mot de passe est accepté par le serveur kerberos du controleur de domaine avec wbinfo –t (check succeded, ou pas.)

Nous voila serveur membre, editions le fichier /etc/squid/squid.conf (c’est assez long, mais tu peux copier-coller. Les lignes entre "" doivent se trouver sur la même. Ligne. Pensez a enlever les "") J’ai inseré certains modules que j’ai commenté, comme celui concernant kerberos/ntlm.  Dans ce contexte, seul les utilisateurs présent dans l’UO « UO » du domaine domain.local peuvent se connecter. La base SAM du controleur a l’ip 192.168.0.1 sera utilisé.

"auth_param basic program /usr/lib64/squid/squid_ldap_auth -R -b dc=domain,dc=local -D cn=admin,cn=UO,dc=domain,dc=local -w domain -f sAMAccountName=%s -h 192.168.0.1"

auth_param basic children 25

auth_param basic realm proxyname

auth_param basic credentialsttl 12 hours

### negotiate kerberos and ntlm authentication

#"auth_param negotiate program /usr/local/bin/negotiate_wrapper -d --ntlm /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=domain --kerberos /usr/lib64/squid/negotiate_kerberos_auth -d -r"

#auth_param negotiate children 240

#auth_param negotiate keep_alive off

### pure ntlm authentication

"auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=DOMAIN"

auth_param ntlm children 10

auth_param ntlm keep_alive off

Nous ajoutons la prise en compte du module ldap_auth qui nous permettra d’appliquer des stratégies en function de l ‘UO :

### provide basic authentication via ldap for clients not authenticated via kerberos/ntlm

#auth_param basic program /usr/lib64/squid/basic_ldap_auth -R -b dc=domain.local -D [email protected] -W domain -f sAMAccountName=%s -h dc.domain.local

#auth_param basic children 10

#auth_param basic realm Internet Proxy

#auth_pram basic credentialsttl 1 minute

Nous allons attribuer les ACL (Access Control List) correspondante a ce que nous venons de définir a la suite du fichier squid.conf :

##SSL AUTHORIZATIONS####################################################

acl SSL method CONNECT

#acl SSL_PORT 443 563

########################################################################

####acl for proxy auth and ldap authorizations##########################

acl auth proxy_auth REQUIRED

### external acl (LDAP GROUP ACL) ###

external_acl_type STAFF1 ttl=3600 %LOGIN /usr/lib64/squid/squid_ldap_group -b "dc=domain,dc=local" -f "(&(cn=%g)(objectClass=groupOfNames)(member=%u))"

####

acl ACLtest external STAFF1 net

http_access allow ACLtest

########################################################################

###Enforce Authentication#########################################

http_access deny !auth

http_access allow auth

http_access deny all

##################################################################

###SSL ACCESS RULES###############################################

http_access allow SSL SSL_PORTS

http_access deny SSL

Nous pouvons fermer squid.conf maintenant.

Maintenant, nous attribuons les droits nécessaire a winbindd (Verifier que l’emplacement est correct, le bougre aime aller se planquer n’importe où.) :

chmod 750 /var/lib/samba/winbindd_privileged/

chown root:squid /var/lib/samba/winbindd_privilege

Et activons le trafic http sur le ticket /etc/krb5.keytab que nous aurons créer sur le controleur sous 2008 avec :

Windows cmd :

C:\>ktpass -princ HTTP/[email protected] –mapuser [email protected] -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass long!$longp2ass3word -out c:\temp\berenkeytab

ATTENTION INCOMPATIBLE AVEC XP . Voir http://www.grolmsnet.de/kerbtut/ pour la méthode RC4)

grâce a :

kinit -k -t [email protected]

MISE EN PLACE DE SARG POUR LES LOGS VIA FRONT END WEB :

On download, compile, make, et make install SARG a l’emplacement voulu :

[root@linuxbox opt]# tar -zxvf sarg-2.3.1.tar.gz

[root@linuxbox opt]# cd sarg-2.3.1/

[root@linuxbox sarg-2.3.1]# ./configure

[root@linuxbox sarg-2.3.1]# make

[root@linuxbox sarg-2.3.1]# make install

Et nous partons modifier sarg.conf sous /usr/local/etc/sarg.conf :

[root@linuxbox ~]# vim /usr/local/etc/sarg.conf

# This is sample configuration, that you need to setup

access_log /var/log/squid/access.log

graphs yes

graph_days_bytes_bar_color orange

title “Squid User Access Reports”

temporary_dir /tmp

output_dir /var/www/html/reports/

[root@linuxbox ~]# vi /etc/httpd/conf.d/sarg.conf

Alias /sarg /var/www/html/reports/daily

<Directory /var/www/html/reports/daily>

DirectoryIndex index.html

Order deny,allow

Deny from all

# add IP address you allow

Allow from 192.168.0.2 <------- ajouter les ips des gestionnaires du proxy...

</Directory>

(l'inscription en base sql utilisant le module squid-db-logd.pl, verifiez qu'il soit installé avec la version de squid utiliser. (Perl nécessaire aussi, l'installer si cela n'est pas déja fait.) )