EVALUATIE

Klik hier om naar de Webtrack te gaan.

N.B.: de video is in HD kwaliteit te bekijken op YouTube.

Meer informatie:

Citrix website over HDX Mediastream

Citrix HDX MediaStream for Flash System Verifier

HDX Ready thin clients

Gebruikte filmpjes:

Adobe HD Gallery (Getty Show Reel)

WMV HD Content Showcase (Robotica)

Vragen:

Vragen kun je hieronder stellen of per e-mail.

convert this post to pdf.

This post is password protected. To view it please enter your password below:

Password:

convert this post to pdf.

Time for a solution. I started some googling and found HideIP VPN

It’s supposed to work as I read here. So I decided to give it a go.

The free products are not always available. You have to wait for the free giveaway.

The site attracts me due to its clear products and seemingly easy setup. No crappy installers are necessary (I tried some, the don’t work that well). You make a connection by defining a PPTP connection. OpenVPN support is for premium users only. This is extremely cool, since my synology NAS supports OpenVPN (via an ipkg). It might also support PPTP, I didn’t test it yet.

I’m now waiting for a free test account to complete this post!

convert this post to pdf.

What I found so far is that it suffices to send traps from vCenter only. You can configure this from the vSphere Client Administration menu:

Now you can change alarms to let them send traps, e.g.:

convert this post to pdf.

I couldn’t find a clear overview and had to merge all documentation myself (see the links at the bottom of this post). For documentation purposes I wrote this blog.

To configure SNMP you need vSphere CLI. Instead of installing it I decided to have a go at the vSphere Management Assistant (vMA). This is a virtual machine you can download and allows you (amongst other features) to run scripts.

Installing and configuring vSphere Management Assistant

• Using the vSphere Client select in the file menu Deploy OVF Template. Use http://www.vmware.com/go/importvma/vma4.ovf (you can download it and deploy it from a file as well)

• Complete the wizard and wait until the download completes.
• Power on the virtual machine.
• Follow the installation wizard on the console.
• After the installation is complete you can use a ssh client to connect.

Configuring SNMP for ESX

Run the following commands on the vMA

1. Configure SNMP Communities (run for each ESX host)
   • vicfg-snmp.pl –server <hostname> –username <username> –password <password> -c <com1>
     • Hostname = esx host
     • username and password can be left out to be prompted
     • com1 = SNMP community (if more than one, separate with comma)
2. I don’t want the agent to send traps, so I don’t cover this in this blogpost. Read more in the admin guide (see link below)
3. Configure the SNMP Agent for Polling (run for each ESX host)
   • vicfg-snmp.pl –server <hostname> –username <username> –password <password> –enable
     • Hostname = esx host
     • username and password can be left out to be prompted

Configuring management software

This subject is covered in the admin guide (see link below)

Sources

http://www.vmware.com/pdf/vsphere4/r40/vsp_40_admin_guide.pdf (page 51 Configure SNMP for ESX/ESXi)

http://www.vmware.com/pdf/vsphere4/r40/vsp_40_vcli.pdf (page 13 Installing vMA and Running Commands from vMA)

http://www.vmware.com/support/developer/vima/ (vMA)

convert this post to pdf.

I created the following function:

Function FixServer($server)
{
# define the remote key. In this case HKLM on $server
$RemoteKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $server)
# Define the right subkey and open it (the "$true" is used to allow writing, default is readonly)
$regKey = $RemoteKey.OpenSubKey("SYSTEM\CurrentControlSet\Services\Dhcp\Parameters",$true)
# Get all access rules
$colAcl = $regKey.GetAccessControl()
# You can use the SID or the NTAccount. I use the SID, because it's language independant. Netwerkservice is dutch for NetworkService)
[System.Security.Principal.SecurityIdentifier]$ident = "S-1-5-20";
#[string]$ident = "NT AUTHORITY\Netwerkservice";
# construct the access rule
$rights = [Enum]::Parse([Security.AccessControl.RegistryRights], "FullControl");
$allow = [Enum]::Parse([Security.AccessControl.AccessControlType], "Allow");
$iFlags = [Enum]::Parse([Security.AccessControl.InheritanceFlags], "ContainerInherit");
$pFlags = [Enum]::Parse([Security.AccessControl.PropagationFlags], "None");
$rule = new-object Security.AccessControl.RegistryAccessRule $ident,$rights,$iFlags,$pFlags,$allow;
# add the access rul to the collection
$colAcl.AddAccessRule($rule)
#Set the collection of rules to the key
$regKey.SetAccessControl($colAcl)
# close the key
$regKey.Close()
}

convert this post to pdf.

You cannot configure everything from the web management page. I wanted a portforwarder with a different source and target port. I found that you can use telnet. Take a look a this page. I decided to give it a go!

E.g. you would like to publish a Remote Desktop on the outside address on 9833 (no I didn’t).

First create a custom service, with the right target port:

Use telnet to connect to the router. With the following command you can see the nat rule you just added:

nat inbound tcp list

ID: 26, wan Ip: 0.0.0.0, wan port: 3389-3389, lan Ip: 192.168.3.4, lan port: 3389

now delete that rule:

nat inbound tcp delete 26

And create the right one:

nat inbound tcp add 9833 9833 192.168.3.4 3389 3389

That’s it!

convert this post to pdf.

Error 5: Access is denied.

I tried WMI with a vbscript:

Permission denied: ‘GetObject’

I gave everyone (iedereen in Dutch) remote permissions in dcomcnfg:

This changed the error:

0×80041003

This is a WMI access denied error. I also gave Authenticated Users (Geverifieerde gebruikers in Dutch) Remote Enable permissions in wmimgmt.msc:

I still received the same error. This time however I found an Audit Failure event in Event Viewer:

Event ID: 4656 in Microsoft Windows security auditing. Audit Failure on SC_MANAGER OBJECT (SC Manager)

After some googling I found the command to view and set permission on de Service Control Manger (scmanager from now on)

sc sdshow scmanager

You can find more information on this SDDL syntax with your friend google (or maybe your new friend BING). I found out that Authenticated Users (AU) need LC (List Contents) permissions. In the SDDL string the AU part becomes:

(A;;CCLC;;;AU)

So the final solution becomes:

sc sdset scmanager D:(A;;CCLC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

SUCCESS indeed:

I cleaned up the wmi and dcom permissions, since I don’t need them.

Note: the user only sees the services he’s authorized to see. With the same command you can autorize an user to see additional services. Replace scmanager by the service name. Example:

sc sdset spool D:

If you actually run this command, no one has permissions anymore. I did this by accident. Fortunately you can fix this by running the right sc sdset command as SYSTEM. The RunAsSys tool from my collegue can help you with that. You can download it here

convert this post to pdf.

I wanted to use this certificate on my Synology Disk Station (DS 107). A first I received the error message “Private key and certificate are not matched.”

In this article I explain the steps I followed.

As a private person, I ordered a SSL123 Certificate. This saves you the trouble (and costs) for using a notary or solicitor.

Before applying for the real certificate, it’s a good idea to test first. E.g. at https://www.thawte.com/ssl-digital-certificates/free-trial/

Here we go:

First you have to make sure openssl is installed on your DS.

• Create a 2048 bit private key file:
  openssl genrsa -des3 -out some.key 2048
  I entered a pass phrase. I had to remove this pass phrase later on.
• Generate a request:
  openssl req -nodes -new -key some.key -out some.csr
• Apply for a certificate. I entered AppacheSSL as my web server software.

I received my certificate and saved it to some.crt. I uploaded some.key and some.crt into my DS. I received the error “Private key and certificate are not matched.” I was sure I used the right one. I wondered why I didn’t have to enter the private key password. I decided to test the private key without the password

• Remove the private key password:
  openssl rsa -in some.key -out some.nopass.key
  Be extra careful: your private key isn’t protected anymore. I would recommend to delete the unprotected key.

Now I uploaded some.nopass.key and some.crt into my DS. After restarting the web services (which happened automatically) I was happy to see the proper certificate was used!

convert this post to pdf.

After I sent an email it was moved to the Sent Items folder. The outbox in Outlook was empty. I got a notification that my mailbox was over it’s size limit. I checked but noticed that the size was below the limit. I compared the Local data with the Server Data and noticed a big difference:

Outlook Web Access showed the same. I determined that not all sent mail stayed in the Outbox but I couldn’t figure why some did and some didn’t.

After some research on the web without any results I figured out the “problem”.

After sending an email I immediately move it to a archive sub folder. I created a macro for this purpose which I attached to a button. When I wait for the synchronization to be complete (at this stage this means checking with OWA) I can use my macro to move the email. I guess I have to build in some check… or wait…

convert this post to pdf.