Security Stories and Help with Network Documentation

“Sorry for the delay” the girl smiled at him, “It’s been busy around here lately.”
“Oh, don’t worry.” midfr0st hoped he didn’t sound too annoyed. Feels like I’ve been waiting since bloody Christmas, I hope it’s worth it.

“Do you have a reservation?” The girl asked.
“Yes it’s that one,” midfr0st said and pointed at a line in her notebook. He felt uneasy with his name printed in plain view like that. Stop being so freaking paranoid, he thought, hoping his chills were from the weather outside instead of a product from his demons.
“Will you be dining alone?” midfr0st removed his finger from her reservations list.
“Just me, but you’re welcome to join me.”
Her smile grew a bit, “your table will be ready shortly.”
“The bar it is then.”
“That way sir,” she said pointing in the direction of the bar.
“Thanks!”

The place was fairly crowded so there was a buzz of chatter blended in with some classical music.
“What can I get for you sir?” the man behind the bar asked.
“Red wine, I’ll have that bottle,” midfr0st said pointing to a brand he knew of.
“Excellent choice,” the bartender poured him a drink.
You would have said that regardless of what I drank, midfr0st thought.
After his second glass his table was ready.
“I´ll just bring the bottle if that’s alright?” midfr0st asked not really waiting for the answer. They seated him in the corner of the room where he had a full view of the restaurant. He smiled; it was the table he would have chosen for himself. No one would be able to sneak up on him from behind. If I don’t get too drunk that is.
midfr0st was flipping through the menu trying to figure out what language the meals were written in. At the table next to his a waiter was explaining to two men what they had ordered and how the meals had been prepared. I wonder if that was the French word for road kill?

Soon a waiter was ready to take midfr0st’s order.
“I’ll have number fourteen as a starter and number thirty seven as my main course.”
“Ah, the foie gras and the steak, wonderful. Have you decided on a dessert?”
“I’ll see if I want one later.”
“And what would you like to drink to that?” she asked, midfr0st caught her looking at the empty bottle.
“What can you recommend?” midfr0st asked.
“That’s not really my area of expertise, wait a second and I’ll fetch our wine expert.”

The waiter ran off and a few minutes later a short guy came rushing to midfr0st’s table.
“Good evening, sir” he saluted and opened their wine list.
“What price range were you aiming for?” he asked glancing at the bottle on the table.
“Well if the wine is older than me it’s probably too expensive,” midfr0st confessed.
The man launched into a wild discussion, mostly with himself, about the different wines the restaurant had to offer. It sounded like he had an intimate relationship with the lot of them. In the end midfr0st didn’t really know what it was he had ordered, just that he had probably never paid that much for a bottle of wine before.
I should have a sommelier when I live in a mansion, midfr0st mused watching the guy walking away from his table. But mine won’t be gay as a meatball.

During the week I wrote a certification exam for Cisco, before the actual exam I was presented by a survey where they ask questions like background and experience. One of the questions was for which existing certifications I held.

From the Novell camp they had listed CAN, CNE and MCNE. I archived my CNA status in 1998 but haven’t really thought of pursuing the CAN certification. Since it isn’t listed on the Novell page for certifications, I’ll give you a hint on how to reach your goal.

If you already have the CNA status you’re ready to go, otherwise just follow the guidelines provided by Novell  before you start. Then when it’s time to write your CV just open up a word processor which has automatic spell check and write about your trophies hopefully the program will replace CNA with CAN, voila!

I haven’t seen that many CAN’s in the real world although I noticed one of the authors who writes for Syngress has it, good for him!

I would also guess that a lot of happy jobseekers have listed the CAN certification in their resumes.

Tags: certification, spell check

It’s a shame but my brand new Cisco ASA 5505 has just been sitting on my desk untouched for two weeks. The only think I’ve noticed about it is that it still had the old Cisco logo. Basically I’ve watching it from time to time without having time to play with it.

Finally I had some time to spare and I connected it to my cable modem, I have an ADSL connection with a few DHCP addresses so at first I just connected the device with the default configuration. The intelligent network seemed nowhere in sight and nothing worked. [click to continue...]

As I said a while ago I moved SYDI, my network documentation project, to a new domain. Now I’m beginning to add information about SYDI and network documentation in general. The first article is under the best practices section and is titled How to use SYDI Server with Login Scripts.

If you have any requests, please let me know.

Regarding my stories I am going to write more of them and the next installment of The Broken NDA is coming, sorry for the delay!

Tags: sydi, network documentation

You’ve probably heard of LinkedIn, I have been thinking of signing up for some time but always postponed it. Finally I decided to give it a go, like many of these Internet services it’s real easy to register and get started, most people can do it in minutes. Of course the registration process was beyond me.

The idea with LinkedIn is to connect people and make them network, this has been happening in the real world for ages. For example last week I saw that the toilet in my basement was leaking, shortly afterwards the water in the shower next to it started to rise. It got ugly in a hurry, in fact I think I know where they got the inspiration for the movie.

Working with Cisco they keep telling me that it’s like network plumbing, but I assure you there plumbing and there’s plumbing. After doing some basic troubleshooting it was time to call in the cavalry, but alas I had never hired a plumber and didn’t know  how to find a good one (one that I could trust).

To the rescue comes a neighbor, after talking with him he picks up his cell phone and calls a friend of his who works in the field. Now my plumbing problems are gone and this is an offline example of what LinkedIn can do, networking. Better yet when the plumber heard that I work as a network consultant he was interested in my services!

It all sounds great however, there’s no username that matches with that password.

Hm, that’s strange I just created the account. I figured something went wrong so I reset my password, still no dice. Mind you I don’t panic at this stage; I’m used to having problems registering different accounts. First I remove the funky characters from my password and try again.

The site is still unaware of my username and password. My next bet is the length of the password since I can’t very well view the internal code of the site I have to settle for the html code I can see;

input id=”session_password#login” type=”password” size=”24″ name=”session_password”

My password was 22 characters, I shouldn’t be having a problem but the search continues. On the password reset page I see this code instead:

input type=”password” name=”new_password” value=”" id=”new_password#newPassword#passwordReset” size=”16″ maxlength=”16″

Aha, maximum password length = 16. I don’t think too many people have this problem, however if my password is too long please tell me!

Anyway, now I’m LinkedIn, and here is my public profile.

Tags: password policy, maximum password length, linkedin, bad programming

So the SYDI project is coming of age and will be moving to its own domain. I haven’t launched the site yet but it should be out soon.

My plan is to use Drupal 5 when it is released, which I hope is very soon.

If there is anything you would like to see on the new website please let me know.

The new link to SYDI will be http://SYDIproject.com. Initially the content of the site will match the current one but I have plans to publish more information so hopefully you’ll find the new site more useful.

A few days ago the download counters for SYDI went passed 50 000! Although it’s great to see that so many are using the scripts what I like best about the project is when I receive feedback from you. If you have anything to say about SYDI good or bad just tell me.

Tags: sydi, network documentation, move, drupal

It was getting cold on his balcony. The leaves were falling from the trees and his neighbors had stopped having barbeques down below him. But midfr0st endured and defied the cold; he enjoyed his cigarettes too much and didn’t want to smoke them indoors. That environment was bad enough for his computers as it was, he didn’t want to make it worse.

The last few months had been fiercely busy for midfr0st, he hadn’t had any time to relax or really think about his situation. His current projects were done and he was left with a feeling of boredom. He wanted to be productive but his brain couldn’t handle anything besides smoke and music.

Eleanor Rigby was playing in the background; midfr0st thought Pain’s version was much more powerful than the original. He watched a couple walking, hand in hand away from his apartment complex. It’s better to eat porridge together than to eat pork alone. He didn’t remember where the saying came from but it had stuck to his mind.

When his cigarette was all but gone he left the balcony. His apartment was quiet as the grave. All the computers were off and midfr0st realized he wasn’t used to the utter silence. I bet the neighbors’ dog starts off soon though, he thought. Walking by his array of computers he wondered where the itch to turn them on had gone, usually he had millions of things to check. Instead he walked over to check his cupboard for a bottle of wine. Empty? midfr0st didn’t remember taking the last bottle; realizing he didn’t have any wine made him want it even more.

Sure he had plenty of beer and whiskey but what he wanted was a little something called Syrah, someone needs to take care of the logistics here.

Cooking up a meal just didn’t appeal to him without a bottle of red. Briefly he thought of pizza but that would only take care of his hunger, which was a secondary problem.

His plan had been to live as a hermit to avoid being seen by the outside world. He didn’t want to draw any kind of attention to his person and had sworn to follow that plan. midfr0st hadn’t eaten out in well over two years; he had hardly met “real” people during that time. Screw the plan, he thought, or that part of the plan anyway. His cravings overcame his earlier planning.

But where should I go? He asked himself, being out of the grid for so long meant he had no idea where any decent restaurants were located. Google Local didn’t work since that service wasn’t activated in his region. After booting up a computer and doing some searching he found a local search engine for restaurants.

After making the reservation he chose a blue suit from his wardrobe and phoned a taxi. He thought about the pretty girl he had been eyeing and exchanging hi’s with, it would have been nice to buy her dinner and actually talk to someone for a change. I think her name is Jenny… But midfr0st didn’t want to stray that far from the plan.

Tags: security, stories, fiction

Wasn’t There an Option for Html?

I might have said there was at some time, but it was a white lie. What you can do is to convert the XML file into a Html document. It’s quite easy and it’s used in this way:

cscript.exe sydi-transform.vbs -xServer.xml -sServerhtml.xsl -oServer.html

Running this script will require that Server.xml and Serverhtml.xsl and sydi-html-stylex.xsl are located in the same directory. If you have created private xsl files you can use the sydi-transform to convert it.

Hey, Wasn’t This about Documentation?

It sure was, most of what we’ve looked at up until now has been more geared against Inventory instead of Network Documentation. I saved the best for last, a new tool in sydi-server 2.0 is the ss-xml2word.vbs script (or SYDI-Server XML to Word).

What the script does is that it takes an XML file and converts it to a Word document. You might be thinking that SYDI already wrote to Word, which is true, however there are situations where that isn’t possible. For example in environments where you don’t have Word installed, may it be in a DMZ or as a scheduled task on a server.

The good part though is the options you specify when creating the Word document. To view these options run:

cscript.exe ss-xml2word.vbs -h

Here you can see that there are two arguments that are required -x and -l.

cscript.exe ss-xml2word.vbs -xServer1.xml -llang_english.xml

This line will create a Word document based on the information in the Server1.xml file, it will then use the English language file which describes what it writes to the Word document. This means that you can have the documentation in your native language. When I released SYDI-Server 2.0 there was support for English and Swedish. Later people have contributed with there own language files which you can download; Italian, Norwegian, Portuguese and Dutch.

One issue that causes the ss-xml2word.vbs script to fail for many people is a path problem. If you run the script and it just writes out a few pages without any information from the xml file and the script crashes, this is happening to you. Either put all the files in the same directory or specify the path after -x -l or -s. I will fix this in future versions so the error message is a bit more user-friendly.

The most exciting feature as I see it is the optional -s argument. This is the reason I created SYDI in the first place. The -s option specifies an XML file which contains the written documentation about the server. That is the documentation you have created, this differs from the data that SYDI-Server has gathered from the machine.

Let’s take it for a spin.

Writing Your Documentation

To get you started I’ve included three files in the Examples directory (of sydi-server), copy the howto.xml and rename it to Server1_docs.xml. This will be where you will write the documentation. Open the Server1_docs.xml file in Notepad. Scrolling up and down you will see different XML tags. You’ll recognize the sections and subsections from the Word documents previously created.

Inside the sections and subsections you will se prenotes and postnotes, inside these there are a few tags. The only thing you have to do in this file is to create and edit tags. Scroll down to the section called toc (Tables of Contents), here you will se the difference between prenotes and postnotes. It has to do where they appear in the final document. Just run a few tests and you’ll se what I mean. So let’s start to document.

In the system info section change this:
In this version you are only able to use text tags, more could be availible in later versions of SYDI.To:

Physical Location: Server Room in Stockholm
System Owner: BOFH
Support Agreement: 3Y Next Business Day (Expires 2007-10-16)
Save the file and create the final document.

cscript.exe ss-xml2word.vbs -xServer1.xml -llang_english.xml -sServer1_docs.xml

The above was just an example, you are of course free to write and include whatever you want in the documentation. If you fail to create the documents it’s good to know that XML parsers are very unforgiving if there’s an error in any of the files. Make sure all tags are closed correctly by opening them in a browser. If you fail to open Server1_docs.xml in a browser the problem is there. Fix it and try again.

I’ve also created a batch file, writedoc.cmd which looks like this:
cscript tools\ss-xml2word.vbs -x\\serverr\net$\sydi\output\%1.xml -llanguage\lang_english.xml -s\\server\itsupport$\documentation-source\%1-written.xml -o\\server\itsupport$\documentation-binder\Server-%1.doc -d -b”Table Contemporary”

I use it by running
Writedoc.cmd Servername

So there you have it, that’s how I use SYDI-Server. If you have any questions just post a comment or contact me.

Read Part 1
Read Part 2

Tags: network documentation, server documentation, sydi, how to, tutorial

The Output Options

SYDI has two output options; one for saving the report and another to choose which format to use.

-o Output to file, specify a path and filename and use quotation marks if there’s a space in the path. Remember to give your file an .xml extension if you’re using the XML format and a .doc extension for the Word format.

-e This is to choose the export format, the default is -ew (Word), to change to XML use -ex.

To create an XML report you would use:

cscript.exe sydi-server.vbs -oServer1.xml -ex [enter]

This will create an XML file that you can open in a browser.

XML Options

You might have noticed that the XML file you created didn’t look that great when viewed in your favorite browser. The reason is that you’re just looking at the raw XML file.

To view a style sheet, use the -s option. I generally use the -sh option which uses the html style sheet included in SYDI. For advanced users there is a -st option where you can specify a style sheet you have created on your own.

Lets test it again:

cscript.exe sydi-server.vbs -oServer1.xml -ex -sh [enter]

In order to view this file with a browser you will need the serverhtml.xsl and sydi-html-styles.xsl to be located in the same directory. These files are in the XML subdirectory of SYDI-Server. Copy the Server1.xml file you just created to that directory and open the file in a browser. Alternatively you can copy all of these files to another directory.

What Other Options do you have?

To be honest, you don’t have that many. The options that are left are -v to check the version of your script; this will check the SYDI website and see if a later version is available (I might remove this option).

The last option is -d for debug, if something fails to run as you expect it might be because of a bug in SYDI. The -d option is useful to troubleshoot these scenarios.

What if You Have More Than One computer?

So you want to run SYDI against multiple computers, it’s easy enough to write a batch file that does it for you. However, in the Tools directory there is a script called sydi-wrapper.vbs. A little “gotcha” is that you have to edit the script for it to work, but don’t panic; there isn’t any voodoo involved. Just open the script in notepad and scroll down to this section:

‘ Gathering Options
‘ WMI - Everything enabled by default
WMIOPTIONS=”-wabefghipPqrsSu”
‘ Registry - Everything enabled by default
REGISTRYOPTIONS=”-racdlp”

‘ Export Options
‘EXPORTFORMAT=”word” ‘ For Microsoft Word
EXPORTFORMAT=”xml” ‘ For XML

‘ Location Options
‘ Location of SYDI-Server.vbs
SYDISERVER=”C:\scripts\sydi-server.vbs”
OUTPUTDIRECTORY=”C:\scripts\Output files\”
LOGDIRECTORY=”C:\Scripts\Log Files\”
TIMEOUT=”600″ ‘ How many seconds you have to wait until a computer-scan is aborted hasn’t been tested.

‘ Other options, check sydi-server.vbs -h for help
‘ Uncoment/Change One of the below
OTHEROPTIONS=”-sh” ‘ For HTML Stylesheet on XML output
‘OTHEROPTIONS=”-b10″ ‘ Base Font size of 12
‘ End Of Settings

You will recognize the -w and -r options, unlike SYDI-Server this script defaults to XML (as it should). What you must change in order to get this to work are the values for SYDISERVER, OUTPUTDIRECTORY and LOGDIRECTORY. If you want to you can change the TIMEOUT value too, however it might not do you any good. That feature seems to have taken time out.

I wasn’t sure this was a good way to implement the script. The reason you have to edit the script is so that you won’t have to write such long commands later on in order to get it working.

Anyway, the remaining options are -u and -p for username and password when you connect to the machines. Then there are the gathering options or source options.

-t Reads from a text file, the computers listed in the text file should be separated by line or comma. To use this option:

cscript.exe sydi-wrapper.vbs -tAllMyComputers.txt

-d This is to get computers from a flat domain (NT4 style) to connect to all the computers in the domain you specify. A word of warning though, I’m told Heaven will be closing the gates for people who use NT4 much longer (you might have to break in as it is).

-a Active Directory, if you just run the script with -a it will connect to the active directory domain where you’re machine is located. Your other option is to specify an LDAP container. SYDI-Server will then scan all computers under this container (except for the ones with disabled computer accounts).

A few examples:

cscript sydi-wrapper.vbs -aDC=exibice,DC=com
cscript sydi-wrapper.vbs -a”OU=Member Servers,DC=exibice,DC=com”

[Self Promotion Mode]
If you haven’t heard of Exibice there’s a whole story about the company, read the first part here and you’ll find the other parts here.
[/Self Promotion Mode]

An Eagles View

After running sydi-wrapper you might have ended up with a whole lot of XML files. To give you a quick overview I’ve included a script for just this purpose. Also in the Tools directory is the sydi-overview.vbs script. It accepts one argument, -x, you will want to point this to the output directory you specified in sydi-wrapper. I have created a batch file which reads:

cscript.exe sydi-overview.vbs -x\\fileserver\net$\sydi\output

Running the script requires that you have Microsoft Excel installed on your machine. The script will parse all the XML files and start to populate the cells in Excel. The script will create six sheets. Computers with basic information about all your computers, WMI Programs is a list of all software installed by Windows Installer, Reg Programs are the ones found in the Uninstall registry key, Processes tells you what every computer is running. All these can be good to detect rouge programs or processes.

Finally there is the OS distribution pie chart and data source.

Read Part 1
Read Part 3

Tags: network documentation, server documentation, sydi, how to, tutorial