I've been really pleased with LastPass as a password management plugin for Chrome. It has the ability to store and generate complex passwords for all your sites as well as store encrypted notes about each one.
Just make sure to turn off the "Automatically Fill Login Information" option if you work in Systems Administration. Just the other day it updated this information on a site I was using without me noticing. I had to scramble for the valid username and password before systems started throwing alerts.
Showing posts with label System Administration. Show all posts
Showing posts with label System Administration. Show all posts
Jun 17, 2014
Mar 10, 2014
Typical Network Speeds
Borrowed from http://www.channelz.org/network-speed-table/
| Tech | Scope | High | Low | Typical |
| POTS | WAN | 56,000 | 300 | 50,000 |
| ISDN | WAN | 2,048,000 | 128,000 | 128,000 |
| T1 | WAN | 1,544,000 | 1,544,000 | 1,544,000 |
| E1 | WAN | 2,048,000 | 2,048,000 | 2,048,000 |
| 802.11b | WLAN | 11,000,000 | 4,300,000 | 4,300,000 |
| DSL | WAN | 52,000,000 | 256,000 | 6,000,000 |
| 802.16 WiMAX | WLAN/WWAN | 70,000,000 | 10,000,000 | 10,000,000 |
| Ethernet | LAN | 10,000,000 | 10,000,000 | 10,000,000 |
| Cable | WAN | 400,000,000 | 512,000 | 16,000,000 |
| Token | RingLAN | 16,000,000 | 4,000,000 | 16,000,000 |
| 802.11g | WLAN | 54,000,000 | 4,300,000 | 19,000,000 |
| 802.11a | WLAN | 54,000,000 | 5,500,000 | 23,000,000 |
| E3 | WAN | 34,368,000 | 34,368,000 | 34,368,000 |
| T3 | WAN | 44,773,000 | 44,773,000 | 44,773,000 |
| 802.11n | WLAN | 248,000,000 | 4,300,000 | 74,000,000 |
| Fast Ethernet | LAN | 100,000,000 | 100,000,000 | 100,000,000 |
| FDDI | WAN | 200,000,000 | 100,000,000 | 100,000,000 |
| ATM | LAN/WAN | 622,000,000 | 622,000,000 | 622,000,000 |
| Gigabit Ethernet | LAN | 1,000,000,000 | 1,000,000,000 | 1,000,000,000 |
GB = 1e9
10GB = 1e10
Oct 18, 2013
New Remote Desktop for Mac (about time)
Apple and Microsoft have released a new client for Remote Desktop for the Mac. The old client has been in sore need of an update for years and the new client with IOS and Android versions is a welcome improvement.
https://itunes.apple.com/us/app/microsoft-remote-desktop/id715768417?mt=12
Apparently you can't save shortcuts with passwords, or at least I haven't figured it out yet. There will certainly be a learning curve and maybe a few updates (now that it's in the App store) but I sure hope I can have shortcuts with passwords, or maybe I should just rethink that from a security stand point anyway.
https://itunes.apple.com/us/app/microsoft-remote-desktop/id715768417?mt=12
Apparently you can't save shortcuts with passwords, or at least I haven't figured it out yet. There will certainly be a learning curve and maybe a few updates (now that it's in the App store) but I sure hope I can have shortcuts with passwords, or maybe I should just rethink that from a security stand point anyway.
Jun 18, 2013
9 Reasons SysAdmins Hate You | ITworld
9 reasons sys admins hate you
Happy sys admins mean happy systems. By avoiding these 9 common mistakes, you can stay on your sys admin's good side.
|
Sep 28, 2012
SNMP Basics
Here is a great writeup on SNMP basics that I have blatantly stolen from Paessler.com.
OIDs or Object Identifiers uniquely identify manged objects in a MIB hierarchy. This can be depicted as a tree, the levels of which are assigned by different organizations. Top level MIB object IDs (OIDs) belong to different standard organizations. Vendors define private branches including managed objects for their own products.
SNMP version 1, which is the SNMP standard supported by PRTG Network Monitor, was the initial development of the SNMP protocol. A description can be found in Request for Comments (RFC) 1157 and it functions within the specification of the Structure of Management Information (SMI). It operates over User Datagram Protocol (UDP), Internet Protocol (IP), OSI Connectionless Network Services (CLNS), AppleTalk Datagram Delivery Prtocol (DDP), and Novell Internet Packet Exchange (IPX). SNMP v1 is considered the de facto network management protocol in the Internet community.
SNMP works on the basis that network management systems send out a request and the managed devices return a response. This is implemented using one of four operations: Get, GetNext, Set, and Trap. SNMP messages consist of a header and a PDU (protocol data units). The headers consist of the SNMP version number and the community name. The community name is used as a form of security in SNMP. The PDU depends on the type of message that is being sent. The Get, GetNext, and Set, as well as the response PDU, consist of PDU type, Request ID, Error status, Error index and Object/variable fields. The Trap consist of Enterprise, Agent, Agent address, Generic trap type, Specific trap code, Timestamp and Object/Value fields.
MIBs are a collection of definitions which define the properties of the managed object within the device to be managed (such as a router, switch, etc.) Each managed device keeps a database of values for each of the definitions written in the MIB. As such, it is not actually database but implementation dependant. Each vendor of SNMP equipment has an exclusive section of the MIB tree structure under their control.
In order for all of this to be properly organized, all of the manageable features of all products (from each vendor) are arranged in this tree. Each 'branch' of this tree has a number and a name, and the complete path from the top of the tree down to the point of interest forms the name of that point. This is the OID. Nodes near the top of the tree are extremely general I nature. For example, to get to the Internet, one has to reach to the fourth tier. As one moves further down, the names get more and more specific, until one gets to the bottom, where each node represents a particular feature on a specific device (or agent).
SNMP, MIBs and OIDs - an Overview
SNMP is one of the most commonly used technologies when it comes to network monitoring. Bandwidth Monitoring programs like PRTG Network Monitor use it. But how does SNMP work? What are MIBs and OIDs? Read this short introduction into the world of SNMP!SNMP Basics
SNMP stands for Simple Network Management Protocol and consists of three key components: managed devices, agents, and network-management systems (NMSs). A managed device is a node that has an SNMP agent and resides on a managed network. These devices can be routers and access server, switches and bridges, hubs, computer hosts, or printers. An agent is a software module residing within a device. This agent translates information into a compatible format with SNMP. An NMS runs monitoring applications. They provide the bulk of processing and memory resources required for network management.MIB, OID, etc.
MIB stands for Management Information Base and is a collection of information organized hierarchically. These are accessed using a protocol such as SNMP. There are two types of MIBs: scalar and tabular. Scalar objects define a single object instance whereas tabular objects define multiple related object instances grouped in MIB tables.OIDs or Object Identifiers uniquely identify manged objects in a MIB hierarchy. This can be depicted as a tree, the levels of which are assigned by different organizations. Top level MIB object IDs (OIDs) belong to different standard organizations. Vendors define private branches including managed objects for their own products.
SNMP version 1, which is the SNMP standard supported by PRTG Network Monitor, was the initial development of the SNMP protocol. A description can be found in Request for Comments (RFC) 1157 and it functions within the specification of the Structure of Management Information (SMI). It operates over User Datagram Protocol (UDP), Internet Protocol (IP), OSI Connectionless Network Services (CLNS), AppleTalk Datagram Delivery Prtocol (DDP), and Novell Internet Packet Exchange (IPX). SNMP v1 is considered the de facto network management protocol in the Internet community.
SNMP works on the basis that network management systems send out a request and the managed devices return a response. This is implemented using one of four operations: Get, GetNext, Set, and Trap. SNMP messages consist of a header and a PDU (protocol data units). The headers consist of the SNMP version number and the community name. The community name is used as a form of security in SNMP. The PDU depends on the type of message that is being sent. The Get, GetNext, and Set, as well as the response PDU, consist of PDU type, Request ID, Error status, Error index and Object/variable fields. The Trap consist of Enterprise, Agent, Agent address, Generic trap type, Specific trap code, Timestamp and Object/Value fields.
MIBs are a collection of definitions which define the properties of the managed object within the device to be managed (such as a router, switch, etc.) Each managed device keeps a database of values for each of the definitions written in the MIB. As such, it is not actually database but implementation dependant. Each vendor of SNMP equipment has an exclusive section of the MIB tree structure under their control.
In order for all of this to be properly organized, all of the manageable features of all products (from each vendor) are arranged in this tree. Each 'branch' of this tree has a number and a name, and the complete path from the top of the tree down to the point of interest forms the name of that point. This is the OID. Nodes near the top of the tree are extremely general I nature. For example, to get to the Internet, one has to reach to the fourth tier. As one moves further down, the names get more and more specific, until one gets to the bottom, where each node represents a particular feature on a specific device (or agent).
Sep 4, 2012
Mac Terminal Tricks
I use the Terminal application on my Mac all day long. I have numerous different systems that I connect to for different tasks. Generally, I have one terminal open and I can just ssh to various systems from that window. Lately however, I have been customizing things a bit. One thing I have liked is creating a default look (profile) for various systems so I know specifically what box I am on. Some systems have nearly identical test / dev systems and the last thing I want to do is enter a command on a production system when it was meant for test. Once inside the terminal application I can simply do a Shift-Command-N to bring up the command window and type in the profile for that system. Since I can enter the initial command for each profile, this makes connecting to various systems with a specialized look very simple and easy. So I can have my test system with green text and my production systems all glowing red.
*update* It appears that you only get the custom colors and not the actual command. I have posted in the Support Community. I'll update here if I get any response.
*update* It appears that you only get the custom colors and not the actual command. I have posted in the Support Community. I'll update here if I get any response.
Feb 17, 2012
Impressions: Windows Sysinternals Administrator's Reference
Impressions: Windows Sysinternals Administrator's Reference:
Mark Russinovich and Aaron Margosis have written another awesome addition to the Microsoft Press catalog, Windows Sysinternals Administrator's Reference. Per my policy, because I did not read the whole book I am only posting "impressions" here and not a full Amazon.com review.
In brief this book will tell you more about the awesome Sysinternals tools than you might have thought possible. One topic that caught my attention was using Process Monitor to summarize network activity (p 139). This reminded me of Event Tracing for Windows and Network Tracing in Windows 7. I remain interested in this capability because it can be handy for incident responders to collect network traffic on endpoints without installing new software, relying instead on native OS capabilities.
I suggest keeping a copy of this book in your team library if you run a CIRT. Thorough knowledge of the Sysinternals tools is a great benefit to anyone trying to identify compromised Windows computers.
Tweet
In brief this book will tell you more about the awesome Sysinternals tools than you might have thought possible. One topic that caught my attention was using Process Monitor to summarize network activity (p 139). This reminded me of Event Tracing for Windows and Network Tracing in Windows 7. I remain interested in this capability because it can be handy for incident responders to collect network traffic on endpoints without installing new software, relying instead on native OS capabilities.
I suggest keeping a copy of this book in your team library if you run a CIRT. Thorough knowledge of the Sysinternals tools is a great benefit to anyone trying to identify compromised Windows computers.
Tweet
Copyright 2003-2011 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
Jan 7, 2011
Splunk GEOIP Lookup
Here's a great Splunk feature. Using this query you can see what countries are hammering your boxes and make nice graphs for the boss.
sourcetype="linux_secure" name="Failed Password" | lookup geoip clientip as src_ip | timechart useother=false limit=5 count by client_country
You can easily change client_country with src_ip to start dropping the ban-hammer as well.
sourcetype="linux_secure" name="Failed Password" | lookup geoip clientip as src_ip | timechart useother=false limit=5 count by client_country
You can easily change client_country with src_ip to start dropping the ban-hammer as well.
Jan 6, 2011
Useful Splunk Queries
So we finally have a working reliable installation of Splunk on site and I am starting to build some useful queries. There is so much information available it's almost too hard to make a reliable query that returns the information you need (without false positives).
sourcetype="WinEventLog:Security" User Name: "CategoryString=Logon/Logoff" User_Name="administrator" | chart count(eval(Type="Failure Audit")) as "Login Failures" by src_ip
This will give you a nice chart showing a count of Administrator logon failures by source IP.
If you find yourself getting data that you aren't sure is real or should be ignored, I find the best way to be sure is to verify with a known failure or reproduction of the issue to be tracked. In this case, I simply attempted to log in with a bad password and my attempt showed up after a refresh.
sourcetype="WinEventLog:Security" User Name: "CategoryString=Logon/Logoff" User_Name="administrator" | chart count(eval(Type="Failure Audit")) as "Login Failures" by src_ip
This will give you a nice chart showing a count of Administrator logon failures by source IP.
If you find yourself getting data that you aren't sure is real or should be ignored, I find the best way to be sure is to verify with a known failure or reproduction of the issue to be tracked. In this case, I simply attempted to log in with a bad password and my attempt showed up after a refresh.
Dec 23, 2010
Software Developer Advice for Sysadmins
Can't pass up great advice. I've done my share of upgrades and have personally experienced each and every one of these situations. Here are the highlights but please take the link for the full story.
1. DO have a "silent install" option.
2. DON'T make the administrative interface a GUI.
3. DO create an API so that the system can be remotely administered.
4. DO have a configuration file that is an ASCII file, not a binary blob.
5. DO include a clearly defined method to restore all user data, a single user's data, and individual items.
6. DO instrument the system so that we can monitor more than just, "Is it up or down?"
7. DO tell us about security issues.
8. DO use the built-in system logging mechanism.
9. DON'T scribble all over the disk.
10. DO publish documentation electronically on your Web site.
10 Dos and Don'ts To Make Sysadmins' Lives Easier: "CowboyRobot writes 'Tom Limoncelli has a piece in 'Queue' summarizing the Computer-Human Interaction for Management of Information Technology's list of how to make software that is easy to install, maintain, and upgrade. FTA: '#2. DON'T make the administrative interface a GUI. System administrators need a command-line tool for constructing repeatable processes. Procedures are best documented by providing commands that we can copy and paste from the procedure document to the command line."
1. DO have a "silent install" option.
2. DON'T make the administrative interface a GUI.
3. DO create an API so that the system can be remotely administered.
4. DO have a configuration file that is an ASCII file, not a binary blob.
5. DO include a clearly defined method to restore all user data, a single user's data, and individual items.
6. DO instrument the system so that we can monitor more than just, "Is it up or down?"
7. DO tell us about security issues.
8. DO use the built-in system logging mechanism.
9. DON'T scribble all over the disk.
10. DO publish documentation electronically on your Web site.
10 Dos and Don'ts To Make Sysadmins' Lives Easier: "CowboyRobot writes 'Tom Limoncelli has a piece in 'Queue' summarizing the Computer-Human Interaction for Management of Information Technology's list of how to make software that is easy to install, maintain, and upgrade. FTA: '#2. DON'T make the administrative interface a GUI. System administrators need a command-line tool for constructing repeatable processes. Procedures are best documented by providing commands that we can copy and paste from the procedure document to the command line."
Subscribe to:
Comments (Atom)


