Windows Server 2012 R2 & HP Proliant Microserver

Windows Server 2012 R2 hangs on 'Getting devices ready 84%'
Fails to Complete the installation on HP MicroServer Gen7 (N36L, N40L & N54L)

The MicroServer N36, N40L and N54L all share the same embedded NC107i PCI Express gigabit NIC. The NC107i uses the Broadcom BCM5723 chip which doesn’t have an updated driver included with the Server 2012 R2 installation media. The lack of drivers will get you stuck at 84%...

The current workaround is to disable the on-board NIC and install another card.
Flash the custom BIOS to unlock the hidden BIOS screens
Install a supported NIC in the PCIe slot (Joe used the Intel EXPI9301CTBLK
Go into the BIOS and change the settings to match
Boot Settings -> Embedded NIC Port 1 Control – [Disabled]
Boot Settings -> Wake-On LAN – [Disabled]
Chipset -> Atheros AR8132M NIC – [Disabled]
After a reboot, Server 2012 R2 should install fine.

Fall back to R1 or...., here's a solution for you!

Download this driver and add it to the $WinPEDriver$ folder of your media installation kit.
Disable Embedded NIC Port 1 Control in BIOS
Install Windows Server 2012 R2
Add a Server name
Reboot into BIOS to Enable the NIC
This should get you working, have fun!

HP have documented this as a known issue and are currently working with Microsoft to resolve prior to the official release of R2.

Read more →

ITProDevConnections 2013

ITProDevConnections

It's time to attend a conference this weekend all about technology with my friend nick.

I`ll possibly stick to the networking & security area again as every year....

Hope it's gonna be good! See you on monday!

Read more →

Vodaphone USB Broadband on Linux

What you will need:

1. usb-modeswitch-2.0.1.tar.bz2
2. usb_modeswitch-data
3. libusb-1.x

Right after you install those files on your linux box, append these three lines in a terminal:

usb_modeswitch -WD -v 12d1 -p 1526 -n -M 555342437f0000000002000080000a11062000000000000100000000000000 -I -w 500

modprobe option

echo "12d1 14cf" > /sys/bus/usb-serial/drivers/option1/new_id

Open your network manager window, select Mobile Broadband, create a new connection and for connection settings leave them as default, just set the password to 1234.

Plug-in your Vodafone USB and that's it !
                                                                                                                                           [Source]

Read more →

Disable ICMP ping responces on your linux box

Depends on the distribution you use you may be able to disable the ping responce in your box to add some complexity for the attackers or the 'bad guys'. In the video below i am going to show you how to append such configuration in your linux distro.

Disable ping reply

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

Enable ping reply

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

To make this permanent set the following into /etc/sysctl.conf

net.ipv4.icmp_echo_ignore_all = 1

ICMP Message Types

You can find more about ICMP here.

Read more →

Enable TCP SYN cookie protection on your linux server

Normally when a client attempts to start a TCP connection to a server, the client and server exchange a series of messages which normally runs like this:

1. The client requests a connection by sending a SYN (synchronize) message to the server.
2. The server acknowledges this request by sending SYN-ACK back to the client.
3. The client responds with an ACK, and the connection is established.

This is called the TCP three-way handshake, and is the foundation for every connection established using the TCP protocol.

A SYN flood attack works by not responding to the server with the expected ACK code. The malicious client can either simply not send the expected ACK, or by spoofing the source IP address in the SYN, causing the server to send the SYN-ACK to a falsified IP address - which will not send an ACK because it "knows" that it never sent a SYN.

The server will wait for the acknowledgement for some time, as simple network congestion could also be the cause of the missing ACK, but in an attack increasingly large numbers of half-open connectionswill bind resources on the server until no new connections can be made, resulting in a denial of service to legitimate traffic. Some systems may also malfunction badly or even crash if other operating system functions are starved of resources in this way.

The protection should be enabled by default in many distros.

Commands used:

sysctl -n net.ipv4.tcp_syncookies
nano /etc/sysctl.conf
sysctl -p

Read more →

VLANs vs Subnetting

Subnet
is a range of IP addresses determined by part of an address (often called the network address) and a subnet mask (netmask). For example, if the netmask is 255.255.255.0 (or /24 for short), and the network address is 192.168.10.0, then that defines a range of IP addresses 192.168.10.0 through 192.168.10.255. Shorthand for writing that is 192.168.10.0/24, 255 is for the broadcast and 0 is for the network address.

VLAN
A good way to think of this is "switch partitioning." Let's say you have an 8 port switch that is VLAN-able. You can assign 4 ports to one VLAN (say VLAN 1) and 4 ports to another VLAN (say VLAN 2). VLAN 1 won't see any of VLAN 2's traffic and vice versa, logically, you now have two separate switches. Normally on a switch, if the switch hasn't seen a MAC address it will "flood" the traffic to all other ports. VLANs prevent this.

If two computers are going to talk using TCP/IP, then one of two conditions must be met:

They must belong to the same subnet. This means the network address must be the same and the netmask must be equal or smaller. So, a computer with an interface with an IP address of 192.168.10.4/24 can talk to a computer with an interface with an IP address of 192.168.10.8/24 with no issues, provided they are both connected to the same physical switch or VLAN. If the second computer's interface connected to that same physical switch or VLAN was 192.168.11.8/24, it would ignore the traffic (unless the interface was in promiscuous mode).

A router needs to exist between both computers that can forward traffic between subnets. Computer A and computer B need a route (or default gateway) to this router. Let's say a computer with an interface with an IP address of 192.168.10.4/24 wants to talk to a computer with an interface with an IP address of 192.168.20.4/24. Different subnets, so we must go through a router. Let's say there's a router with two interfaces (routers by definition have two interfaces), one on 192.168.10.254/24 and 192.168.20.254/24. If the route table or DHCP is setup correctly and both computer A and B can reach the router's interfaces on their respective subnets, then they can talk to each other indirectly via the router.

Forcing traffic to go through a router, even though it's not needed such as on our 8-port switch above, has security and performance benefits - it gives you an opportunity to filter traffic, an opportunity to optimally route traffic based on type, and routers do not forward broadcast traffic (unless unusually configured). VLANs are sometimes used as a "hack" to manage flows/visibility of IPv4 broadcast traffic.

VLANs are equivalent to switches. What comes in 1 port of a VLAN is replicated("flooded") to all other ports unless the VLAN has seen/learned the MAC address before, then it is directed to that port. There is no gateway to the VLAN proper. A "gateway" always means the IP address of a router.

For VLAN 1 to talk to VLAN 2, an interface in VLAN 1 must be connected to a router, an interface in VLAN 2 must be connected to a router, and that router must be configured to forward traffic between those subnets. In our 8 port example above, if we wanted to route traffic between those VLANs, we'd have to spend 1 port on each VLAN connecting to a router. Same with a switch.

When a computer gets its IP via DHCP, it also usually gets the "default gateway" from that same DHCP server. Someone has to configure the DHCP server correctly. Routing protocols such as RIP, IS-IS, OSPF, and BGP can also add routes. Of course you have the option of adding static routes.

I'm sure many high-end switches/hardware have a "VLAN router" "built-in" to them where spending an extra port within each VLAN connecting it to a physical router really isn't necessary if you want to route between VLANs in the same switch. This might be where the VLAN IP or "gateway" comes into play.

Read more →

Cisco router - Reset config

Start putty & connect to the communication's port with the default rates etc....

Restart the cisco router in order to break the boot sequence of the router by tapping the Break key.

breaking the boot sequence...

After you broke the boot sequence, issue the following command:

confreg 0x2142

"You must reset or power cycle for new config to take effect" is what you will face after the proper usage of the above command, reset by giving this:

reset

issuing the reset command...

Now, after some time it should start booting.. It will ask you if you`d like to start from scratch.. say yes/no depending what you actually want to config.

[...] ~config taking place

After the configuration, you have to exit the NVRAM ignorance mode by issuing the commands below:

config-reg 0x2102

Exit config# using Ctrl+C and then:

wr mem
reload

Hint: If you would like not to reset the router's configuration - altering the password only is done through the same way but answering no to the 'start from scratch' dialogue, then by saving the running configuration giving the copy start run command at that time. For more info reply below.

Read more →

Reduce MTU size to accept 802.1Q or ISL

InterSwitchLink and 802.1Q are two different protocols for trunks between network devices, though they cause some problems when they are not configured properly...

In order not to cause frame errors so packets can be accepted in the RX line, you have to reduce the MTU size if you are working with cheap equipment or non-cisco devices.

I wont explain the 'how-to' because devices vary, just a reminder :)

Read more →