Cisco ASA AnyConnect VPN group lock

I'm going to paste a recipe from Cisco Forum, this recipe explains how to set a tunnel lock into AnyConnect. It is very important because if you don't apply this policy any user with authorised credentials in the radius will be able to login in any VPN tunnel.

Puppet in Windows Azure

Few month ago Microsoft announced the availability of Azure VM images with Puppet agent installed.
Puppet is a piece of software useful to manage hundreds o thousands of machines from a single point of management.
Today, I have tested this feature and here are the notes, I hope they will be useful to you.

Testing Vagrant Azure provider

Last weekend I tried Vagrant-Azure, it is still a little bit unstable.
First of all, I did some tests with Vagrant and Virtualbox on Windows, following this URL, in this first test everything went fine, no problems.

Later, I wanted to use a Azure as provider and I had to install Vagrant-Azure Plugin https://github.com/MSOpenTech/Vagrant-Azure

VPN from CISCO ASA 5530 8.3(2) to Azure resets every 1 minute

We are working in a hybrid cloud solution, the first step is setting up the communications between our on premise servers and Azure.

We have at least one dozen of different network ranges in on premise network behind the ASA. 

We started the communication between on premise and Azure with one full /24 network and it worked fine, no problems at this point. So we added an extra HOST of different network and the problems began, we saw these messages in the ASA device log:

Lessons learned with a migration to Office 365

Today we are going to write about Office 365 and the recent migration of one of our clients.

Scenario:

• The client want to migrate their mailboxes from on premise Exchange servers to Office 365
• The client requieres password synchronisation (just an active directory sync, not federation or SSO)
• The client has Exchange 2003 and Office 2007
• The Exchange 2003 in our client's implementation is not standard
• The client wants a gradual migration to have time window to deploy Office 2013 on their computers in multiple stages.

Limit bandwidth between on premise and Azure with Cisco ASA

Here is a new recipe. We are working into a new hybrid cloud with Microsoft Azure and our offices. One of the requirements was the limitation of the bandwidth, between on premise servers and services in Azure servers, because we only have a  link of 20Mbps and this link has to provide access to clients and to our infrastructures in Azure. So we decided to limit the bandwidth to 8Mbps, between both sites. Here is the configuration example.

Windows 2012 R2 disk deduplication

Today we are going to talk about the file deduplication, a service which can achieve space savings of 60% into VDI infrastructures. 

There are some software requisites to setup before deduplication. To start the setup you have to add the following roles in to the server:

SCOM 2012 SP1 client-side event 34215

This is a short tip to solve the error event 34215, this event appears when client-side is trying to write an extra configuration into a IIS shared configuration and you don´t have enough permissions.

First thing, is understand how client-side monitoring is deployed. By default, client-side monitoring, tries to create the CSMCollector virtual directory and the OperationsManagerCsmCollector v.4.0 application pool when you execute the client-side wizard in the SCOM console.
The solution is easy, just give the computer permissions (web server) over the shared directory of IIS config.

After that you will get an event 34243 that means "The new client-side monitoring configuration has been successfully applied. No conflicts were detected."

SCOM 2012 check root login into CentOS system

Continuing the previous post, here is a recipe to rise an alert when root or privileged account has login into CentOS box via SSHD.

Obviously, for this recipe you need the Unix/Linux Management Packs applied and properly configured, here is an old post concerning this topic. 

There are at least two ways, via ACS or via Unix/Linux Log file monitoring to rise this type of alerts. 

The quickest and easiest way is with Log file monitoring, but it is less accurate than ACS, for example ACS has a set of reports to get detailed login statistics, but in some scenarios, it could be noisy and complex to manage.

SCOM 2012 - Create alert / monitor based on Windows event ( Administrator login alert )

Today, our customer asks us how we can know when the Administrator has logon via terminal server on Windows Server on their Domain.
The answer is with SCOM, using the event alert feature.
When you do a login in Windows 2008 or higher and the audit is running an event with id 4624  is created in the security log of the machine.
So first step to create the alert / monitor is to enable the audit.
You have to add new group policy with the audit enabled in the OU of the computers that you want to monitor, in this image you can see highlighted what you need.

Recipe: Linux SNMPD script OID & Cacti example ( VSFTD number of users )

Today we have to implement a new chart in our Cacti, this chart has to display the number of users connected to a VSFTPD server in a CentOS server.

VSFTPD CONFIG
Firstly, you have to setup VSFTD to display the number of connections, to do this, you have to add this variable setproctitle_enable=YES in the vsftpd.conf file and restart the service.
This setting allows you to monitor the clients, now you can see the connection in the output of ps command, in this case the output looks like this:
vsftpd_daemon_user 11203  1.0  0.3  56320  1548 ?        Ss   15:12   0:00 vsftpd: 90.IP.IP.IP: connected
Counting the number of connections is very easy, one script like this is enough:

 #!/bin/bash  
 ps aux | grep vsftp | grep connected | wc -l  

It will return the number of the connected users.
We are going to save it as /scripts/ftp-who.sh to use it in the next examples.
Now is time to integrate it on SNMPD config.

Recipe: How to know when was the last update in Linux

Today we are going to write about the difference between the two main package managers. Last week we were setting up some systems to be ready for ISO 27000 audit and we needed to know when the last updates were installed in  Linux servers. We have two types of Linux distributions in the company, Debian and CentOS, we think that CentOS is more enterprise friendly, especially the package manager (yum) is more enterprise friendly than dpkg and here is an example.

In CentOS you need to execute the command yum history to get a report of the last software installed in the machine. In Debian on the other hand, you need to execute something like this, date -d @$(stat -c %Y /var/cache/apt/) and it just return the last day when apt-get installed a package, it looks more tricky and it is not a function of dpkg.

This kind of details, like update history, are very important to us because they are very annoying in day by day operation, so we strongly recommend CentOS instead of Debian for enterprise systems.

Recipe: last MSI installed on a computer

This is a PoC of Powershell script to monitor MSIs installed packages in the local machine, it is ready to run every 5 minutes and launches an action if anything is installed in this period of time.

 #Deploy as 5 minutes management task.  
  $softinst=Get-EventLog application -InstanceId 1033 -Source MsiInstaller -Before ([System.DateTime]::Now) -After ([System.DateTime]::Now).AddMinutes(-5)  
  if ($softinst -eq $null)  
  {  
   Write-Host "No new software installed in the last 5 minutes"  
  }  
  else{   
  #Skip autoupdates  
  if ($_.Message -notcontains "Microsoft Endpoint"){  
  #Action  
  }  
  }  

You can run it as scheduled task and send email as action to control every 5 minutes which are the new MSI packages installed in one machine.
You can deploy it across domain using GPO and scheduled task ( http://technet.microsoft.com/en-us/library/cc725745.aspx ) using powershell.exe with parameter -command{} and invoke-command{\\UNC\scripts}
Remember the execution policy, you can manage it with GPO in Computer Configuration | Administrative Templates | Windows Components | Windows PowerShell and configure the Turn On Script Execution setting

Recipe to get hits per browser by URL

This is our first recipe, a short article describing a specific task.
Today we need get hits by browser in specific URLs.
We have used the following tools, Logparser Lizard,Powershell and Excel to present a graphic report.