Manage Firefox via Group Policy

Actually this heading is misleading. There is no proper easy to use  Active Directory Group Policy Object for Firefox yet.  This one shows a  a simple solution that will propogate firefox settings in to client machines via a logon script written in VB Script. Compared to some solutions this one is very simple and can be completed with in a very short time.

When a user logged in , logon scrpt given below will copy a file called user.js to that user's firefox profile folder.  User Firefox profile folder is usually located under :  C:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles

You can include many default settings in this user.js file such as user home page , proxy settings and switch off or set annoying settings such as checking for default browser etc    ... that you would like to deploy in to multiple machines in the domain. Syntax of the user.js file is exactly similar to the prefs.js file that lives in the firefox profile folder.

Difference between these two files is that settings in the user.js file take precedence over the settings in the  prefs.js file and user.js file can contain subset of preferences stored in the  prefs.js file.
Here's how its done.

1. Create the user.js file with all the necessary settings you would like to be propagated in to client machines. Sample user.js file is shown below.

# Mozilla User Preferences
/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 * For more information, see http://www.mozilla.org/unix/customizing.html#prefs
 */
user_pref("browser.startup.homepage", "http://www.mycompany.com");
user_pref("browser.shell.checkDefaultBrowser", false);

2. Create a VB Script file (Ex: MyFile.vbs ) with following code in it  

Option Explicit
dim oShell
dim LastDate
dim filesys
dim profilePath
dim latestProfileFolder
Dim fso
dim fldr
dim MainFolder
dim sourceFile
dim targetFile
dim boolOverWrite

Set oShell = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")

profilePath = oShell.ExpandEnvironmentStrings("%APPDATA%") & "\Mozilla\Firefox\Profiles"
' If firefox directory doesnt exist , then gracefully exit
If fso.FolderExists(profilePath) Then
Set MainFolder = fso.GetFolder(profilePath)
For Each fldr In MainFolder.SubFolders
    If fldr.DateLastModified > LastDate Or IsNull(LastDate) Then
        latestProfileFolder = fldr.Name
        LastDate = fldr.DateLastModified
    End If
Next

If latestProfileFolder <> "" Then
  profilePath = profilePath & "\" & latestProfileFolder
End If

sourceFile = "\\<Your Server Share>\Firefox\user.js"
targetFile = profilePath & "\user.js"
'WScript.Echo targetFile 
If fso.FileExists(targetFile ) Then
boolOverWrite = vbTrue
fso.CopyFile sourceFile, targetFile, boolOverWrite
Else
boolOverWrite = vbFalse
fso.CopyFile sourceFile, targetFile, boolOverWrite
End If
End If

3. Copy both files in to a shared location that has read access to all domain users.

4. Setup a group policy object so that this vbscript runs during the user logon

Refs:
Prefs.js file - MozillaZine Knowledge Base

How to find the RSA Server Fingerprint

SSH server's key is the key you see the fingerprint for when you connect to a different server for the first time. This key's identity is used to make sure you are logging in to the SSH you intend to use. 

The keys a SSH server uses to identify itself when you login to it are located in /etc/ssh/ and are named something like ssh_host_rsa_key. 

By default, ssh-keygen will create a key for the current user, which, by default, will be stored in ~/.ssh. The format of a user key and a server key is the same; the difference is where they are placed . When you install the openssh-server package, it automatically generates keys for the server to use.  

To see the fingerprint of the SSH server's RSA key, run the command : sudo ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.

Configuring Aegir Hosting System to use a Remote MySQL server

This post is a quick one on how to configure the Aegir hosting system to host it's database in a seperate MySQL database server. 

With the normal Aegir hosting system instillation , it expects the local MySQL database server to host it's database which contains various aspects of hosted site configuration details. To move this SQL database to a separate MYSQL database server you need to take following steps during/after the Aegir installation.

1. Follow the instructions given in the AegirInstallation Guide

2. Once Aegir has been istalled sucessfully , connect to the local MySQL sever and take a backup of the Aegir database. Also note down the service user account it creates under the database server.

3. Migrate the database to the remote MySQL sever and create the Aegir service user account in it. You should give appropriate rights to this user account so that it can access and manage the Aegir database.

4. Go to the Aegir instalation folder (usually /var/aegir/)and edit following configuration files so that Aegir can connect to the remore MySQL server.


File 1:
Pah:/var/aegir/hostmaster-6.x-XXX/sites/<Your Site Name>/drushrc.php


$options['db_type'] = 'mysqli';
$options['db_host'] = '<database Server Name>';
$options['db_port'] = 3306;
$options['db_passwd'] = '<Database Password>';
$options['db_name'] = '<Database Name>';
$options['db_user'] = '<Database User Name>';
$options['site_ip_addresses'] = array ();


File 2: /var/aegir/config/server_master/apache/vhost.d/<Your Site Name>
DocumentRoot /var/aegir/hostmaster-6.x-XXX

ServerName  <Your Site Name>
SetEnv db_type  mysqli
SetEnv db_name   <Database Name>
SetEnv db_user   <Database User Name>
SetEnv db_passwd   <Database Password>
SetEnv db_host   <database Server Name>
SetEnv db_port  3306

5. Thats about it. Restart the server and make sure that Aegir is using the remote MySQL server insted of the local one. Then you can uninstall the local MySQL server instance by typing : sudo apt-get --purge remove mysql-server

How to limit or control bandwidth usage by users in a small local area network

How do we block or limit the bandwidth utilisation of a single or handful of users who exploit the network by saturating the bandwidth with P2P traffic?

How can we do this using a PC and a redly available software tools in a shared home network environment with out raising any alarms, with out using elaborate QOS service policies, proxy servers, or Cisco Switches/Routers?

I googled a bit and none of the solutions mentioned in various sites didn’t address my particular need.
As I was able to see from various forums I have browsed, this is an issue many people come across in daily life and till date I have not seen a definite simple solution.

To this question what people normally suggest is listed below:

1. Use of a  Cisco or a Linksys router/ switch that has built in Quality of Service (QOS) features.
2. Modify existing home router with hacked Linux firmware that enables QOS.
3. Use of a proxy server or a specially designed bandwidth controlling software running on a gateway.

And the list goes on…

Yes, it is nice if you have a router that can do all that but in a SOHO environment it might not be the way to go. And after some time offending users may adjust their usage to coexist with other and spending money on hardware or software solution, which only get used for few days/weeks, might not be the best way to go about.

None of these solutions are cost effective, easy to implement/use and some may require the modification to the client machines or to the gateway router so that they redirect packets to the server which implements QOS feature instead to their default gateway. This cannot be done stealthily with out the help or consent of the user and I don’t think any one would give their consent to limit their bandwidth anyway.

So here is a simple yet effective solution to address just that. It limit the bandwidth utilisation at the network layer without alarming anyone , is simple, easy to configure and ethically very unsounding. Anyway what does these days?

These are the softwares you will need:

1. Cain & Able
2. Net limiter (Free version)

STEP 1 - Installing and configuring the software

First install both of these softwares in to a PC/Virtual machine that can act as a router. Cain & Able is considered by many antivirus software as an malware/hack tool. So you may need to create an exception for it in your antivirus software.

Secondly you will have to disable Windows or any other firewall in use or add exceptions to it to so that
Cain & Able can do it's job properly.

Optionally you can go to Configuration-> APR (ARP poison Routing) tab and set  spoofing options. This will makes it harder for the victim to trace your activities on the network.


STEP 2 - Running Cain & Able and Poisoning the ARP cache in the offending machine

This needs to be done so that our machine acts as a router sitting in between the offending machine and the gateway router. Yes, for those who are curious, technically this is a “Man in the middle attack”. But this is the easiest way to get the offensive traffic flow through our desired PC with out much hassel.

I will not try to explain this step in detail in here. please watch the movie below that explains it well.

Once you activate the ARP poisoning on the target machine , it will show up similar to the image shown above. As you can see this machine has hundreds of incoming and outgoing connections. This is a classic sign of running a P2P software.

STEP 3 - Run Netlimiter and limit the bandwidth as you find appropriate.

Once the offending machine is ARP poisoned, then you can open Netlimiter and check traffic routing through the interface by expanding Thrugoing nod. usng the bandwidth limiting capability in the Netlimiter , we can assign upload/download limits to individual machines or if you are lazy , you can cap  everything by setting limits to the Thrugoing nod.

Cain & Able is designed to deploy man in the middle attacks to collect and crack passwords from remote machines. In here we have put it in to  good cause .

As part of this configuration Cain & Able will collect many sensitive information flowing through it including plain text or encrypted  passwords …. So be ethical. With great powers comes great responsibility.

Fix For: Mac OS X print button not responding.

Error Message:
None.

Screens:

Mac OS X Print button
 not responding

Platforms:
Mac OS X 10.6.x

Scenario:
This occurred after an Apple software update for Xerox printer drivers. After applying the software update when the user select the File->Print option, the print dialog appears. After selecting print options when the user clicks on the "Print" button nothing happens. Print Dialog box does not disappear as it usually does. User can exit the Print dialog box by pressing "Cancel" button.

Reason:
Corrupted or invalid Xerox printer driver or plugin came through Apple software updates might have caused this.

Solution:

1.  Remove the printer that caused the issue using System Preferences -> Print & Fax
2.  Remove/Move to Trash the Xerox printer drivers/plugins from the machine (path: /Library/Printers/FujiXerox) that might have been updated through the Apple software update routine. It is a good idea to keep a backup of files you delete in case you want to restore them back. In my case I removed everything in the FujiXerox folder.
3. Empty the Trash folder to completely delete the files you have moved to Trash. You may need to restart the computer in order to do this as some files may be in use and will not let you delete them.
4. Reinstall old Xerox printer drivers that used to work earlier.
5. Add the printer back using System Preferences -> Print & Fax

/Library/Printers/FujiXerox Folder

Related Information:

• Mac OS X 10.4: Print button not responding

Fix For: Unable to add the domain - An Unexpected Error of type - 14090 (eDSAuthFailed) occurred

Error Message:
Unable to add the domain - An Unexpected Error of type - 14090 (eDSAuthFailed) occurred.

Screens:

Platforms:
Mac OS X 10.6.x 
Mac OS X 10.5.x  

Scenario: 
Active Directory account credentials were not recognized by the machine. Directory users were unable to log in to the machine using their network log in credentials. Local OS X accounts works fine. trying to unbind the machine from the Active Directory may fail and require us to do a force unbind.  Then, when we go and try to rebind the machines to the directory , above mentioned message will appear.

Reason:

File "Kerberos:EXAMPLE.COM.AU.plist" located in /var/db/dslocal/nodes/Default/config/ may be corrupted or invalid. 

Sample content of the file /var/db/dslocal/nodes/Default/config/Kerberos:EXAMPLE.COM.AU.plist is shown below

Use the Terminal command:

sudo cat  /var/db/dslocal/nodes/Default/config/Kerberos:EXAMPLE.COM.AU.plist

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>OSBuild</key>

<string>9L31a</string>

<key>appDurations</key>

<dict>

<key>["com.Adobe.ESD.AdobeUpdaterApplication"] [6.2.0.1474] [Adobe Updater 6.2.0.1474]</key>

<integer>81839</integer>

<key>[Microsoft/com.microsoft.AlertsDaemon] [12.2.5] [12.2.5]</key>

<integer>87438</integer>

<key>[Microsoft/com.microsoft.AlertsDaemon] [12.2.6] [12.2.6]</key>

<integer>158664</integer>

<key>[Microsoft/com.microsoft.AlertsDaemon] [12.2.7] [12.2.7]</key>

<integer>37661</integer>

<key>[com.adobe.Acrobat.Pro] [9.0.0] [9.0.0]</key>

<integer>137839</integer>

<key>[com.adobe.Installers.Setup] [2.1.51.0] [COMPUTER_NAME:nodes] 

Solution: 

Remove the Kerberos:EXAMPLE.COM.AU.plist file and attempt to bind the machine to the domain again.

Use the terminal command:

sudo rm /var/db/dslocal/nodes/Default/config/Kerberos:EXAMPLE.COM.AU.plist

More Information:

• Problems with Active Directory and Leopard — Macguru 
• Apple - Seminars Online - Single Sign-On and Kerberos in Mac OSX

Resetting the System Management Controller (SMC) And Parameter Random Access Memory (PRAM) in MacBook Pro

Problem:
MacBook Pro does not charge its internal battery. Laptop works till it is connected to the main power supply. But as soon as we take out the power code laptop dies as no power is left in the battery.

Screens:
In the following screen you can see that the internal battery is not getting charged even though the unit is connected to the mains supply.

Platform:
Hardware: MacBook Pro 8,1 i7/4GB RAM /500GB HDD
Software:  Mac OS X 10.6.7

Reason:
Corrupted System Management Controller (SMC) and/or  Parameter Random Access Memory  (PRAM) is responsible for this.

Solution:
Reset System Management Controller to factory defaults. 

Note: Portable computers that have a battery you should not remove on your own include MacBook Pro (Early 2009) and later, all models of MacBook Air, and MacBook (Late 2009).

• Shut down the computer.
• Plug in the MagSafe power adapter to a power source, connecting it to the Mac if its not already connected.
• On the built-in keyboard, press the (left side) Shift-Control-Option keys and the power button at the same time.
• Release all the keys and the power button at the same time.
• Press the power button to turn on the computer.  

Note: The LED on the MagSafe power adapter may change states or temporarily turn off when you reset the SMC.

Reset PRAM and NVRAM

• Shut down the computer.
• Locate the following keys on the keyboard: Command, Option, P, and R. You will need to hold these keys down simultaneously.
• Turn on the computer.
• Press and hold the Command-Option-P-R keys. You must press this key combination before the gray screen appears.
• Hold the keys down until the computer restarts and you hear the startup sound for the second time.
• Release the keys.

Apple knowledge base Links:

• Intel-based Macs: Resetting the System Management Controller
• Resetting your Mac's PRAM and NVRAM