My PC is chatty (snmp-read)

I've been on a firewall monitoring kick lately and I've noticed a lot of office computers chatting on http and/or snmp.  Mine for one was trying to open snmp-read on 192.168.1.4 all throughout the day.  That drives me crazy.  Yeah, I'm that guy.

So, how do you go about running that down?  Use the firewall to your advantage.

The firewall will tell you not only what IP address and port you're trying to talk to, but it will also tell you what port you're talking from on your PC.

Now we can use netstat -ano to tell us what process ID (PID) is using the the source port 65365.

Finally, we can use procexplore (a free SysInternals tool) to determine what process has PID 1740.  You can also use Task Manager, but I like the SysInternals tool better.

The print spooler ... dang it!

And, there you have it.  My girlfriend's printer.

My next post will hopefully be on how to make it stop talking all day long ;)  Really Microsoft?!  Do we need to query the device every 70 seconds?  Why don't we just talk to the printer when we try to use it.

And people wonder why are PCs run so slowly ... sheesh.

1st Rule of Data-Comm ... Always Check the Connection

That one seems so obvious.  I know.  It is one of the universal truths.  I recently fought for hours with a NetApp appliance trying to figure out why it was having issues.  Turned out to be 2, not 1 but 2 bad GBICs!  I managed to duct tape and coat hanger the brain to the disk shelves while I waited the 24 hours for warranty parts replacement to get me the new GBICs, but I can never get those hours of troubleshooting back.

Everyone I've ever talked to says those things are notorious for failing.  A $300 part the size of a USB thumbdrive is notorious for failing yet we continue to use them in our enterprise class equipment.  Makes no sense to me.  At least I have several fiber loopback testers and a couple of spare GBICs on hand now.

1. As simple as it sounds ... check the connection first

2. When it's not the connection check permissions ;)

Nokia IP330 Smoothwall Express 3.0 in practice

Just a quick note to say this firewall is working perfectly.  Smoothwall is an outstanding product.  I have both public and private wireless networks at my office.  The public wireless was sitting behind a Linksys router.  I configured the Linksys as an access point (turned off DHCP, plugged into a switch port rather than the WAN port, etc) and put the IP330 between it and the Time Warner cable modem.

I have nothing allowed inbound and opened only http/s, dns, pop3 and smtp outbound.  The IP330 is acting as the DHCP server and is forwarding DNS.  I couldn't ask for a better solution ... and it's free -- double bonus. 

Building a Firewall Appliance

Many years ago there was a post that stated you could take a Nokia IP330 firewall and load Smoothwall Linux on it to create your own freely licensed 1U rackmountable firewall.  Back then I bought an IP330 and it's been sitting in an unopened box ever since.  That's not a huge deal as it only cost me $50 and I didn't have any practical application for a real firewall.

This morning I got the bug.  I needed a project I could geek out on.  So, this was it.  I had searched periodically over the years and found that the original article was gone.  Thank goodness for Google's cache!

The process, simplified, goes like this:

INITIAL INSTALLATION

1. Download and burn Smoothwall Linux 3.0 SP1 (as of today).
2. Remove the HDD from the Nokia IP330
3. Attach the Nokia HDD to a surrogate PC that will be used for the installation
4. Boot/Install
1. Take the defaults until you're prompted for the basic security posture: open, mostly open or closed.  I chose closed.
2. You'll be asked to choose the types of interfaces.  GREEN/RED is what you want.  It will default to GREEN/RED (ISDN or Modem), that's not what you want.
   
   During this process you have to configure your NICs.  The whole process only took me ~2 hours but 30 minutes of it was during this portion.  My surrogate PC had only one NIC, but the type we're choosing requires 2.  More on this in a minute.
3. Go ahead and setup your LAN (Green) network.  I used 10.123.99.0/255.255.255.0 and I set the firewall address to 10.123.99.254.
4. I set my External interface to DHCP so it would pickup an address from my existing internet router.
5. At this point you can do CTRL-ALT-DEL and reboot the PC.  Unless you have 2 NICs you will not get past this point.  No worries.  It all works out in the end.

MAKING THE EDITS

1. Because of the hard reset in the middle of the process I did not get to setup any passwords.  When you're prompted to login do so with 'root' and no password.
2. Set the CONFIG_TYPE to 3 in /var/smoothwall/ethernet/settings
3. Configure each of your GREEN, ORANGE and RED settings to match this:
   GREEN_DEV=eth0
   ORANGE_DEV=eth1
   RED_DEV=eth2
   
   [GREEN|ORANGE|RED]_DRIVER=eepro100
   [GREEN|ORANGE|RED]_DRIVER_OPTIONS=
   [GREEN|ORANGE|RED]_DISPLAYDRIVER=eepro100
   
   GREEN_ADDRESS=10.123.99.254
   GREEN_NETMASK=255.255.255.0
   GREEN_NETADDRESS=10.123.99.0
   GREEN_BROADCAST=10.123.99.255
   
   ORANGE_ADDRESS=10.123.100.254
   ORANGE_NETMASK=255.255.255.0
   ORANGE_NETADDRESS=10.123.100.0
   ORANGE_BROADCAST=10.123.100.255
   
   RED_DHCP_HOSTNAME=smoothwall
   RED_ADDRESS=0.0.0.0
   RED_NETMASK=0.0.0.0
   RED_TYPE=DHCP
   RED_NETADDRESS=0.0.0.0
   RED_BROADCAST=255.255.255.255
   
4. Next edit /etc/rc.d/rc.network. Look in the file for the end of the for loop:
   
   forNIC in 0 1 2 3; do
    
   done
   
   You need to add MAC address entries for each of the NICs.  These are the ones used by the original article, but my IP380 booted and had Checkpoint's IPSO installed so I was able to capture my real MAC addresses:
   ifconfig eth0 hw ether 00:a0:8e:e:50:78
   ifconfig eth1 hw ether 00:a0:8e:e:50:7c
   ifconfig eth2 hw ether 00:a0:8e:e:50:80
5. Next we need to change /etc/inittab.  Replace the line 1:2345 with:
   
   1:2345:respawn:/sbin/agetty -h ttyS0 9600 vt100
   
6. Finally, type lilo at the prompt and press enter followed by shutdown -h now.

After your PC shuts down remove the HDD and put it back in the Nokia and boot it.  You'll need to be console connected to the device so you can run "setup" to set the 3 passwords used on the machine.

You can now surf to the new Smoothwall box via it's Green IP address on port 81!  Login with admin and the password you entered during "setup."

http://10.123.99.254:81

Keeping Track of Files

Ever wanted to make sure the same file, in this case hosts file, is on all the PCs you manage at the office, but you don't have the budget for expensive automated software distribution tools?  You can do this with DOS batch or .VBS files.

Make a directory that we have permissions to write into at login.  In that directory create a marker file so we can successfully check to see if the directory exists.  Then we use the same technique to check the version of our hosts file!

Here's the code ...

@echo off

cls

echo *****************************************************************

echo * Executing Login Scripts.  Use of this equipment is restricted *

echo * to authorized employees only.                             *

echo *****************************************************************

echo .

:PCUPDATE

IF EXIST "c:\patches\NULL" GOTO :HOSTSNT

cd c:\

mkdir PATCHES

cd c:\patches

dir > NULL

:HOSTSNT

IF EXIST "c:\patches\hosts.20070430" GOTO END

echo Updating Hosts file

cd %SYSTEMROOT%\system32\drivers\etc

copy hosts hosts.old /Y

copy \\FileServer1\Sys\Patches\hosts . /Y > c:\patches\hosts.20070430

echo Done.

:END

We create the directory if it doesn't exist as previously discussed.  Then we look for a hosts file revisioned 20070430 (yyyymmdd).  If the file doesn't exist then we: 1. create a backup of our existing hosts file and 2. copy the new hosts file from our network store sending the output to our marker file in c:\patches.

Hiding the Executioner Follow Up

I noticed that one of my kids' PCs was on in the morning.  It's usually at a WoW login screen so I decided to double check my shutdown settings.  I found a missing "/f" to force the shutdown.  All corrected.  It also occurred to me that Windows 7 didn't have the keys I told you to modify.  For Windows 7 you simply create the appropriate keys and DWORD entries and it will hide your account.  Here's a sample registry file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList]
"executioner"=dword:00000000  


Just make sure you change "executioner" to the username you selected to run your jobs.  Also, a space was inserted between each \ for readability.  Do a CTRL-H in notepad and replace " \ " with "\".

Hiding The Executioner (job.user)

It's a flurry of posts today.  Once you created the user to run your jobs you may have noticed you now get a Welcome Screen in XP (or maybe you already did), but Executioner shows up in the list.  There is a way to hide him/her ...

You need to modify the registry.  Run regedit and navigate to the following Key:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList

Under this key you simply create a new DWORD value – the name matches the users name exactly, and the value is one of the following (Decimal format)

0 – Hides the user just from the welcome screen
1 – The user is shown

 Now when you reboot things will be back to normal.  This is also a good way to use a regular privs user account but give yourself the CTRL-ALT-DEL hidden option of entering a Bill Admin username and password if required.