Handling FirewallD logs with Rsyslog

Lately I'm working on a project for work that's involving standing up Syslog servers for various sources such as Cisco FTD's, WLC's and other Linux servers. We have standardized on FirewallD and Ubuntu (cue the lols) I know, I know.. an uncommon pairing. But it works fine and while I'll admit not quite as easy to manage as UFW it's pretty solid.

Anyway, one problem I've had with FirewallD is how to handle it's own logging functions. By default it's conf file only supports the enabling or disabling of logging denied packets. Everything else seems to be split between kern.log and syslog however it seems the facility on all of them is 'kernel'. I want all of it to be sent to a specific log file, in this case /var/log/firewalld.log. 

Today I finally figured out how:

if ($programname == 'kernel') and ($msg contains "FwD ") then { Action (type="omfile" file="/var/log/firewalld") stop }

Message contains "FwD" is included because everyone one of my rich rules in FirewallD has a 'log prefix' of "FwD" then usually I tag on a bit extra like "SSH In", or "SNMP In" so my logs are easier to read.

Setting system DNS servers using Ansible

 So I've got a project at work that's allowing me to use more Ansible.. and I love it!  Anyway we've been using Cisco's Umbrella appliances for safe DNS services but now they are going away. So.. what to do about all the servers currently using those servers in a static fashion?

So in this situation Windows was actually a bit easier. We have three main sites and a few smaller locations that do not contain their own DNS servers. So this play associates the smaller sites subnets with the nearest main site. So after much assistance from #ansible on Libera.Chat here is what I have:

---

- name: Replacing Umbrella DNS on Windows

hosts: "{{ targets }}"

become: yes

become_method: runas

tasks:

- name: Edit Site1 DNS Settings on all network interfaces

win_dns_client:

adapter_names: '*'

ipv4_addresses:

- 10.10.16.11

- 10.10.16.12

log_path: C:\dns_log.txt

when: "(ansible_ip_addresses | ipaddr('10.10.0.0/16') | list)

or (ansible_ip_addresses | ipaddr('10.25.0.0/16') | list)"

- name: Edit Site2 DNS Settings on all network interfaces

win_dns_client:

adapter_names: '*'

ipv4_addresses:

- 10.11.16.11

- 10.11.16.12

log_path: C:\dns_log.txt

when: "(ansible_ip_addresses | ipaddr('10.11.0.0/16') | list)

or (ansible_ip_addresses | ipaddr('10.30.0.0/16') | list)

or (ansible_ip_addresses | ipaddr('10.20.0.0/16') | list)

or (ansible_ip_addresses | ipaddr('10.18.0.0/16') | list)"

- name: Edit Site3 DNS Settings on all network interfaces

win_dns_client:

adapter_names: '*'

ipv4_addresses:

- 10.13.16.11

- 10.13.16.12

log_path: C:\dns_log.txt

when: "(ansible_ip_addresses | ipaddr('10.13.0.0/16') | list)

or (ansible_ip_addresses | ipaddr('10.22.0.0/16') | list)

or (ansible_ip_addresses | ipaddr('10.21.0.0/16') | list)

or (ansible_ip_addresses | ipaddr('10.44.0.0/16') | list)"

Next post I'll make is handling Linux.  thanks!

MacOS Big Sur, Unable to expand disk (Signed Snapshot??)

 So it's been a while. Got a new job... enjoying the work from home life finally. 

Anyway this post isn't about that, it's about MacOS, Big Sur and alleged changes to the boot volume/container.  So at work now part of my teams job is to support the virtual platform used my all other employees. Yeah, the odd emplyee who needs a vmg uest for <insert reason> can login to an internal portal and spin one up; Windows, Linux, MacOS.  Anything is game.

Anyway so I have this ticket to assist a user with expanding the primary volume on this MacOS 11.0 guest. So I tried the Disk Utility.app first.. gave me an error about not having enough MAP space. To resolve that I ran a sudo diskutil repairdisk disk0 which completed successfully.  Followed up with a sudo diskutil resizeDisk0 0 which also completed successfully. I thought this was the end.

Turned out to be not.. I'd seen mention of a resizeContainer so next I tried that. One done I checked the gui Disk Utility and only Disk0 showed the full new size. All other objects underneath did not. 

I've spoken with folks on ##apple and was told that this is a new Big Sur-specific change in that now MacOS boots up into what he called a 'signed snapshot'.  Super interesting right?  I can't find ANY documentation on this.

I really, REALLY hope someone out there has something on this.. can confirm. Please comment if so.

Thanks

Netlify + Namecheap + ImprovMX = New Website

So with my recent splurge into development I realized that eventually I'd need a domain with a real looking website. The formatting options here on Blogspot suck horribly, I can't even use this place to host my resume without it looking like a 12 year old Dutch girl composed it.

So I will be making the move slowly to BenHart.Dev

I do have to say... the Reddit suggestions from r/webdev to use Netlify were spot on! I mean there was a tiny DNS record issue on the backend but one forum post is all it took to resolve it.  They even support deploying straight from github/bitbucket/etc which really excites me.

Plus setting up a free ImprovMX account allows me to forward mail sent to ben at benhart.dev to my personal Gmail account!

And going with Namecheap for the domain.. their Beast Mode name search really helped me narrow down the domain name I wanted.

I'm super excited!

Udemy: Django + Python: Complete Bundle

Up and onward into my development learnings is this course from Udemy. Now I readily admit.. this was a spur of the moment choice due to a 90% sale ending very soon.. I did not research it well enough.
The lecturer is obviously a super smart guy and very skilled in the ways of the Python (we haven't reached Django yet).  But being an English as a second language guy, sometimes his ideals aren't explained in familiar ways.

So you might wonder why I chose Django. I was wanting two things: more intermediate Python, and a framework to step into.

From what I can tells the primaries are Django and Flask.. the later's been described to me as a good enough framework but does not contain all the things you;d expect to find.  More of a DIY choice. Whereas Django has a ton of stuff built-in like auth, html, etc.

And honestly there's not a ton of choices I could come across that deal with those two packages primarily.  I started this this past weekend, I've been able to skip through some of the beginning level Python stuff but we're now approaching the meat of the course. I'll re-post back with my thoughts.

Coursera: Python for Beginners

So as my second foray into Python learning, I chose the Python for Beginners specialization.. You might ask why?

Well the reasoning was to hopefully hear about some of the most complex parts: lists, dictionaries, tuples a second time and using different words. I figure hearing about the same topic multiple, identical times is wasteful. But having a topic described in two completely different ways is best to help it sink in.
And it did I believe. Honestly I did not like this one, the TA's and lecturers used were not good speakers...nothing like Dr. Chuck that's for sure.

I mean, don;t get me wrong I did pickup more on the entirety of the beginning levels of the subject but it could have been easier.

Coursera: Python For Everbody

EDIT: The dates are wrong.. I actually completed this back last month. Just forgot to post it.

So I after hew and hawing over Python for the better part of 2 years I finally decided to go after what I can afford.  The PY4E Specialization on Coursera is led by Dr. Chuck Severence from the University of Michigan: Ann Arbor. The guys great at explaining things in a way for total noobs to understand.
This specialization is listed as a 6 month duration but I felt like spending more than 2 hours a week so I knocked it out in about a month.  Even got a certificate to prove it!

What I liked about the experience was  they incorporate assignments to help practice and drive home what was taught. Some were difficult for me I'll admit.. I did resort to IRC help on #python for a few of them.

But it was so much more effective than lecture alone.

Anyway now I'm onto the next specialization, Python for Beginners.

Veeam using BackBlaze API

So recently (like last week) BackBlaze announced the support of S3 API calls.  Something people have wanted literally for years now. Me included.

Anyway you all know me, I don't throw a bunch of fluff out.. here is how to add a B2 bucket as a repository.

First off some things that took me way too long to discover:

Buckets created prior to May 4 2020 won't work. So you have to create a new bucket.

Here's a handy link of tips:  Help.Backblaze.Com

Open Veeam (duh)
Click on Backup Infrastructure
Right-Click Backup Repositories
Choose 'Add Backup Repository'
Click on Object Storage
S3 Compatible
    Service Point: The entire S3 Endpoint url in your Application Key
    Region: Just the 'us-west-000' or equivalent in your app key
    Credentials: Create a new one based off your Key ID and Application Key
Make sure the bucket you associated with the Application ID is correct, create a new folder within

That's it!

Azure AD Connect error 8244-- SOLVED

So here I was the other day setting up AAD Connect for a new employer, gotta get those account sync'd!  Anyway this being yet another in a long series of inherited networks I ran into almost every single user object in the specified OU's to be sync'd erroring out according to the Synchronization Service Manager under Connector Operations with a 'permission-issue' error 8244.

I spent some quality time with Google and found where people needed to ensure the local sync account has been added to the domain level with:

So I did that, but it did not help. I start looking into the NTFS Security permissions on the users and OU's and low and behold not a single level has inheritance enabled.

So I found this powershell blurp: https://community.spiceworks.com/topic/2120107-powershell-to-enable-inheritance

Ran this and BOOM all my objects were now enabled, however re-running a Delta sync I was still getting mass errors.  So as a test I added the sync account with FC permissions and that account's password hash was sync to AAD.  Odd I thought, so I went looking further and in the event log event 611

So using this I found, eventually, that the sync account needs permissions to edit: ms-dS-ConsistencyGuid which then led me to this:

$accountname = "<domain>\ad_forest"
$forestdn = "dc=<domain1>,dc=<domain2>"
$cmd = "dsacls '$forestdn' /I:S /G '`"$accountname`":WP;ms-ds-consistencyGuid;user'"
invoke-expression $cmd

Once I ran that, I could then see the sync account under the Security tab of all my user objects and the next Delta sync kickoff ran without any errors.

Windows 10 MPIO, Here's how to do it.

So recently I swapped my Linux Plex server with a Windows box.  Actually truth be told I re-purposed a Barracuda 410 Web Filter appliance.. It was powered by Pentium G850 which I upgraded to an I7-3770K..  Oh and before I forget to mention I did get the front NIC ports working. Ask me how :)

Anyway the point of this post is to explain MPOI in Win10. So I'm running Win 10 LTSB on this box because I don;t want some errant update screwing up my media experience. Plus my back end storage is a Drobo 810i. So I've got both Drobo nics setup for iSCSI and I wanted the front nic ports of the now dubbed 'CudaPlex' (patent pending), to be dedicated to iSCSI.

Now WIndows 10, while similar to Server 2012/2016 does not support multi-path out of the box.  But after much time spent on Google I finally found a working solution. And to help save it for posterity I'm posting it here.

Originally found on the Technet forums it worked beautifully for me.

Here's the post:

Hi

I managed to "transplant" MPIO and msdsm driver from Windows 2019 to Windows 10 Pro (1703, 1709, 1803 and 1809) with success.
The method needs to import some registry, copy necessary files into original place and manually check update for drivers.
There was slow and old Infortrend Disk Array in my test (3x Gig connected to switch with 10Gig to PC), so PC initiated 3 paths from 1x10Gig to 3x1Gig
https://i.imgur.com/tqaJq0U.png
https://i.imgur.com/k2riJi7.png
https://i.imgur.com/3Gx4OyF.png

But in fast PC + fast array (4x1Gig Array + 4x1Gig PC) it performs like this
https://i.imgur.com/B94ZumQ.png

How-to and script+files+registry are located inside zip file (link below).
https://ufile.io/u2003
Beware!!! Backup first and this "mod" is for test/educational purpose only. You do it at your own risk and take the responsibility upon yourself and you are not to blame me.

Regards
Chris

• Edited by cra3y Saturday, January 19, 2019 10:50 AM

Friday, January 18, 2019 5:42 PM

I ran a system restore backup first just to be safe but this worked perfectly for me. Both PCIe nics are dedicate to iSCSI and I gained the performance boost only attributed to MPIO after following this guys process.

Enjoy.

In case Chris's link expires here's mine: https://ufile.io/9vp34h23

Qnap 10GBe PCi card locks up device

So a few months ago I bought a Qnap TV-1635AX NAS for work to use as a backup to disk solution until my SAN arrived.

I bought this one because it has a ton of drive bays and 10GB SFP capabilities.  Word of caution: DO NOT USE QNAPS 10GBE PCI CARDS

I wanted to use copper for my 10gb, so I also bought a Qnap QXG-10G1T card.  It's supported and should be fine right?  Except not. In my case I needed to backup roughly 19TB using Veeam and Robocopy.  I started out enabling Jumbo frames to help things move along a bit faster. Within 5 hours of my job starting the unit would lockup.  For the web gui totally unresponsive, however the local LCD panel showed it was good. Tried without Jumbo frames.. same thing except maybe 10 hours into the job. Locked up tighter than tight.

I spent time with support via emails.. they were no help. I wanted to hear from an engineer on this but no such luck.

Switched to a 10GB SFP module and so far no issues. I have not summoned up the courage to re-enable Jumbo Frames but I don;t have to now since my initial jobs are complete and it's just the deltas. 

But moral of the story is, the PCI backplane in at this this model Qnap cannot support 10G over copper.

Ubiquiti Unifi Controller networks.. Corp LAN or VLAN?

So a couple weeks ago I setup my first Unifi Controller on top of Ubuntu 19.10 Server. I ended up following a script I found here and it worked beautifully!

I'll readily admit I don't always research as much as I should but I usually figure it out anyway. This time though I found something odd.  So UBNT states that unless you have a USG in your environment (or another device performing Layer 3) then you should create all of your networks in the controller as VLAN objects.

My setup here at work is not special or out of the ordinary.. I have a Sophos firewall doing the firewall duties as well as DHCP for all my subnets and routing.  When I create my wifi subnet under Networks as a VLAN DHCP traffic refuses to pass.  I don't know why, nor do I want to suffer through the inhumanity that is UBNT's chat based support one more minute.

Long story, short I spent about 5 hours one evening fighting with support over this very thing. They say 'No you need VLANS'.  I say 'Well my clients are not pulling DHCP leases from my firewall'.. they say 'You must have VLANS!'  So it was a stupid cycle.

But about maybe 15 minutes after removing that Wireless VLAN and creating a Wireless Corp LAN my clients were pulling valid leases and everything was good.

I don't know why, nor do I care at this point. Just be aware, if you run into a similar issue try a Corp LAN instead.

Ubiquiti and my configuration

So here at my new job I've been steam rolling the old network infrastructure. When I came here there was a Cisco 2602I wap, a GS series Netgear, and a Cisco SG200.  And with what I was told this place wanted to be able to do those two devices had to go.

So because I've always wanted to try them, and I think their UI is neat as hell (and the switching performance is a definite improvement over the existing) I went whole-hog into UBNT.

I have a US-8-60W, a pair of US-48's, an AC-LR, AC-Pro and 2 AC-Lites. Setting up the Unifi controller on a local virtual machine was a breeze, and adopting and configuring things was a snap.  Even migrating the controller from a Win10 guest to an Ubuntu server was overtly easy.
I NAT'd it's required ports to the outside and could access it from anywhere via the mobile app on the Cloud Access Portal.

Then I decided to take it one step further.. I need a USG for those oh so sweet ISP metrics and DPI.

So I ordered one. Now the idiot in me that does surface from time to time did not read the manual and did not checkout the help.ubnt.com articles.  I jumped right in and uplinked it to my network via it's LAN1 port.
*BIG MISTAKE*

So did I mention my idiot?  He's more of a part-time dumbass. I did not know that the USG would start plugging DHCP right out of the box and because I had snooping enabled in the controller I'm sure all sorts of backend havoc happened.

So after fighting with it myself for an hour I decided to give the Chat support a try.  Fix thing the guy asks for in a screenshot of my config under Networks. When he sees their all Corp LAN object he immediately tells me to delete them and create VLAN objects. I had a bad feeling about this but, at his behest I did it anyway.

Long story, Short I lost communication to all my servers and the controller. When I regained control I spent the next 4 hours getting my switches and APs to re-adopt and to get the wireless network to pass DHCP traffic.

In the end I had to delete the Wireless VLAN and create it as a Corp LAN object. Then.. and ONLY then did DHCP traffic begin flowing and my clients started pulling valid leases from my firewall.

So moral of the story is, not every environment will work with the best practices.

Quickbooks, Potential firewall issue?

Quickbooks.

Everyone I know that has to support it.. hates it.

I hate it.. because I have to support it.

Ok I won;t drone on here, but something stupid I ran into the other day. Three ladies with identical mapped drives to a server housing the database. Due to some DHCP weirdness one of them pulled an ip from a different subnet. So because I was in a hurry (and it really should not have mattered) I disconnected her original mapping and remapped using the primary IP address of the server which just so happens to be on a different VLAN.

She could ping it, she could SMB browse and see the DB and other files. However QB refused to open it citing some stupid shit about QB is not able to open the file due to a potential firewall issue.

Long story: Short.. I fought this nonsense for an hour before finally giving up. Remapping the drive to the original IP and BOOM it opened right up.

OPNSense on a Barracuda 410 Web Filter

So in the past I've ran both pfSense and OPNSense on various hardware platforms.. vSphere, Dell Optiplex, a Nokia IP330 and now a Barracuda 410.
I picked this guy up for free yesterday from a friend specifically for this project.  Now if you've Googled much you'll find people have had all sorts of issues running this hardware and it all boils down to the nic's 'Cuda decided to use. Their fairly proprietary and in the Cuda implementation, software controlled via a set of relays and the LPT port.
Now I don;t know how the Cuda folks code it, but a few people have had luck using the writeio and BCHW binaries as seen here: Netgate Forums

But me, being who I am and since this control, IMO, is more electrical than software driven I followed a suggestion from the link above.. sorting out the blue and black wires on the LPT header connector.

Using a tiny piece of solid conductor wire from some plenum rated CAT5e I shorted those two pins together with the connector unplugged from the header. During power up I cannot hear the relays click closed, but during power off you can hear them click open. In my testing so far (about 2 hours now) they have remained closed and a constant ping from my workstation has no dropped a packet yet.

So see, my figuring is, since there's separate wires leading from the RJ45 header on the two NICs to this relay board (and the front RJ45 ports) that the relays are acting as an on/off switch for this connectivity.  I mean it's a shady thing to do but it does help Cuda maintain some *control* over the reuse of the hardware.  I mean for folks like me.. I know this box is powered by a normal MSI motherboard with a decent Celeron proc.  But I WANT to use it for the front network ports. To me there is no other reason to use this box without those ports.

So anyway, this works for me. And it involved zero packages, binaries nor messing with rc.d to make sure they work after a reboot.

Enjoy.

Determine IP address from MAC address, in Linux

Found a switch in a closet.. not documented and I'm too lazy to haul a laptop over and try to hit the console so I took a picture of the MAC label and stumbled across this literal GEM of a one-liner:

nmap -sP <subnet>/24 >/dev/null && arp -an | grep xx:xx:xx:xx:xx:xx | awk '{print $2}' | sed 's/[()]//g'

 It literally just works.

Powershell: Scripting, copying one users group membership to another

At $work I've been working on a new On-Boarding script, and to make things easy part of this script prompts to enter an existing users SamAccountName to copy the memberof to the new user.

It took me an hour or more of solid Google-Fu but here's the result and it works perfectly:

Get-auser -identity $copyuser -properties memberof | select-object memberof -ExpandProperty memberof | add-adgroupmember -members $newuser

Cheers.

OPNsense and PIA (Private Internet Access)

So.. I'm finally getting around to setting up my homelab, it helps to be buying a house, lol.

Ok so onward, a very good buddy of mine allows me to share his PIA account, and since I recently rolled from pfSense to OPNsense I decided to night to set it up.  To help create this I logged into the PIA account and generated an OpenVPN .ovpn config file, everything you need is within..



First things first, you need to create a new Certificate Authority via System -> Trusts -> Authority.  Copy and paste the

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

parts into the Certificate data field.. make sure to name is something descriptive.

Then goto System -> Firmware -> plugins and install the OpenVPN client.

Once complete, we will configure it..  VPN -> OpenVPN -> Clients and Add a new one.

Now here I  and used what was in it.. so

 Once complete I checked teh status at VPN -> OpenVPN -> Connection Status and saw it was connected.  Now you will want to create a new Interface; Interfaces -> Assignments -> New then pick the latest addition.. in my case it was "ovpnc1".

Then head over to Firewall -> Rules -> LAN and create a new rule:

And set the gateway tot eh new interface you created.. (obviously edit the Source ip to whatever IP your machine is using that you want the traffic to traverse this new VPN connection).

And there you go.. all done.

Linux/Windows Dual Boot, "The disk contains an unclean file system"

I'm not running a dual-boot system between KDE Neon (My current favorite Linux distro) and Windows 8.1 (Because I think 10 sucks ass),  Why Windows you say? Because no ones ported Far Cry 5 over yet ;)

Anyway I have a shared 'storage' drive between the two.. it's formatted as NTFS and just holds some backup stuff and I use it as a go between. Last night I'm pretty sure I told Windows to shut down. Turns out it left this disk in an unclean state. SHAME......SHAME.......SHAME lol.

The resolution is *ntfsfix*, installed by default on Ubuntu since like.. hell IDK like a number of major versions back.  Any how this is your savior.

 skeer@spektr  /media/skeer  sudo ntfsfix /dev/sda1
Mounting volume... The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sda1 was processed successfully.
 skeer@spektr  /media/skeer  sudo mount -a          
skeer@spektr  /media/skeer 


BOOM, Done. 

I can now write to the disk from Neon.

Peace Out.

Netplan error: Unknown key version

If you get the error: Unknow key version when trying to 'try' or 'apply' a netplan config file re-check your indentations.  They are off.. that's what causes this error.

Enjoy


p.s. yaml is 4 spaces for each indent.