Category: SBS 2008


Windows Server vs. Linux.

There are some serious errors in this..i’ll address them inline.

Text below:

Windows Server vs. Linux

June 8, 2010 —

Which is better? Microsoft Windows Server or open-source Linux?

This debate arouses vehement opinions, but according to one IT consultant who spends a lot of time with both Windows and Linux, it’s a matter of arguing which server OS is the most appropriate in the context of the job that needs to be done, based on factors such as cost, performance, security and application usage.

7 Open Source innovations

“With Linux, the operating system is effectively free,” says Phil Cox, principal consultant with SystemExperts. “With Microsoft, there are licensing fees for any version, so cost is a factor.” And relative to any physical hardware platform, Linux performance appears to be about 25% faster, Cox says.

That’s at a minimum.  It’s often much higher.  Windows server core is an attempt to regain some of that base speed by jettisoning the gui.

Combine that with the flexibility you have to make kernel modifications, something you can’t do with proprietary Windows, and there’s a lot to say about the benefits of open-source Linux. But that’s not the whole story, Cox points out, noting there are some strong arguments to be made on behalf of Windows, particularly for the enterprise.

For instance, because you can make kernel modifications to Linux, the downside of that is “you need a higher level of expertise to keep a production environment going,” Cox says, noting a lot of people build their own packages and since there are variations of Linux, such as SuSE or Debian, special expertise may be needed.

Windows offers appeal in that “it’s a stable platform, though not as flexible,” Cox says. When it comes to application integration, “Windows is easier,” he says.

Windows most assuredly is NOT easier.  by the time you get to managing patches, default configuration tweaking, the layers of security you have to pile on to have a prayer of a chance to NOT get compromised…Linux is MUCH easier.  I can turn up a Linux server from ground zero to the base install in under an hour WITHOUT USING AN IMAGE.  Updates?  One run and one reboot..Windows?  It’ll be multiples of each…it goes on and on and on.

Windows access control “blows Linux out of the water,” he claims. “In a Windows box, you can set access-control mechanisms without a software add-on.”

He apparently hasn’t heard of chmod and chown.  You can do everything you want right from the cli.  I tend to use a package called Webmin which is installed from the command line and run from a web browser…i don’t have to pay the Windows gui performance tax.

Patching is inevitable with either Windows or Linux, and in this arena, Cox says that it’s easier to patch Windows. Microsoft is the only source to issue Windows patches. With Linux, you have to decide whether to go to an open-source entity for patches, for instance the one for OpenSSH, or wait until a commercial Linux provider, such as Red Hat, provides a patch.

OR you can use a community variant called Centos(to reference Redhat) which is non-commercial…OR you can use the granddaddy of Linux distros, Debian, who has the basis of many many other distributions.  You don’t have to go to openssl because the distros are hooked right into the package vendors.  Here’s one point the author missed…speed of patches.  Microsoft WON’T patch until there’s an active exploit outside of it’s monthly cycle.  Most Linux distros patch within 24 hours of release..24 HOURS..not DAYS or MONTHS…HOURS.  Let’s see Microsoft do that…and do it reliably with hosing it’s users systems that have gotten infested due to their continued bad design choices.

Microsoft presents a monolithic single point of contact for business customers, whereas “In Linux, you need to know where to go for what,” which makes it more complicated, Cox says. “There’s no such thing as a TechNet for Linux,” he says. Linux users need to be enthusiastic participants in the sometimes clannish open-source community to get the optimum results.

Oh and Microsofties aren’t clannish?  LOL!  Let me tell you something..if you don’t drink the Microsoft Kool-aid totally you won’t be in the MS forums and MS evangelists sites..trust me I know about this.

These kind of arguments may indicate why Windows Server continues to have huge appeal in the enterprise setting, though some vertical industries, such as financial firms, have become big-time Linux users.

The only reason Windows keeps hanging around like a fungus is because the third party app vendors have not yet started coding for Linux in large numbers yet…that’s coming.  Once folks can see the advantages to Linux MS will have to tighten up their code or die.

Linux and open-source applications are popular in the Internet-facing extranet of the enterprise, Cox notes. And Linux has become a kind of industrial technology for vendors which use it in a wide range of products and services — for instance Amazon’s EC2 computing environment data centers rely on Xen-based Linux servers.

Know why?  Security is one, reliability is another, patching is stupid easy(run updates on live system. if no kernel updates no reboot needed..at all).  Windows hangs around right now because third party vendors aren’t coding…yet. MS right now does have it’s place and i will recommend windows on the back only when it’s truly necessary. The comments on this article do a far better job of eviscerating the author than I do..:)

I logged into a client’s machine today and saw this one sharepoint file was over 7 gigs in size. I am thinking this is one reason sharepoint has been pokey as of late. Some googling showed me that by default MS basically has the database in debug(which means every little thing is logged no matter what). That’s good for diagnostics but it makes the database get bloated to the point it kills performance. I found this MS page about the issue.

here are the instructions as noted in the article:

To reduce the size of the log file, use the following steps. A full server backup is recommended first.

1. Open notepad and Copy and paste the following text into notepad. Save the file as c:\logshrink.sql

declare @ConfigDB varchar(255);
declare @ConfigDBLog varchar(255);
declare @ConfigDBCmd varchar(255);
select @ConfigDB = name from sys.databases where name like ‘SharePoint_Config_%’;
set @ConfigDBCmd = ‘BACKUP database [' + RTRIM(@ConfigDB) + '] to disk=”C:\windows\temp\before.bkf”’;
execute(@ConfigDBCmd);
set @ConfigDBCmd = ‘use [' + RTRIM(@COnfigDB) + ']‘;
execute(@ConfigDBCmd);
set @ConfigDBCmd = ‘BACKUP LOG [' + RTRIM(@ConfigDB) + '] WITH TRUNCATE_ONLY’;
execute(@ConfigDBCmd);
set @ConfigDBCmd = ‘use [' + RTRIM(@COnfigDB) + ']‘;
execute(@ConfigDBCmd);
select @ConfigDBLog = name from sys.database_files where name like ‘SharePoint_Config%_log’;
set @ConfigDBCmd = ‘use [' + RTRIM(@ConfigDB) + '] DBCC SHRINKFILE([' + RTRIM(@ConfigDB) + '_log],1)’;
execute(@ConfigDBCmd);
set @ConfigDBCmd = ‘BACKUP database [' + RTRIM(@ConfigDB) + '] to disk=”C:\windows\temp\after.bkf”’;
execute(@ConfigDBCmd);
go

2. Open an elevated command prompt and run the following command:sqlcmd -S \\.\pipe\mssql$microsoft##ssee\sql\query -E -i c:\logshrink.sql

I had to run it twice to get the file back down to a reasonable size.

Computer Security Research – McAfee Labs Blog.

This is an expansion of the most recent IE exploit.  Now comes the analysis.

Allowing a system level file for windows(in this case a dll) be executable without any kind of security context is a really bad idea.  That’s really all  Activex is but there are several other DLL’s inside of IE that allow other DLL’s to be executed.  In this case it was mshtml.dll.  Mshtml.dll was the source of hte exploit and now a further analysis of the malware shows it uses it’s own dll to leverage this vulnerability.

ECC HIGHLY reccomends you do one of two things:

1.  Simply don’t use IE at all

2.  If you can’t(or won’t) at least get your security setup to wholesale blacklist dll’s at the firewall.  This will break some sites that are coded for IE.  Many of these sites will work under Firefox as well.

This was an exploit form back in ie6.  It is present in all version up to 8.  mshtml.dll once again has a major issue that allows remote sites to take over your machine.  If you are running ie6, ie7, or ie8 you are vulnerable.  HOWEVER if you have DEP turned on for ie 7 or 8 then the threat is reduced but not eliminated.  This is also why you NEVER surf on a server.  Frankly I am going to extend Microsoft’s advice.  Raise ALL security levels to high except trusted sites…leave it at medium(for windows updates) then never launch IE again.  I am being dead serious.

VIDEO OF EXPLOIT IN ACTION.  Blow the video up to full screen then watch for a list that shows up at around 1 minute.  Notice how notepad is running nicely.  At around 1 minute 50 seconds the “hacker” issues a kill command followed by a number.  That number is the notepad.  watch as notepad goes boom..no warning..no notifications.  This person has full control of your system..all because of a badly designed OS and browser.  Notice the users on the right.  Those are system processes..processes even the administrator does not have direct access to.  I have said it over and over having a web browser tied so closely to the kernel is a bad idea.  As long as IE exists in it’s current form Windows will NEVER be remotely secure.

Here’s the backstory.  Apparently some Chinese folks(possibly the gov’t) started using this unknown security hole in IE to start trying to get into various activists that are opposed to the vast range of Chinese gov’t controls.  They targeted Google because this is where these targeted activists had their mail.  Google detected this activity and began a backtrace.  They found out that multiple large companies had also been attacked using this issue.  The story is continuing to unfold.  The only fix available right now is to put all of your IE settings up to high.  This has the effect of making IE unusable on the internet.

My recommendation:  Use either google chrome or firefox.  Don’t bother with IE anymore…at all.  There’s so many links with full information I am not going to embed them into this post.  The list follows.

*UPDATE* there are quite a few programs that idiotically use IE to operate.  Now various exploit writers and researchers are hitting these as well.  Many other programs are now falling over after being hit either with IE exploits or ones similar that are now being found in a rash of other software.

Google’s Initial Response disclosure of what was targeted and revelations of other companies hit

Microsoft’s confirmation and advisory.

Other companies also hit.

(This list will continue to grow)

Mcafee has multiple postings:

1 2 3(twitter feed) 4

*UPDATE*  Itworld has much the same opinion of IE as I have had for a long time.

Microsoft looking into Windows ‘black screen of death’ problem.

I have not run into this with any of my clients.  Will keep a lookout though and will update this if things change.

*UPDATE*  The black screens are caused by the machines already being infected with malware BEFORE the security updates are installed.

Laurent Gaffié blog: Windows 7 / Server 2008R2 Remote Kernel Crash.

notice this is only in the two major operating systems that use the new smb protocol by Microsoft?  Vista isn’t mentioned but i bet this will kill Vista as well.

A user on the smallbizserver.net forums had an sbs server crash and had to restore it.  Instead of reinstalling then manually installing(like i did in an earlier post) he leveraged the VHD’s to restore directly form the backups(something sbs seems to have a hard time doing).  Here is the text:

Symptoms:
1) No concrete errors from WSB eventlog.
2) When trying the repair option from the SBS2008DVD, Unknown on Unknown device, Windows 2008 may appear at the Select OS to repair dialog box. Or it could be blank for the new drive.
3) When attempting complete PC Restore, operation will fail despite having enough HD space with error:
“The Volume ID could not be found. (0×80070495)”

When I ended up doing:
1) Find a Server 2008 machine. I need WSB that to access the backup image from the backup drive. Logon with admin rights.
2) Attached the drive containing the backup to the Server 2008 machine. The drive will be automatically assigned a letter but the user may not have access to the backup drive’s content (yet).
3) Launch WSB.
4) Attempt some recovery operation with WSB. For eg, restore some directories from the backup image onto a temp location. This gives the system access to the backup drive contents.
5) At this point, open up a windows explorer, and look for the backup VHDs on the backup drive via the drive letter. Copy them out to a separate directory. The VHDs will be named with GUIDs, rename them to shorter filenames.
6) Find a WS2008R2 or Windows 7 machine. They have native VHD mounting capabilities.
7) Mount the VHDs via disk managements.
8) Use HDD cloning applications to clone the different VHDs to other hard disks. I used Norton Ghost14 on my W7 machine. Make sure to clone the system drive (C:) with options to set bootable(active) and copy MBR.
9) Move the cloned disk(s) back to the original server. And reset BIOS to boot from the correct disk with the restored system partition.
10) Try booting. If everything is ok, you will get an error regarding something about ntloader.exe.
11) Boot with the SBS2008DVD again. Choose repair. Go into a command prompt.
12) CD into C:\windows\system32. This should be your restored system drive.
13) fire up bcdedit. Output will probably show unknown in several entries.
14) Reset the unknown entries with commands like bcdedit /set {default} device partition=C:

At this point, reboot. I was able to successfully recover the server this way. Definitely a real hassle. How the BCD on the backup images got corrupted, I have no idea. And this shouldn’t be so difficult to fix as all the underlying data is fine……..

I have spent the past few days working with level .5 techs(in terms of the knowledge of their own product) trying to get carbonite to restore the data it so willingly allowed me to upload.  Nowhere on the site does it mention a 50 gig cap and then they slow you down below dialup speeds.  Nor do they tell you that once the restore goes bad it’s going to take tons and tons of e-mails with you getting canned non-helpful suggestions.  Only after i finally uninstalled carbonite and contacted the CEO and started posting my negative reviews did they FINALLY give me some advanced things to try..by this time i was done and was working on my recovery from the .vhd file.

I just got an e-mail from carbonite..they ahve given me a full refund and have kept the account active..I can’t trust my data to them so it’s going to be an empty sheel from now on.

Luckily mounting the .vhd worked..but not without it’s own issues.  The instructions i talked about in my last post forget one thing.  The weird filename that the system generates make the vhdmount program barf.  I also wound up having to put the files inside the vhdmount folder onto the drive in the same folder as the vhd file.  I also had to rename the vhd file. So here’s my restoration procedure:

1.  Reformat the server

2.  Reload SBS onto said server

3.  get sbs setup

4.  download MS virtual Server 2005 sp1 for 64 bit

5. install just vhdmount

6.  copy the files from vhdmount(make sure you ahve hidden files in view) to the directory on the usb drive that contains the vhd file

7.  rename the vhd file to backup.vhd

8. type:  vhdmount /m backup.vhd

9. in a minute or two you should have another drive mounted.

10. take ownership of the entire drive

11. change the permisison so admins have all permissions.

Now you can copy the files from the drive to your sbs server.

If you read my earlier carbonite post it started because i had my server decide it would corrupt itself.  I did not catch it for a copule of days which meant my backup had corrupted OS files on it.  It turns out you can only restore the entire volume, disk, or server.  How idiotic.  So this means if your server craps out your only option is to restore the crapped out operating system files.  Since carbonite is useless in terms of restore what good is that backup?

After many hours of googling I think i found a solution:  The backup files are stored in MS virtual mahcine format.  I am going to try to manually extract the files i need after i reload SBS from scratch, manually rebuilt it…and then load up virtualserver 2005 and try to mount that drive.  I got this idea from David Moisan’s Blog.  Once i get the machine running again i’ll give this a wirl and let everyone know.