Why netflow?

Recently, we're facing with network congestion, especially on our Wan Link.


We tried to find the culprit for this problem, but nothing much came out of cacti and ntop. So we decided to download and test this netflow reporting tools called Netflow tracker from Crannog Software. The installation is very easy, and we managed to find the cause of the trouble in just few minutes.


After identifying the source of problem, we decided to disconnect the server from the network. Traffic flow back to normal.

Disabling Windows Autoupdate

If you have a patch management system, you dont need to enable AutoUpdate service. Why?

1. Reduce bandwidth consumption, instead of every machine connecting and downloading from *microsoft.com, now all you need is one centralize server.
2. Reduce logging noise in network devices especially firewall
3. Reduce resources usage since less services running automatically.

So how to do it?

I use GNU Awk and must run as domain administrator.

1. net view | gawk " { print $1 } > hostlist
2. for /f %i in (hostlist) do sc \\%i stop wuauserv
3. for /f %i in (hostlist) do sc \\%i config start= disabled


Thats it.

Enabling Windows Remote Desktop using command line

Sometime u need to access remote windows machine by RDP, but the problem is, RDP is not enable by default. Using psexec and reg add, you can enable RDP remotely.

psexec \\computername -u username reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0

OSSEC HIDS + Web Interface

After testing several HIDS like samhain, osiris i decided to give OSSEC a try. BTW, what the heck is OSSEC? OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. The reason i pick OSSEC not samhain or osiris, because of it's simplicity.

Ossec is a client-server solution. So u need a server and clients. My server run on FreeBSD and clients run on windows/Linux/Solaris/Bsd. The installation process is very straight forward, so please visit here.

For monitoring purpose, i use ossec-wui, a web based interface for alerting. Installation also very straight forward, except that, i cant view alert from ossec logs file. I already add apache user into ossec group (edit /etc/group), but the result still the same. From Ossec mailing list, one of the guy pointed out that os_lib_alerts.php does not return the right user group. For solution, i need to comment that line.

/* Getting group information */ $evt_group = strstr($buffer, "-"); if($evt_group === FALSE) { /* Invalid group */ continue; => comment this line }


So, now my ossec-wui work like a charm. Heres the screenshot.


Further googling show that, i need to upgrade my OSSEC from 0.93 to 1.0 in order to overcome this problem. Without very much hesitation, i download the latest version and run ./setup.sh . Thats it . Job done for today.

Reset "sa" in MSDE

Yeah, shit does happen especially when you dont plan properly. I forgot my MSDE password that store most of EventViewer alerts. Luckily, Builtin administrator accounts can be used to reset MSDE password. Here's the trick:

osql -E -d databasename -Q "sp_password NULL, 'newpassword', 'sa'"

-E to use trusted connection
-Q to execute query and exit

for more option, run osql /?