Chryzo's Notepad

October 21, 2011

OpenVPN and AD authentication

Filed under: OpenVPN,Windows — Chryzo @ 10:06

Okay, so I setup an openVPN server nice and easy. Found the script on the net to auth against the AD from Jose Ortega: http://sites.google.com/site/amigo4life2/openvpn

However, it was not working on my side for 2 reasons. First, somehow openvpn was passing one argument to the vbs script and second, my user group is not in the same place as my users. The argument passed by openvpn was empty but still it was present thus screwing around with the vbs script which checks for the number of arguments present. Finally, as I was not able to find a “contact me” link on Jose Ortega’s site I am doing this post just in case other people run into the problem.

I did te following modifications:

    In Auth4OpenVPN.ini

  • Added a new DNGROUP variable in order to be able to distinguish User and Group base DN
    In Auth4OpenVPN.vbs

  • In the function AreSettingsOK(), I added the DNGROUP to the parameters array
  • In the function AreSettingsOK(), I incremented the for loop from 4 to 5
  • In the function AreCredentialsOK(), I modified the first test that check for 0 argument and added the following: or Wscript.Arguments.Count = 1 and Wscript.Arguments(0)=”"

Hope it helps others getting OpenVPN 2.2 working with AD and different DNs for users and groups.

May 6, 2011

WDS 2008, XP Master on low end terminals

Filed under: Windows — Tags: , , , , , — Chryzo @ 22:06

PDF version here: XP Master

1 Table of content

1 Table of content 1
2 Aims of the document 2
3 Background. 3
4 Environment 3
4.1 Terminals. 3
4.2 Network. 3
4.3 Servers. 4
5 Requirements and Pre-necessary configuration. 4
5.1 Pre-necessary configuration. 4
5.1.1 WDS and network configuration. 4
5.1.2 DHCP configuration. 4
5.1.3 TCLs configuration. 5
5.2 Requirements. 5
5.2.1 Capture Image. 5
5.2.2 Windows AIK. 5
5.2.3 Deployment Image. 5
6 XP Masterization. 5
6.1 Prepping the capture image. 6
6.1.1 Capture Image. 6
6.1.2 Usage. 6
6.2 Prepping the TCL for the image. 6
6.2.1 Sysprep.inf 6
6.2.2 Cleaning a few things. 6
6.2.3 Sysprepping. 7
7 Capturing the Image. 7
7.1 Media to save the master to. 7
7.2 Tricks. 7
7.3 Capture time. 8
7.3.1 Retrieve the XP Master Image. 8
8 Applying the image. 8
8.1 Notice. 8
8.2 Deployment 8
9 ROI 9
10 Going Further. 10
10.1 Lighter Terminals. 10
10.2 Automating. 10
11 FAQ.. 10
11.1 Network boot – unable to boot 10
11.2 Required XP Version. 10
11.2.1 Bug: XP SP2 Installed – Patched to SP3 – Sysprep SP3 or SP2. 10
11.2.2 Unknown: XP SP3 Installed. 10
11.3 Sysprep. 11
11.4 Capture. 11
11.4.1 Command Line Interface. 11
11.4.2 Activating the network interfaces. 11
11.4.3 Not enough memory to capture the image (or similar) 11
12 References. 11
12.1 Ref 1 – WDS and network configuration. 11
12.2 Ref 2 – Configuring WDS for an XP Image. 11
12.3 Ref 3 – Sysprep and registry could not update error. 11

2 Aims of the document

As I have not been able to find a document that goes pretty much through the whole process of making an XP Image of a light terminal by using WDS 2008, here is one.

The document roughly discusses the process and the environment. It will not however go into details about such or such configurations for that or that system. Its topic is centered on a specific environment and may or may not be applied elsewhere.

For French reading people I advise to check out Ref 2.

I’ll also say that in this document some configurations are given. In no way are they best practices and most often are not. They are just what I had to work with for the main part.

And no download links will be given as to keep this guide from making you download out dated tools.

3 Background

The company, in the industrial sector, in which I started to work, is using some light touchscreen terminals (TCL) in order to input some production data. However for historical reasons the network was flat, with some IP allocation problems and lots of viruses. The terminals are limited in their computing resource, pre-installed by our suppliers. Thus antiviruses cannot be installed on them. I was thus faced with the challenge of:

  • Increasing the company security as a whole
  • Cleaning up all the terminals from the rampaging viruses

In order to ramp up security and clean up the terminals I decided on creating a domain and making a master for the TCLs. And it is the last part that ended up taking some time.

4 Environment

The environment is made out of:

  • TCLs (OSYS TCL17 and TCL12), they are light touchscreen terminals.
  • Layer 2 (HP2510) and layer 3 (HP5406) switches
  • 2 Virtual servers:
    • 1 for AD / DNS / DHCP
    • 1 for WDS 2008

4.1 Terminals

The TCL have the following configuration:

  • Processor: 600 Mhz
  • Memory: Total of 256 MB and 32 MB by default shared with the video card
  • Network: Ability to boot over a cabled network through PXE

They are, when setup on the industrial machines, using wireless to connect to the company network.

4.2 Network

The network being upgraded pretty much at the same time it had, at the moment required for the reinstall and cleanup of the TCL the following configuration (overtly simplified):
null

4.3 Servers

The AD / DNS / DHCP server was on a virtual server with the following configuration:

  • 2008 R2 Datacenter (overkill)
  • 1 Processor, 2Ghz
  • 4 GB of memory

The WDS server was on a virtual server with the following configuration:

  • 2008 R2 Datacenter (overkill)
  • 1 Processor, 2Ghz
  • 4 GB of memory

5 Requirements and Pre-necessary configuration

5.1 Pre-necessary configuration

Due to the fact that the clients where not on the same network as the servers and I was using 2 different servers for DHCP and WDS, some preliminary configuration was required in order for TCLs to boot over the network correctly.

5.1.1 WDS and network configuration

WDS uses DHCP for network boot and transmitting information (more in Ref 1). Thus it requires the layer 3 switches to be able to route DHCP packets correctly to the WDS server or the PXE terminals will not be able to load the necessary boot images.

In order to do so, I had to not only configure the layer 3 switches to route to the server 10.0.0.A but also to 10.0.0.B by using the “ip helper address” command and enable the “dhcp-relay” on the 192.168.0.205 interface.

Also, don’t forget to configure the WDS server to answer to all clients. And do not configure the server to listen on port 67 or configure the option 60 on the WDS. DHCP and WDS are, here, on 2 different servers.

5.1.2 DHCP configuration

In order to enable PXE boot the DHCP server must have option 66 and 67 set:

  • Option 66: 10.0.0.B (the IP or Name of the WDS server)
  • Option 67: boot\x86\wdsnbp.com (the menu loader which comes with WDS)
5.1.3 TCLs configuration

Since the TCLs had already the bare amount of memory necessary for a WinPE boot, it is necessary to lower as much as possible the shared memory.

In my case, the shared memory was set to 1 MB instead of 32 MB.

5.2 Requirements

5.2.1 Capture Image

In order to be able to capture an XP image through a WDS setup you REQUIRE the vista boot image (works 100% of the time) or 2008 longhorn (not thoroughly tested though). A 7 boot image will not work.

This requirements has a huge impact on the Windows AIK you will require / need

5.2.2 Windows AIK

Actually, depending on what you need in regards to the light terminal, you’ll require a specific version of the WAIK, something I unfortunately found the hard way.

Here are the rough differences between the WAIK for Vista and 7:

  • Vista uses peimg to inject drivers into windows images while 7 uses DISM. Unfortunately DISM is not able to inject drivers into images in previous version of windows (before 7).
  • It seems like the WinPE image of the WAIK 7 did not contain any capture tools while the WAIK for Vista does. (Might just be a problem with mine though – have not checked)

So, if, in order to be able to capture the image you need to load:

  • Specific network drivers
  • Specific usb drivers
  • Specific hard drive drivers

Use the Vista WAIK (see Capture Image to understand more).

5.2.3 Deployment Image

Here, everyone is lucked out because de Vista or 7 deployment image actually require 512 MB of memory and it will refuse to load on less. Maybe there is a switch, but time was an issue. Don’t worry, there is a work around I’ll explain in the Process chapter.

6 XP Masterization

In order to get the XP master, one has to go through a few steps in order to:

  • Configure the pre-requisites.
  • Boot on a system that can capture an image.
  • Capture the image.
  • Apply the image.

Check out the Going Further chapter for some additional information for what you might try. The following is based on what I was able to try in the time I had.

6.1 Prepping the capture image

6.1.1 Capture Image

Getting this image is pretty straight forward:

  • Get your Vista install sources.
  • Retrieve the boot.wim file
  • Put it on the WDS server
  • Load WDS role
  • In the boot images:
    • Create a new boot image
    • Follow the process (pretty straight forward, or google a bit)
    • Once you have loaded your boot image:
      • Right click it
      • Select: Create capture image

Now you have your image that can actually capture the XP Master into a wim file.

6.1.2 Usage

Once you have the capture image, you can:

  • Boot the TCL over the network in order to capture the image
  • Use a USB stick:
    • Create a USB WinPE bootable stick (see WAIK documentation on how to do that)
    • Replace the boot.wim file on the USB stick, with the capture image

6.2 Prepping the TCL for the image

In order for microsoft tools to be able to capture the XP master, the terminal with the XP OS must be sysprepped. No way around it.

6.2.1 Sysprep.inf

If you want to automate the install after you have applied the XP master to a new computer, you need to create the sysprep file.

Just run the setup tool from the XP deployment kit.

6.2.2 Cleaning a few things

Before sysprepping the terminal you need to clean up an annoying folder and it’s sub directories:

  • %systemroot%\System32\Microsoft\Protect\S-1-5-18

If you don’t do it, you might run into some registry problems when you try to boot on a new computer to which you have just applied the master.

See Ref 3 for more info.

6.2.3 Sysprepping

Sysprep has lots of switches, personnaly I used the following command:

  • Sysprep –mini –reseal –activated

If you plan on getting the terminals onto a domain at a later date, do not use –nosidgen. No need to add to the workload of getting a terminal into a domain.

7 Capturing the Image

7.1 Media to save the master to

In order to capture the image you will have to be able to at least do one of these three things:

  • Have the capture image load the network drivers so that the capture image can be pushed directly to the WDS server (I vote against this solution). This require injecting the network drivers into the capture image and thus has an impact on the WAIK one has to use.
  • Use a USB stick that has 4 or more GB of memory (depends on how much data is on your XP terminal)
  • Use an external HDD that has 4 or more GB of memory. The external HDD does not need an external power supply cable. (My preferred solution)

7.2 Tricks

Once you have the necessary media to save the XP master, there is a few additional tricks here in order to be able to do the capture safely / faster:

  • Make it so that, if your terminal has shared memory, you make that shared memory as small as possible. Usually you can configure how much memory is shared in the BIOS. If you don’t give the system enough memory you will not be able to capture the image.
  • Use PS2 keyboard.
  • Don’t plug-in a mouse.

This is necessary in order to reduce as much as possible the memory foot print of the capture image on boot and allow it to load the most important driver:

  • USB driver if you are using a USB stick
  • External HDD drivers if you are using an external HDD
  • Network drivers. If you are trying for the network capture, check out the FAQ if you want to verify that you have network connectivity.

Funny thing is, sometime attaching a mouse will use just enough memory so that you won’t be able to see your media on which you want to capture the master or not have enough memory for the capture itself.

7.3 Capture time

Once you have booted on the capture image the process is straight forward and just follow the on screen instructions. I do not have a VM so I can’t post screens.

However if you are:

  • Unable to select a place to save the image to:
    • Try the tricks
    • Look into the Going Further section
    • Unable to save to the network:
      • Check that the network is initialized (see the FAQ for a really quick How-TO)

The capture of the image takes some time. Don’t worry about it, as long as it is launched, you are okay. Me, it took me, depending on the tests between 2 and 3 hours for a 2 GB XP Master (not much installed on it).

7.3.1 Retrieve the XP Master Image

To retrieve the XP Master Image:

  • If you captured to the network, it is on the WDS
  • If you captured to the USB Flash or HDD… guess what?

8 Applying the image

As I said, in order to deploy a master image, any deployment image based on Vista or 7 from the WDS require 512 MB of memory. This is a no go in our case since we have less than 256 MB.

8.1 Notice

This section is the least complete and tested on my part. So I will keep it short and to what I did so that I got it to work.

8.2 Deployment

In order to be able to apply the XP Master Image I did the following:

  • Transferred the XP Master Image to a USB flash drive and added my XP Master Image to the drive. Do not name it boot.wim and you can put it where ever you want on the drive, though I advise root folder J
  • Used all the tricks I had to do for the capture
  • Boot on a WinPE system with Imagex (see the WAIK documentation on how to get such a WinPE system; it is the same one if you ever did a 7 master for example).
  • Checked that I:
    • Could access the C drive of the new terminal
    • Could access the USB drive (D in my case, not always the case though)

Once you have booted on the Win PE system:

  • Format the TCL’s drive
    • If you partition the TCL’s drive, you might need to reboot in order for the drive to get the letter C
    • Apply the XP Master Image to the drive using the following command:
      • Imagex.exe /apply image_name.wim 1 c:\
      • Wait for the image to be applied. Pretty quick, like 10 to 20 minutes

Once the image is applied:

  • Exit the PE environment, it will reboot the terminal
  • Remove the USB flash drive
  • Let the computer boot.

Now, depending on your sysprep and sysprep.inf the system will install itself automatically. If you get an error, check the FAQ, I ran in the “registry could not update” one. Adding the –activated switch and removing the S-1-5-18 folder solved that one.

I hope this guide will help other people avoid losing time and increasing their ROI in such scenarios.

9 ROI

A quicky on the ROI for me:

  • For one terminal, the time I would require for:
    • Scratch installation is about 3 hours (Dismounting terminal from machine, XP install, driver install, soft install, …)
    • With a master: 0,25 hours for the equivalent of the scratch installation
    • I have about 30 terminals

If I had done scratch installs I would have spent about 90 hours ~ 11 days in order to reinstall the different terminals and kept on spending 3 hours every time I had to reinstall one.

With the master, I spend around 33 hours getting the system to work and I am down to half an hour to install a TCL. Thus, for the 30 terminals I gained around 50 hours of time though I “wasted” 6 days getting the system to work.

Just to prove that sometime, even though one may be hard pressed by time, It is worth losing some to gain a lot.

10 Going Further

10.1 Lighter Terminals

What about computers that have even less memory or processing power?

If so, I d’say that as long as win PE is able to boot:

  • One can try to use directly imagex to create an image (see the windows 7 WAIK on how to do that for exemple)
  • Remove as much driver and such loaded automaticaly from win PE to reduce its foot print.
  • Create 2 partitions on the harddrive. Install the system on the first partition, capture to the second one. It will load less drivers that way and reduce again the win PE or capture image memory requirements.

10.2 Automating

Because my terminals are machine mounted, not cabled, on a domain and on a specific WiFi network, I am:

  • Unable to boot from the network
  • Unable to fully automate all steps

So yes, one could even push even more automation through scripts and booting on an image that is able to apply the image to the computer hard drive and even format / partition it.

11 FAQ

11.1 Network boot – unable to boot

If you are unable to boot on the network check your dhcp relays and ip helper addresses or if you are in some way doing something to DHCP flows.

See at the start of the document for network configuration requirements.

11.2 Required XP Version

Due to the fact that I do not possess an XP SP3 CD, I can only say that the process works with an XP SP2 system, fully patched but without SP3.

11.2.1 Bug: XP SP2 Installed – Patched to SP3 – Sysprep SP3 or SP2

Windows XP SP2 patched with SP3, sysprep with the deployment toolkit for XP SP3 or SP2 seemed to not be working when:

  • Trying to capture an image or,
  • Trying to install the captured image.
11.2.2 Unknown: XP SP3 Installed

Unfortunately I was not able to test the sysprep when installed from an XP SP3 CD since I do not have one at my disposal.

11.3 Sysprep

Since I spent some time on google & co to know exactly which options to use, I ended up on some articles that were advising to use the –activated and –nosidgen switches in addition to the –mini and –reseal.

I advise using sysprep –mini –reseal –activated

I dissuade using the –nosidgen switch especially if you want to put the terminals on a domain. Though you can regenerate the SID after install if you want to. (http://lupus.wikidot.com/use-sysprep-to-reset-sid)

11.4 Capture

11.4.1 Command Line Interface

Once the capture image has booted, you have between 10 to 15 seconds in order to hit Shift + F10 and load the command line of the system. I have not found anywhere why this is so for my capture images at least.

11.4.2 Activating the network interfaces

Use the wpeutils InitializeNetwork command once you have access to the CLI

11.4.3 Not enough memory to capture the image (or similar)

This error does not mean that your media you want to save the image to is too small, but that you actually need more freed RAM in order to be able to do the capture.

12 References

12.1 Ref 1 – WDS and network configuration

http://www.techtalkz.com/windows-deployment/196944-pxe-problems-booting-wds-server.html#post824503

12.2 Ref 2 – Configuring WDS for an XP Image

This post is in French and regards a generic way of using WDS for XP images. Unfortunately, it misses some requirements and had a different hardware configuration for the XP terminals.

http://forum.hardware.fr/hfr/systemereseauxpro/Management-SI/deployment-services-windows-sujet_1410_1.htm

12.3 Ref 3 – Sysprep and registry could not update error

Well known bug, there is even a KB from Microsoft on this one: http://support.microsoft.com/kb/818171

January 13, 2011

Happy new year!

Filed under: Uncategorized — Chryzo @ 12:15

Hello,

It is true I have not been quite as active as late as I was, or want to be. Though since some people are finding some of the posts helpful and commenting on it, i ll try to pick up the pace on validating the comments from now on and posting about other things I might have picked up here and there

Happy new year

July 20, 2010

Back Online

Filed under: Apache,WebServers,Windows — Chryzo @ 21:05

Hey all,

So switch the server from a windows box to a linux box and got all the servers working again! It took me a while to do, but was pretty much straight forward in the end. Just that the permission system is really annoying sometimes on Linux.

Services switch from W2L:
* teamspeak
* web
* dbms
* version repos

Chryzo

August 19, 2009

EasyMYP version 2.6 – Release

Filed under: C#,Development,Windows — Tags: , , — Chryzo @ 20:58

EasyMYP version 2.6 is released!

It adds / improves the following list of features:

  • Dirties up the code a bit more due to it being beta and having new functionalities
  • A tree view is now available to peak into the archives
  • You can extract anything you want from the tree view by using a simple right click
  • Drag & Drop files in the application to load them, no need to go through the menu anymore!
  • Drag & Drop items from the archive tree to the file system tree!
  • Huge speed increase in lots of places
  • Multi threaded the extraction of files in order to separate read and write operations
  • Last but not least: Persistent options!

Still learning loads of stuff when working on functionalities for this application, so keep them coming!
The application can be found at: EasyMYP on GoogleCode

July 7, 2009

EasyMYP version 2.6

Filed under: C#,Development,Windows — Tags: , , — Chryzo @ 18:22

EasyMYP version 2.6 Beta is up and about!

It adds / improves the following list of features:

  • Dirties up the code a bit more due to it being beta and having new functionalities
  • A tree view is now available to peak into the archives
  • You can extract anything you want from the tree view by using a simple right click
  • Huge speed increase in lots of places
  • Multi threaded the extraction of files in order to separate read and write operations
  • Last but not least: Persistent options!

Still learning loads of stuff when working on functionalities for this application, so keep them coming!
The application can be found at: EasyMYP on GoogleCode

June 6, 2009

Hyper-V, corrupt virtual machine ?

Filed under: Hyper-V,Windows — Tags: , , — Chryzo @ 11:46

A while back, i had a proof of concept on a hyper-v virtual machine. Said machine, one day, crashed (hypothesys being that the antivirus scanned or tried to write some place not possible due to physical disk limitations). On reboot the machine would not start and the admin told me it was corrupted or something and i had lost the data of the machine.
Since the application was a POC, i did not really care but my boss was still intent on getting the data back…
So i started to take a look into how I could get the data back. So, I downloaded WinImage to read VHD files. Though I could open my file, all my data was absent :( . Searching a bit more I got an AVHD file but could not open it with WinImage. Thus I found that Hyper-V disk files are split into 2:

  • VHD: contains the image before boot of the VM
  • AVHD: contains the modifications of the VM, you may have more than one

Those files are not merged until you actually shutdown the VM… pretty annoying. To merge the files, it is pretty easy. You do not need a Hyper-V server, I was fortunate since my admin was stubborn enough to keep telling me I could not get the data back. You can simply use Virtual PC 2007 and the disk wizard utility.
Once the files were merged I was able to get the data back without any corruption whatsoevre.
And, since the VM config file was corupt, I asked the admin to reload the merged disk into a new server. Only problem is that the new server was not seen as the old one and I got into some authentification poblems with the application on the domain.

So, to end this post, if you have corrupt files, first merge the VHD and AVHD files. Check if you can open them through windows 7, server 2008 or WinImage. As for the server not rejoining the domain, I ll let some AD expert answer if it is possible or not. I think so, but I may be Wrong.

And as a last note, before increasing the size of a disk in Hyper-V, you need to merge the VHD and AVHD files!

In the hope this may help other people

April 27, 2009

LUA: Classes and Instanciations

Filed under: LUA — Tags: — Chryzo @ 21:46

If, like me, you tend to be a bottom up learner you usually never read the manuals except when you need to. And this is, for once, one of these times. Only reading the class parts of the manuals/wikis (IE: http://lua-users.org/wiki/SimpleLuaClasses and http://www.lua.org/pil/16.1.html ) is actually not really enough to be able to make classes always work as you want them to.
If you also tend to adapt examples to your requirements (no need to reinvent the wheel), here it might actually go wrong. In the examples given in the two previous link, the writers tended to forget about the differences between metatables and tables completely confounding me :) .
In the example below:

function Account:new (o)
o = o or {} — create object if user does not provide one
setmetatable(o, self)
self.__index = self
return o
end

self equals Account and the metatable of Account is also Account which creates an infinite loop which needs to be treated if you try to save / dump the instanced variables.
To solve this, use instead the following syntax:

function Account:new (o)
o = o or {} — create object if user does not provide one
setmetatable(o, {__index = self})
return o
end

When you retrieve the saved variables don’t forget to set the metatables to what they should be too :)

And if I am totally wrong in what I just posted, I ll be glad to be corrected. I really do have a hard time with the Lua OOP model, guess I still have lots to read / learn.

April 18, 2009

WordPress Xslt Processor plugin – follow up

Filed under: PHP — Tags: , , — Chryzo @ 08:05

So, a user of the plugin asked me on how to make the plugin also have parameters for the xsl file. And I ended up coding it because it seemed simpler that way.

This this post servers as much as a test bed as a presentation of the different kind of options one can use:

So lets start with the most basic way to use this plugin:

Use:

[XmlProcessor wp-content/plugins/CPT_XslProcessor/example]

Result

[XmlProcessor wp-content/plugins/CPT_XslProcessor/example]

or:

[XmlProcessor xml=”wp-content/plugins/CPT_XslProcessor/example.xml” xslt=”wp-content/plugins/CPT_XslProcessor/example.xsl”]

Result:

[XmlProcessor xml="wp-content/plugins/CPT_XslProcessor/example.xml" xslt="wp-content/plugins/CPT_XslProcessor/example.xsl"]

Now, lets say you want to add options to the xsl file:

Use:

[XmlProcessor wp-content/plugins/CPT_XslProcessor/example params=”default_param=this is the replaced default parameter”]

Result:

[XmlProcessor wp-content/plugins/CPT_XslProcessor/example params="default_param=this is the replaced default parameter"]

or:

[XmlProcessor xml=”xml_filepath” xslt=”xslt_filepath” params=”default_param=this is the replaced default parameter”]

Result:

[XmlProcessor xml="wp-content/plugins/CPT_XslProcessor/example.xml" xslt="wp-content/plugins/CPT_XslProcessor/example.xsl" params="default_param=this is the replaced default parameter"]

And that should actually be working now :)

April 7, 2009

LUA and overloading

Filed under: LUA — Tags: — Chryzo @ 21:27

I am coding some mod in LUA for some game and I hit a snag and it actually took me quite some time to solve it due to several functionalities not available through LUA to control some of the interface elements and thus transformed the snag into lots of small snags to get what I wanted to work.

But the last snag I hit, after clearing the others, was really annoying, in the API there was a function like: removeSmthg(ID) but also removeSmthg(NAME). And being unfamiliar with the language as always I forgot that LUA doesn’t handle type-based function overloading, so only one of the function actually worked… the one I was not using. Once I found that out, it ended up being quite easy to actually do what I wanted at the start.

And because it is blogged, I should remember it next time!

Older Posts »

Powered by WordPress