May 2008 - Posts

SQL injection information from Harry's blog

 While the default apps on a SBS 2003 (and upcoming SBS 2008) go through a SDL process so that I'm not concerned about SQL injection possibilities on my SBS box (nor do I have SharePoint exposed anyway) when you have third party and home grown apps, you really don't know of what the coder did.

Review these and forward them on to your local dev guy to make sure they are aware of the problem. 

http://msmvps.com/blogs/harrywaldron/archive/2008/05/31/microsoft-best-practices-for-preventing-sql-injection-attacks.aspx

Microsoft has recently published a series of best practices to help developers build SQL code that is not susceptible to SQL injection attacks.

SQL injection attacks occur in applications that are poorly programmed. They are not a result of failures in the data base or supporting products.  When applications do not properly filter and control input data, there is a chance inputs can be manipulated, so that dangerous redirecting scripts may end up on the website

Once a web site is infected, the newly embedded script will then direct users to another dangerous website, that can automatically download malware on the user's PC.  While these attacks have been around for years, malware authors are now using newly automated approaches to find susceptible servers automatically and infect thousands of websites in a single day.   

IT developers have an inherent responsibility to protect the privacy and integrity of customer information. These articles are "must reads" for any IT developer, for greater assurances in building secure applications.

Microsoft Best Practices for preventing SQL Injection Attacks

Microsoft Security Vulnerability Research & Defense Blog - SQL Injection Attack
http://blogs.technet.com/swi/archive/2008/05/29/sql-injection-attack.aspx  
 
Nazim's IIS Security Blog - Filtering SQL injection from Classic ASP
http://blogs.iis.net/nazim/archive/2008/04/28/filtering-sql-injection-from-classic-asp.aspx 
 
Neil Carpenter's Blog - SQL Injection Mitigation: Using Parameterized Queries
http://blogs.technet.com/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx 
http://blogs.technet.com/neilcar/archive/2008/05/23/sql-injection-mitigation-using-parameterized-queries-part-2-types-and-recordsets.aspx 
 
Michael Howard’s Blog -Giving SQL Injection the Respect it Deserves
http://blogs.msdn.com/sdl/archive/2008/05/15/giving-sql-injection-the-respect-it-deserves.aspx 
 
MSDN Article - Preventing SQL Injections in ASP
http://msdn.microsoft.com/en-us/library/cc676512.aspx 
 
Anti-Malware Engineering Team - When SQL Injections Go Awry, Incident Case Study
http://blogs.technet.com/antimalware/archive/2008/05/30/when-sql-injections-go-awry-incident-case-study.aspx 
 
A more general overview of SQL Injection attacks can also be here:
 
What are SQL Injection Attacks?
http://en.wikipedia.org/wiki/Sql_injection

Patching Flash - Brian's excellent point

http://smbthoughts.com/2008/05/29/additional-adobe-flash-resources/

If you a MSP and you use a patching tool to deploy Flash, have you signed up for the right to redistribute Flash?

Brian makes an excellent point that you need to sign up for the right to do so.

The buzz on servers

The other day someone said that the business value they saw in SBS 2008 wasn't that Exchange was bigger (it is), wasn't that that SQL is on a separate box in premium, wasn't that if everything comes to pass with software assurance promises, that will be one killer deal, it was that the file replication/branch office stuff/multiple servers/Win2k8 ness underneath the SBS box was the killer deal. 

 He said that underneath the SBS console, was the wind2k8 server management console and that he could see a lot of potential.

There is always the struggle for the folks that don't want to trust the wizards to those that do.  For all those folks checking out the sbs 2008 RC0, remember that every time you run a wizard, it lays down a log file.  I dare you to find it and look at all the steps that wizard does.

I'll be blogging about some of my favs, but this weekend I'm off on a train to San Francisco to visit with some gal pals (and no we're not planning to go see Sex in the City or anything), so blogging will be light.

So what exactly is twitter anyway?

http://twitter.com/susanbradley (cough) someone isn' t keeping up on the fake susan bradley twittering.

So what information gets out the door of your organization through social sites?  Do you google on your firm name?  Have a google news alert?  What about www.tweatscan.com ?

http://www.tweetscan.com/index.php?s=sbs+2008&u=&d=

Yup people even tweet about downloading SBS 2008...

Someone was asking what is Twitter and I said Twitter is a micro blogging site where you post little snippits of what you are doing to the site.

People either get it, or they don't.

Posted by THE OFFICIAL BLOG OF THE SBS "DIVA"
Filed under:

4 gigs is truly the minimum

Windows Small Business Server 2008 RC0 - First Impressions » Lukas Beeler’s IT Blog » Blog Archive:
http://projectdream.org/wordpress/2008/05/30/windows-small-business-server-2008-rc0-first-impressions/

Lukas FYI... when they say 4 gig minimum...they mean 4 gig minimum. IMHO 4 gig is the old 512 memory.. you'll want more than 4 gig.

And regarding UAC ... on a server Amy will say leave it on, I say I won't freak if you adjust the setting to silently elevate but DO NOT disable UAC.  Leave it on, but let it silently elevate.

P.S. POP is still there... it's even better now (sigh it will retrieve every 5 minutes) but the wizard does try to push you to a port 25 setup for sure.

The beta process

The WSSG Community Lead Blog : Thoughts on Sean's post on Community Strategy; Are you Company-Centric or Customer-Centric?:
http://blogs.technet.com/kevin_beares/archive/2008/05/19/thoughts-on-sean-s-post-on-cummunity-strategy-are-you-company-centric-or-customer-centric.aspx

Some bugs you win, some you lose.

One that is in RC0 thanks to the folks on the activedir listserve that inspired it is the registry key value of DSRMAdminLogonBehavior.  You can read more about it here:

Windows Server 2008 Restartable AD DS Step-by-Step Guide:
http://technet2.microsoft.com/windowsserver2008/en/library/caa05f49-210f-4f4c-b33f-c8ad50a687101033.mspx

At the end of the day everyone who is a beta tester has to remember and understand that Microsoft makes the final decisions.  And sometimes, it's not the developers, nor the support folks but higher up in the food chain that makes the final call.  And it sure isn't anyone that folks call "the MVPs" making final decisions.

Sometimes things get cut.  Take SCE.  I still say if I were in charge of the Universe that I would include SCE as a bonus in SBS 2008 premium and not be preconfigured.  Or perhaps hook it to var/vap/ Open License sales or something.  But to talk about SCE for two years after TechEd 2005, granted even though when it was first on the box I was freaking out as it was sucking down about 2 to 3 gigs when it was idling.  But I still don't think that it should have been talked about for so long and then removed completely.  I still think that SCE's developers should be locked in a room with nothing but Mountain Dew and forced to code on a 2 gig server or something, but that's just my wacko opinion.

But at the end of the day you bug some, you win some, you don't win others.  Life goes on.

It's just code.  Life is too short to take it personal.

About that cloud....

Some online backup services insecure - heise online UK:
http://www.heise-online.co.uk/news/Some-online-backup-services-insecure--/110771

Does the cloud have maintenance windows that match your needs for maintenance?

Read that.  The Cloud has issues.  Be aware of that.

Cute Crall... real cute...

SBSC & MSP Buzz » Blog Archive » Hi Hilton!:
http://sbsc.techcareteam.com/archives/230

...to Mark Crall...the photo in question for you to obtain in Houston at the WWPC is you and Hilton from Australia...not Paris Hilton....

Nice try dude.

Posted by THE OFFICIAL BLOG OF THE SBS "DIVA"
Filed under:

Patch your Flash

Adobe Product Security Incident Response Team (PSIRT): Potential Flash Player issue - update:
http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue_u_1.html

UPDATE: We've just gotten confirmation from Symantec that all versions of Flash Player 9.0.124.0 are not vulnerable to these exploits. Again, we strongly encourage everyone to download and install the latest Flash Player update, 9.0.124.0. To verify the Adobe Flash Player version number, access the About Flash Player page, or right-click on Flash content and select “About Adobe (or Macromedia) Flash Player” from the menu. Customers using multiple browsers are advised to perform the check for each browser installed on their system and update if necessary.

(If you need Kaseya advice got to the K forums or check out http://tech.groups.yahoo.com/group/SMBManagedServices/message/19999)

Vmware settings for SBS 2008

On VMware Workstation I used Win 2k8 64bit Expermental template as is.

I pointed the cdrom to the location of the ISA rather than using a burned in cdrom (it loads faster that way)

I gave it a 60 gig harddrive

4 gigs of ram (this box has 6 gigs total, and another 1 gig is for a Virtual Vista)

Bridged NIC

Two processors and everything else plain vanilla

 

HyperV can be used and you have to use legacy nic.  I'll see if I can steal a post from Charlie Russel on the HyperV how to.

But that's the basic vmware workstation setup that I did to run SBS 2008 on a virtual setup.

SBS 2008 RC0 is now public

Designed for small businesses, Windows Small Business Server 2008 is an affordable, integrated server solution that helps you protect your business data, increase productivity and present a more professional image to customers – giving you the tools you need to help grow your business capacity.

Windows Small Business Server 2008 Technical Library:
http://technet.microsoft.com/en-us/library/cc527559.aspx

Windows Small Business Server TechCenter:
http://technet.microsoft.com/en-us/sbs/default.aspx

Yup got a red security... no a/v yet on the vmware Vista.

Ligman pulls a fast one

Microsoft SMB Community Blog : UPDATED: Not yet waitlist applicants only for WPC:
http://blogs.msdn.com/mssmallbiz/archive/2008/05/27/8554221.aspx

Wanting to tempt me... working with Hilton to set up a Texas brawl...uh huh Ligman nice going there.

Well the good news is that WWPC/Houston is not sold out so you have time to still book and say Hi to Hilton for me.  Give him a hug even.

 In fact do me a favor.. if you are going, get a picture with Hilton and send it to me at susan-at-sbslinks.com.  I want to see how many SBSC's can say Hi to Hilton on my behalf!

Posted by THE OFFICIAL BLOG OF THE SBS "DIVA"
Filed under:

Windows network impact on Apple updates


About the Mac OS X 10.5.3 Update:
http://support.apple.com/kb/HT1141

  • Improves Safari reliability when connecting to the Internet through a Microsoft ISA proxy.
  • Improves Active Directory binding and login.
  • Eliminates a delay when logging in as an Active Directory user in a .local domain.

I'd like a hotdog with the telephone please?

I am just the message carrier: RP on Costco.om « SMB Dude:
http://harrybrelsford.wordpress.com/2008/05/28/i-am-just-the-message-carrier-rp-on-costcoom/

Next time you are in Costco see if your local one is selling Response Point.  Harry Brelsford's blog today posts the info about RP in Costco.

Posted by THE OFFICIAL BLOG OF THE SBS "DIVA"
Filed under:

Waiting list for Houston

http://blogs.msdn.com/mssmallbiz/archive/2008/05/27/8554221.aspx

For those of you wanting to go to Houston, if you sign up now you'll be put on a Waiting list.  And not that anyone is interested, but just in case you are, no, I didn't sign up.  And for those wondering, no it's not because Hilton and I threatened to get into a wrestling match in person (heck, we even ate next to each other in Sydney and I've hugged him).  So it's not like I'm avoiding the State of Texas just because Hilton will be in the vicinity or something ;-)

I looked at the speakers and the topics and I honestly just couldn't see where I gain value out of the topics for me and my firm.  As far as Karl's point about the meetings in the hallways, WWPC is a big venue and unfortunately all I end up doing in large venues is clumping in the corners with people I already know.  I know there are folks that say "Well MVPs always pal around together at conferences and never interact with anyone else", okay so I'm not a wallflower, but some of my fellow SBS MVPs are sometimes shy in gatherings, some of us only see each other once a year so sometimes we're catching up with each other, it's not something that any of us do on purpose and so I cringe when the word "the mvps" is said sometimes to describe how several of us that are friends and that also hold that designation also end up clumping together in the corner of a room.

And last but not least, I'll be brutally honest, I couldn't justify the dollar value for me.  When there are conference and venues that can be declared as Continuing Professional Education for my firm, the firm pays, when it's an event that is more of a social get together, I can't justify asking my firm (where I'm a partner) to pay.  So I pay for such social conference events out of my "mad" money, you know the fees and such I get from writing articles and chapters here and there.  When it comes right down to it, like I said to Mark Crall in an earlier blog post, I'm cheap.  And when you pay for it and not on the corporate expense account, the decision making gets tougher. 

Okay so all of this is justifying to myself why I just couldn't justify to myself the time away, the travel costs, the hotel and the fee.  Bottom line, I couldn't justify going to sessions on seeing the value in the SMB market and the future ahead for the SMB space because not only am I helping Microsoft with that future, I'm having to make real world decisions about that future.  I don't need to hear about the potential and future of the SMB markeplace, I'm living it now.

This year I am looking for something a bit different in venues and content and with my Dad still not up to 100% full walking and all that, still have to stay a bit close to home base as well.

Does this mean it doesn't have value since I couldn't justify it for me this year?  Absolutely not.  I'm definitely not your ordinary Microsoft SBSC Partner for sure.  And absolutely make sure that you take advantage of all the social networking and connnection tools that Microsoft ensures are in place for these venues.  Make the connections and in particular be sure you visit the SBSC lounge and introduce yourself to the SBSC representatives there.  Say hello to Chris Rue for me.  Welcome the new SBSC Pals that will be coming into the fold on July 1.  I've already seen a few blogs around announcing the new Pals.

So just be prepared to blog and twitter about it while you are there.

Oh yeah,, and say Hi to Hilton for me....

Posted by THE OFFICIAL BLOG OF THE SBS "DIVA"
Filed under:

The Windows Small Business Server 2008 WW Community Survey is live

The Windows Small Business Server 2008 WW Community Survey is live

The SBS, Windows Essential Business Server and Windows Home Server Community Lead Blog : The Windows Small Business Server 2008 WW Community Survey is live:
http://blogs.technet.com/kevin_beares/archive/2008/05/23/the-windows-small-business-server-2008-ww-community-survey-is-live.aspx

This is the third year we have published an SBS WW Community Survey to the SBS Community. 

We have learned an amazing amount of information from the people who have taken the time to tell us what they thought. Some things we kind of knew already, but other things were not as clear before we had received the feedback.Because of the previous surveys, we have made some adjustments in our community engagement. To name a few; we really worked on putting more focus on the Official SBS Blog. Our Sustaining Engineering team runs mini betas with our MVPs before KB's and Bug Fixes are released via Windows Update. We try to get more involvement in our techbetas from our User Groups. The list does go on.To the survey, the SBS Product Team would like to hear from the Windows SBS Community again. This survey is completely anonymous. In fact, some of you may have to sign out from Live in order to take the survey. So, if you get a PAGE NOT FOUND error message, please log out of Live and click on the link to the survey again.We want to know how valuable your experience is with the community resources and information that is available to you today as a member of the Windows SBS Community. We also want to know what you think could be done to improve your Windows SBS Community Experience. Please take a couple of minutes to provide us your candid feedback via this survey and let us know what you think. SBS WW Community Survey 2008 Thanks in advance for your feedback.

 Kevin Beares
Community Lead – WSSG

Posted by THE OFFICIAL BLOG OF THE SBS "DIVA"
Filed under:

Who's logged in?

http://technet.microsoft.com/en-us/sysinternals/bb897545.aspx

Before I reboot the server.... who's logged on and in a file?

Don't know the answer to that?  Try PSloggedon from the Sysinternals gang.

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator.KIKIBITZRTM>cd\

C:\>cd pslogged

C:\pslogged>psloggedon

loggedon v1.33 - See who's logged on
Copyright ⌐ 2000-2006 Mark Russinovich
Sysinternals - www.sysinternals.com

Users logged on locally:
     Error: could not retrieve logon time
NT AUTHORITY\LOCAL SERVICE
     Error: could not retrieve logon time
NT AUTHORITY\NETWORK SERVICE
     Error: could not retrieve logon time
KIKIBITZRTM\SBS Backup User
     Error: could not retrieve logon time
KIKIBITZRTM\QBDataServiceUser17
     5/23/2008 10:57:28 PM    KIKIBITZRTM\Administrator
     Error: could not retrieve logon time
NT AUTHORITY\SYSTEM

Users logged on via resource shares:
     5/26/2008 11:50:02 PM    BITZIEMEDIA\BITZIE

C:\pslogged>

Now if I can find a script or PowerShell to tell me if that user has a file open before rebooting the server.  I'll report back if I find it.

Posted by THE OFFICIAL BLOG OF THE SBS "DIVA"
Filed under:

Email is broken

On the continuing thread of "Email is broken" is the latest saga in my continued attempt to keep my sbradcpa-at-pacbell.net email address.  I used to have sbradley-at-ix.netcom.com (yes I'm that old on the Internet) and then when Pacific Bell offered dial up and later DSL I signed up for the pacbell.net alias.  But lately their attempts to clean up the spam issue has nearly made the email address unusable.

People can't email me and have to use the contact box on the blog to email me when their email is blocked.

Subscriptions that I've signed up for are bouncing.

I write for windowssecrets.com and I pay for a paid subscription (just so I can keep track of when the articles go out the door and what they look like after final edits). So here is a subscription I pay for that is bouncing because SBCGlobal/Yahoo/Pacbell's attempt to de-spamify my malbox ends up with email bouncing.

Dear AT&T Yahoo, whatever you've done, it's not working.  Oh and I am using ssl connections so I'm not sure what they are talking about.

 
Dear AT&T Yahoo! Customer:

We noticed that you are accessing email using non-secure settings in your email software.

We would like to ensure that your AT&T Yahoo! Member ID, password, and email messages are transmitted securely between your mail software (such as Outlook or Outlook Express) and the AT&T Yahoo! Mail servers. In order to meet this need, please enable SSL via the instructions that are available on the Help site.

Since multiple email notifications have already been sent out about this, we request that you please make the necessary changes immediately. Remember, you need to make these changes if you want to continue to send/receive email using a mail client.

Thank you for your cooperation,

AT&T Yahoo! Customer Support

More Posts Next page »