Aleksandar's computer workshop
Let's see what Aleksandar was fixing today.
My findings, tips & tricks related to computers, internet, programming and other stuff I was working with.

Terminal Service client not using saved credentials

January 12, 2011 15:26 by Aleksandar

When connecting via Remote Desktop to Windows 2008 server it always fails with the following message:

"Your credentials did not work. Your system administrator does not allow the use of saved credentials to log on to the remote computer because its identity is not fully verified. Please enter new credentials."

This error occurs only when I try to go from domain client computer to non-domain server.

In order to fix this you have to do following:

  1. Log on to your local machine as an administrator.
  2. Start Group Policy Editor - "gpedit.msc"
  3. Navigate to "Computer Configuration\Administrative Templates\System\Credentials Delegation".
  4. Double-click the "Allow Saved Credentials with NTLM-only Server Authentication" policy.
  5. Enable the policy and then click on the "Show" button to get to the server list.
  6. Add "TERMSRV/*" to the server list. You can also put their exact server name or for example to enable the setting on all servers in "gsmblog.com" domain you can type "TERMSRV/*.gsmblog.com".
  7. Confirm the changes by clicking on the "OK" button until you return back to the main Group Policy Object Editor dialog.
  8. At a command prompt, run "gpupdate" to force the policy to be refreshed immediately on the local machine

 


Best way to practice and learn how to manage complex networks

November 29, 2010 22:43 by Aleksandar

Just use GNS3!

GNS3 is a graphical network simulator that allows simulation of complex networks.
To allow complete simulations, GNS3 is strongly linked with :

  • Dynamips, the core program that allows Cisco IOS emulation.
  • Dynagen, a text-based front-end for Dynamips.
  • Qemu, a generic and open source machine emulator and virtualizer.

GNS3 is an excellent complementary tool to real labs for network engineers, administrators and people wanting to pass certifications such as CCNA, CCNP, CCIP, CCIE, JNCIA, JNCIS, JNCIE.

It can also be used to experiment features of Cisco IOS, Juniper JunOS or to check configurations that need to be deployed later on real routers.

This project is an open source, free program that may be used on multiple operating systems, including Windows, Linux, and MacOS X.

Features overview

  • Design of high quality and complex network topologies.
  • Emulation of many Cisco IOS router platforms, IPS, PIX and ASA firewalls, JunOS.
  • Simulation of simple Ethernet, ATM and Frame Relay switches.
  • Connection of the simulated network to the real world!
  • Packet capture using Wireshark.

Some usefull links:

A lot of documentation and video tutorials http://www.gns3.net/documentation

Download page http://www.gns3.net/download

 


Certificate Signing Request (CSR) Generation Instructions with OpenSSL on Windows

April 17, 2009 19:55 by Aleksandar

To generate a CSR, you will need to create a key pair for your server. These two items are a digital certificate key pair and cannot be separated. If you lose your public/private key file or your password and generate a new one, your SSL Certificate will no longer match. You will have to request a new SSL Certificate and may be charged.
 
Step 1: Generate a Key Pair

The utility "openssl" is used to generate the key and CSR. You can download the binary from here
http://www.openssl.org/related/binaries.html
http://www.slproweb.com/products/Win32OpenSSL.html
 
Type the following command at the prompt:

openssl genrsa -des3 -out www.gsmblog.com.key 1024

Note: For Extended Validation certificates the key bit length must be 2048.
 
This command generates a 1024 bit RSA private key and stores it in the file www.gsmblog.com.key.
 
When prompted for a pass phrase: enter a secure password and remember it, as this pass phrase is what protects the private key. Both the private key and the certificate are required to enable SSL.
 
NOTE: To bypass the pass phrase requirement, omit the -des3 option when generating the private key.
If you leave the private key unprotected, access to the server should be restricted so that only authorized server administrators can access or read the private key file.


 
Step 2: Generate the CSR
 
Type the following command at the prompt:

openssl req -new -key www.gsmblog.com.key -out www.gsmblog.com.csr 



This command will prompt for the following X.509 attributes of the certificate:
 
Country Name: Use the two-letter code without punctuation for country, for example: NL, DE or US.
 
State or Province: Spell out the state completely; do not abbreviate the state or province name, for example: Flevoland
 
Locality or City: The Locality field is the city or town name, for example: Amsterdam. Do not abbreviate. For example: Saint Louis, not St. Louis
 
Company: If your company or department has an &, @, or any other symbol using the shift key in its name, you must spell out the symbol or omit it to enroll. Example: XY & Z Corporation would be XYZ Corporation or XY and Z Corportation.
 
Organizational Unit: This field is optional; but can be used to help identify certificates registered to an organization. The Organizational Unit (OU) field is the name of the department or organization unit making the request. To skip the OU field, press Enter on your keyboard.
 
Common Name: The Common Name is the Host + Domain Name. It looks like www.gsmblog.com or "gsmblog.com".
 
Certificates can only be used on Web servers using the Common Name specified during enrollment. For example, a certificate for the domain "domain.com" will receive a warning if accessing a site named "www.domain.com" or "secure.domain.com", because "www.domain.com" and "secure.domain.com" are different from "domain.com".
 
Please do not enter your email address, challenge password or an optional company name when generating the CSR.
 
A public/private key pair has now been created. The private key (www.gsmblog.com.key) is stored locally on the server machine and is used for decryption. The public portion, in the form of a Certificate Signing Request (certrequest.csr), will be for certificate enrollment.
 
To copy and paste the information into the enrollment form, open the file in a text editor such as Notepad and save it as a .txt file. Do not use Microsoft Word as it may insert extra hidden characters that will alter the contents of the CSR.



Once the CSR has been created, proceed to Enrollment.
 
Step 3: Backup your private key
 
Backup up the .key file and the corresponding pass phrase. A good choice is to create a copy of this file onto a diskette or other removable media. While backing up the private key is not required, having one will be helpful in the instance of server failure.

 

 

MAC Address Decoder

October 2, 2008 12:42 by Aleksandar

Nice online tool to identify the manufacturer by looking up the Ethernet MAC address.

http://www.techzoom.net/lookup/check-mac.en