SteveOH

Tag: windows

NAS / Software and Hardware RAID Performance Benchmarking

by on Feb.15, 2009, under Technology

I recently came across an application provided by Intel for the purpose of benchmarking NAS devices (Define: Network Attached Storage).  I’ve been looking for a to benchmark the new RAID-5 array I created on my 2008 (I love the RAID’s redundancy, but the write speeds are quite low).  I wanted to get a better idea of its performance, as Windows will report 250 – 150 MB READS and 20 – 50 MB WRITES, which is considerably poor considering the 4 drives are individually benchmarked at ~100 MB READS and 60 MB WRITES (They are Western Digital Caviar Blues / RE3 / RE16).

The software can be found here or from Intel here.

Specifications:

: Windows 2008 Enterprise Edition, SP1
CPU Type: Pentium 4 630, 3000 MHz w/ Hyperthreading
Motherboard Name: Dell Dimension 8400
Motherboard Chipset: Intel Alderwood i925XE
Motherboard Frontside Bus Speed: 800 MHz
System Memory (RAM): 4 GB, Dual Channel
System Memory Speed / Timings: DDR2-533 (266 MHz) / 4-4-4-12
Controller Interface: SATA I (1.5 Gbits / s) = 150 MB/s (maximum)
Hard Drives: Western Digital

  • Drive #1 – WDC WD5002ABYS-01B1B (465 GB)
  • Drive #2 – WDC WD5002ABYS-01B1B (465 GB)
  • Drive #3 – WDC WD5000AAKS-00A7B (465 GB)
  • Drive #4 – WDC WD5000AAKS-00A7B (465 GB)
  • Drive #5 – WDC WD800BB-00JHC0 (74 GB) – SYSTEM

Raid Configuration: Software 4 disk RAID-5 (4 x 500GB, 1.36 TB Effective Storage Space)

System Memory Benchmark: Copy – 4790 MB/s, Read – 6266 MB/s, Write – 3341 MB/s, Latency – 92.7 ns
System Processor Benchmark: CPU ZLib – 10592 KB/s, CPU AES  – 3055

Benchmarks completed using Everest Ultimate Edition v4.20.1257

All drives are SATA II (3.0 GB/s) but are running in backwards-capability mode.

The primary roles of the server is to serve files and store backups (File Server) and web and application and website hosting (Web Server).  I do not stream media, play music from the server or write extremely large amounts of data that are time sensitive.  Therefore, my decision for RAID-5 was based on the space savings (n – 1) storage availability and the redundancy by means of the parity.  I am willing to give up performance (write and read) for storage space and redundancy, but I want to know how much I’m actually giving up.

Tests

  • HD Video Playback, 2x HD Video Playback, 3x HD Video Playback, 4x HD Video Playback

These benchmarks examine the behavior of the NAS unit while (simultaneously) playing one or more HD video files at 720p using Windows Media Player. Intel gives a percentage rate for the sequential reading of data in these tests, which lies at 99.5% for the HD Video Playback Test. With 2x HD Video Playback, it lies at 18.1%. The result is 6.6% with 3x HD Video Playback and 9.6 % with 4x HD Video Playback.

  • HD Video Record

This test writes an HD Video file in 720p format to the NAS unit. This test is made of up of mostly sequentially transferred data.

  • HD Video Playback & Recording

HD Video Play & Record examines the behavior of the NAS unit when simultaneously reading and writing an HD Video file in the 720p format. The sequentially-transferred data in this test is approximately 18% of the test.

  • HD 2x Playback 2x Record

This benchmark is similar to the one above, but the proportion of sequential file operations is 3%.

  • HD Playback With Office

This metric measures the data transfer rates when an HD Video file is read from the NAS unit while working with the Office applications. This test is made up of 608 files. The proportion of sequential file operations is 53.2%.

  • HD Playback With Backup

Like the previous test, but this time an HD Video file is played while simultaneously carrying out a backup on the NAS unit.

  • Content Creation

This benchmark is made up of 95% write operations to the NAS unit. This simulates the creation of files on the NAS unit such as is the case when, for example, using video editing programs.

  • File Copy To NAS / File Copy From NAS

These tests determine the data transfer rate when copying files to or from the NAS unit. In both of these test processes, a 4 GB file is copied. Unlike with Backup / Restore, 64 KB is read and written.

  • Directory Copy From NAS / Directory Copy To NAS

Similar to the previous test, files are copied to and from the NAS unit. A total of 126 files with a total size of approximately 188 MB are written and read across the .

  • Photo Album

This test determines how the NAS unit handles the supply of a multitude of small files—for example, viewing digital photographs stored on the NAS unit. It simulates the viewing of a total of 169 photographs with an overall size of approximately 1.2 GB.

Considerations and Assumptions

These tests were conducted on the Server, not over the network, which will probably result in very high throughput.  I did this to get a feel for the actual performance, not that felt over the wire, and because I’m currently running 100 Mbps (Cat 5e) on my LAN, not gigabit.  Thus, I did not want the network to be the bottleneck in these tests, as it would be saturated and skew the results.

I ran the tests 6 times, in each, manipulating the environment to establish a real world benchmark.  Since this benchmark is done via an application, it will compete with other processes for resources.  Additionally, it will compete with the actual Operating System who is responsible for transfering the data to the disk and calculating the parity for the raid (which is quite memory and CPU intensive).  For test 6 I ran the system in Safe Mode, utilizing only necessary processes and services to run the operating system (Safe Mode without Networking).  Thus, the numbers are quite high.  In the others, I ran , , browsed the internet and downloading files via torrents (to the actual RAID, so this will mess with the numbers as well) – not all at the same time, of course, except for test 4.

Results

Test 1 2 3 4 5 6 Avg MB/s
HDVideo_1Play 267.789 267.789 80.364 54.54 59.134 274.603 167.37
HDVideo_2Play 223.736 223.736 68.638 44.619 75.123 223.204 143.18
HDVideo_4Play 177.201 177.201 70.222 54.731 73.009 180.005 122.06
HDVideo_1Record 626.098 626.098 651.41 618.888 678.788 732.636 655.65
HDVideo_1Play_1Record 82.744 82.744 85.224 71.802 79.058 155.986 92.93
ContentCreation 6.199 6.199 5.983 5.628 6.141 6.022 6.03
OfficeProductivity 25.383 25.383 25.474 20.958 26.249 27.955 25.23
FileCopyToNAS 633.475 633.475 748.91 690.827 768.598 806.578 713.64
FileCopyFromNAS 147.096 147.096 79.675 57.42 80.561 151.573 110.57
DirectoryCopyToNAS 65.156 65.156 25.13 18.384 23.418 81.739 46.50
DirectoryCopyFromNAS 44.048 44.048 20.412 15.53 20.929 47.274 32.04
PhotoAlbum 27.748 27.748 26.411 19.508 28.171 29.204 26.47

Discussion

I attribute the absurd file copy speeds to caching and buffering at both the OS, RAID and the Drive level, as well as the writes for the video recording.  All in all, I’m pleased with the benchmarks and am satisfied with the set up.  One thing to note is that the tests were done from the SYSTEM drive to the RAID, and thus, the SYSTEM drive introduced an additional bottleneck as the transfers from it to the RAID were going to be quite slow (the drive is benchmarked at ~56MB READ and ~30 WRITE).

Leave a Comment :, , , , , , , , , , , , , , , , more...

ASP.NET ServerVariable Collection

by on Jan.21, 2009, under Technology

Syntax
Request.ServerVariables (_variable)
Parameter Description
server_variable Required. The name of the server variable to retrieve

Server Variables

Variable Description
ALL_HTTP Returns all HTTP headers sent by the client. Always prefixed with HTTP_ and capitalized
ALL_RAW Returns all headers in raw form
APPL_MD_PATH Returns the meta base path for the application for the ISAPI DLL
APPL_PHYSICAL_PATH Returns the physical path corresponding to the meta base path
AUTH_PASSWORD Returns the value entered in the client’s authentication dialog
AUTH_TYPE The authentication method that the server uses to validate users
AUTH_USER Returns the raw authenticated user name
CERT_COOKIE Returns the unique ID for client certificate as a string
CERT_FLAGS bit0 is set to 1 if the client certificate is present and bit1 is set to 1 if the cCertification authority of the client certificate is not valid
CERT_ISSUER Returns the issuer field of the client certificate
CERT_KEYSIZE Returns the number of bits in Secure Sockets Layer connection key size
CERT_SECRETKEYSIZE Returns the number of bits in server certificate private key
CERT_SERIALNUMBER Returns the serial number field of the client certificate
CERT_SERVER_ISSUER Returns the issuer field of the server certificate
CERT_SERVER_SUBJECT Returns the subject field of the server certificate
CERT_SUBJECT Returns the subject field of the client certificate
CONTENT_LENGTH Returns the length of the content as sent by the client
CONTENT_TYPE Returns the data type of the content
GATEWAY_INTERFACE Returns the revision of the CGI specification used by the server
HTTP_<HeaderName> Returns the value stored in the header HeaderName
HTTP_ACCEPT Returns the value of the Accept header
HTTP_ACCEPT_LANGUAGE Returns a string describing the language to use for displaying content
HTTP_COOKIE Returns the cookie string included with the request
HTTP_REFERER Returns a string containing the URL of the page that referred the request to the current page using an <a> tag. If the page is redirected, HTTP_REFERER is empty
HTTP_USER_AGENT Returns a string describing the browser that sent the request
HTTPS Returns ON if the request came in through secure channel or OFF if the request came in through a non-secure channel
HTTPS_KEYSIZE Returns the number of bits in Secure Sockets Layer connection key size
HTTPS_SECRETKEYSIZE Returns the number of bits in server certificate private key
HTTPS_SERVER_ISSUER Returns the issuer field of the server certificate
HTTPS_SERVER_SUBJECT Returns the subject field of the server certificate
INSTANCE_ID The ID for the instance in text format
INSTANCE_META_PATH The meta base path for the instance of IIS that responds to the request
LOCAL_ADDR Returns the server address on which the request came in
LOGON_USER Returns the account that the user is logged into
PATH_INFO Returns extra path information as given by the client
PATH_TRANSLATED A translated version of PATH_INFO that takes the path and performs any necessary virtual-to-physical mapping
QUERY_STRING Returns the query information stored in the string following the question mark (?) in the HTTP request
REMOTE_ADDR Returns the IP address of the remote host making the request
REMOTE_HOST Returns the name of the host making the request
REMOTE_USER Returns an unmapped user-name string sent in by the user
REQUEST_METHOD Returns the method used to make the request
_NAME Returns a virtual path to the script being executed
SERVER_NAME Returns the server’s host name, DNS alias, or IP address as it would appear in self-referencing URLs
SERVER_PORT Returns the port number to which the request was sent
SERVER_PORT_SECURE Returns a string that contains 0 or 1. If the request is being handled on the secure port, it will be 1. Otherwise, it will be 0
SERVER_PROTOCOL Returns the name and revision of the request information protocol
SERVER_SOFTWARE Returns the name and version of the server software that answers the request and runs the gateway
URL Returns the base portion of the URL
Leave a Comment :, , , , , , more...

Changing your hosts file in Vista

by on Dec.04, 2008, under Technology

By default, if you try to modify your hosts file in , it will not let you save it.  It tells you that you don’t have permission.  To successfully modify the hosts file, run notepad.exe as an administrator and open the file.

1)  Browse to Start -> All Programs -> Accessories
2)  Right click “Notepad” and select “Run as administrator”
3)  Click “Continue” on the UAC prompt
4)  Click File -> Open
5)  Browse to “C:\\32\Drivers\etc”
6)  Change the file filter drop down box from “Text Documents (*.txt)” to “All Files (*.*)”
7)  Select “hosts” and click “Open”
8)  Make the needed changes and close Notepad.  Save when prompted.

Leave a Comment :, , , more...

Squeeze Your Gigabit NIC for Top Performance

by on Nov.25, 2008, under Technology

October 24, 2007
By Charlie Schluting

Many new workstations and servers are coming with integrated gigabit (define) cards, but quite a few people soon discover that they can’t transfer data much faster than they did with 100 Mb/s cards. Multiple factors can affect your ability to transfer at higher speeds, and most of them revolve around operating settings. In this article we will discuss the necessary steps to make your new gigabit-enabled obtain close to gigabit speeds in , FreeBSD, and .

Hardware considerations
First and foremost we must realize that there are hardware limitations to consider. Just because someone throws a gigabit network card in a server doesn’t mean the hardware can keep up.

For attaining maximum throughput, the most important options involve TCP window sizes.

Network cards are normally connected to the PCI (define) bus via a free PCI slot. In older workstation and non server-class motherboards the PCI slots are normally 32 bit, 33MHz. This means they can transfer at speeds of 133MB/s. Since the bus is shared between many parts of the computer, it’s realistically limited to around 80MB/s in the best case.

Gigabit network cards provide speeds of 1000Mb/s, or 125MB/s. If the PCI bus is only capable of 80MB/s this is a major limiting factor for gigabit network cards. The math works out to 640Mb/s, which is really quite a bit faster than most gigabit network card installations, but remember this is probably the best-case scenario.

If there are other hungry data-loving PCI cards in the server, you’ll likely see much less throughput. The only for overcoming this bottleneck is to purchase a motherboard with a 66MHz PCI slot, which can do 266MB/s. Also, the new 64 bit PCI slots are capable of 532MB/s on a 66MHz bus. These are beginning to come standard on all server-class motherboards.

Assuming we’re using decent hardware that can keep up with the data rates necessary for gigabit, there is now another obstacle — the . For testing, we used two identical servers: Intel Server motherboards, Pentium 4 3.0 GHz, 1GB RAM, integrated 10/100/1000 Intel network card. One was running Gentoo Linux with a 2.6 SMP (define) kernel, and the other is FreeBSD 5.3 with an SMP kernel to take advantage of the Pentium 4′s HyperThreading capabilities. We were lucky to have a gigabit capable switch, but the same results could be accomplished by connecting both servers directly to each other.

Software Considerations
For testing speeds between two servers, we don’t want to use FTP or anything that will fetch data from disk. Memory to memory transfers are a much better test, and many tools exist to do this. For our tests, we used [ttcp](http://www.pcausa.com/Utilities/pcattcp.htm).

The first test between these two servers was not pretty. The maximum rate was around 230 Mb/s: about two times as fast as a 100Mb/s network card. This was an improvement, but far from optimal. In actuality, most people will see even worse performance out of the box. However, with a few minor setting changes, we quickly realized major speed improvements — more than a threefold improvement over the initial test.

Many people recommend setting the MTU of your network interface larger. This basically means telling the network card to send a larger Ethernet frame. While this may be useful when connecting two hosts directly together, it becomes less useful when connecting through a switch that doesn’t support larger MTUs (define). At any rate, this isn’t necessary. 900Mb/s can be attained at the normal 1500 byte MTU setting.

For attaining maximum throughput, the most important options involve TCP window sizes. The TCP window controls the flow of data, and is negotiated during the start of a TCP connection. Using too small of a size will result in slowness, since TCP can only use the smaller of the two end system’s capabilities. It is quite a bit more complex than this, but here’s the information you really need to know:

Configuring Linux and FreeBSD
For both Linux and FreeBSD we’re using the sysctl utility. For all of the following options, entering the command ‘sysctl variable=number’ should do the trick. To view the current settings use: ‘sysctl <variable name>’

  • Maximum window size:
    • FreeBSD:
      kern.ipc.maxsockbuf=262144
    • Linux:
      net.core.wmem_max=8388608
  • Default window size:
    • FreeBSD, sending and receiving:
      net.inet.tcp.sendspace=65536
      net.inet.tcp.recvspace=65536
    • Linux, sending and receiving:
      net.core.wmem_default = 65536
      net.core.rmem_default = 65536
  • RFC 1323:
    This enables the useful window scaling options defined in rfc1323, which allows the windows to dynamically get larger than we specified above.

    • FreeBSD:
      net.inet.tcp.rfc1323=1
    • Linux:
      net.ipv4.tcp_window_scaling=1
  • Buffers:
    When sending large amounts of data, we can run the operating system out of buffers. This option should be enabled before attempting to use the above settings. To increase the amount of “mbufs” available:

    • FreeBSD:
      kern.ipc.nmbclusters=32768
    • Linux:
      net.ipv4.tcp_mem= 98304 131072 196608

These quick changes will skyrocket TCP performance. Afterwards we were able to run ttcp and attain around 895 Mb/s every time – quite an impressive data rate. There are other options available for adjusting the UDP datagram sizes as well, but we’re mainly focusing on TCP here.

Windows /2000 Server/Server 2003
The magical location for TCP settings in the registry editor is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

We need to add a registry DWORD named TcpWindowSize, and enter a sufficiently large size. 131400 (make sure you click on ‘decimal’) should be enough. Tcp1323Opts should be set to 3. This enables both rfc1323 scaling and timestamps.

And, similarly to Unix, we want to increase the TCP buffer sizes:

ForwardBufferMemory 80000
NumForwardPackets 60000

One last important note for Windows XP users: If you’ve installed Service Pack 2, then there is another likely culprit for poor network performance. Explained in [knowledge base article 842264(http://support..com/?kbid=842264), says that disabling Internet Connection Sharing after an SP2 install should performance .

The above tweaks should enable your sufficiently fast server to attain much faster data rates over TCP. If your specific application makes significant use of UDP, then it will be worth looking into similar options relating to UDP datagram sizes. Remember, we obtained close to 900Mb/s with a very fast Pentium 4 machine, server-class motherboard, and quality Intel network card. Results may vary wildly, but adjusting the above settings are a necessary step toward realizing your server’s capabilities.

Leave a Comment :, , , , , , , , , , , more...

When Computer Geeks Rap Battle…

by on Nov.24, 2008, under Technology

<djahandarie> we ain’t here to do e-c-e
<djahandarie> we’re here to do c-s-e on the w-e-b
<djahandarie> listen to me spit these rhymes
<djahandarie> while i program lines
<djahandarie> and commit web accessibility crimes
<djahandarie> word, son
<http402> You talk like your big on these I-Net kicks,
<http402> But your shit flows slower than a two-eighty-six.
<http402> I’m tracking down hosts and nmap scans,
<http402> While Code Igniter’s got you wringing your hands.
<http402> Cut the crap rap,
<http402> Or I’ll run ettercap,
<http402> Grab your AIM chat,
<http402> N’ send a PC bitch-slap!
<http402> peace
<djahandarie> you’re talkin bout down hosts and nmap scans
<djahandarie> while i got other plans
<djahandarie> you’re at your new , but you can’t even do it right
<djahandarie> you just create a plight with your http rewrites
<djahandarie> i’ve been on the web since the age of three
<djahandarie> you just got on directly off the bus from mississippi
<djahandarie> respect yo’ elders, bitch
<http402> You’ve been webbin’ since three, but still ain’t grown up,
<http402> Gotta update your config and send the brain a SIGHUP.
<http402> You say you’re that old? No wonder you’re slow!
<http402> You’re knocking at the door while I run this show!
<http402> Elders my ass, you’re shit’s still in school,
<http402> Hunt and pecking at the keyboard like a spaghetti-damned fool,
<http402> Rim-riffing your like a tool,
<http402> Face it. I rule.
<djahandarie> i erase my harddrives with magnets (bitch)
<djahandarie> all you can do is troll on the fagnets
<djahandarie> and son, my brain’s wrapped in a nohup
<djahandarie> it wont be hurt by the words you throwup
<djahandarie> dont mind me while i emerge my ownage
<djahandarie> while you’re still over there apt-getting your porridge
<djahandarie> you say i’m still in school
<djahandarie> but the fact is that i know the rule
<djahandarie> cuz you need to go back to grade three
<djahandarie> and you better plea, that they take sucky from c-s-e
<http402> Time to bend over and apply a patch,
<http402> Your brain’s throwing static like a CD with a scratch.
<http402> Your connection got nuked and you’ve met your match.
<http402> You run a single like a VAX with a batch.
<http402> I’d pass the torch to a real winner
<http402> But it’d just scorch a while-loop spinner
<http402> Caught in a loop that you cant escape,
<http402> I run clock cycles around your words and flows,
<http402> Cuz your rhyme is like a PS fan: it’ blows,
<http402> Your water-cooled lyrics leak and it shows,
<http402> Take your ass back to alt.paid.for..
<djahandarie> Good god, I can’t even respond to that. :P
<djahandarie> You win haha
* http402 takes a bow

Leave a Comment :, , , , , , more...

Fix Windows MBR using Ununtu

by on Sep.10, 2008, under Technology

So, I’ve been dieing to get an LiveUSB drive to work correctly.  I’ve been semi-successful.  It will work, but once you put it on another computer it gets flakey.

Anyway, I tried utilizing the standard Ubuntu installation from the CD, which allows you to simply install to a USB Flash drive.  Great.  I was doing this on a laptop with already installed.  What the installer did, however, was overwrite the MBR of the XP installation and installed (this is standard and OK).  However, this isn’t what I needed, because the will not boot up if the USB drive is not connected – There’s no BOOT LOADER! ahh!

I tried using a Windows Installation Disk to it, however, I did not have drivers (or a floppy drive for that matter) for the SATA Hard Disk Drive (HDD) (BTW, what’s up with Windows STILL not fully supporting SATA out of the box for XP?!  Maybe it’s SP2′s fault, who knows).  So therefore, I could not use the typical fixmbr command from the Recovery Console.

To fix it I did the following.  I booted up using the Ubuntu installation on the USB drive.  Then I ran the following commands:

  1. sudo apt-get install lilo
  2. sudo fdisk -l
  3. Find the windows installation: mine was on /dev/sda
  4. sudo lilo -M /dev/sda
  5. sudo reboot 0

This will place a boot loader on the windows disk and allow it to boot, without a hitch.  No, the Windows bootloader is not installed, but it works, and you will not notice the difference.

I hope this helps.  Good luck.

Leave a Comment :, , , , , , more...

DOCman 1.4 RC3: Error Uploading. Directory Problem. *FIX*

by on Jul.11, 2008, under Technology

I have verified that this works, and that it is, in fact, a bug in the latest release.

EDIT: (8.11.08) Please make sure you change the quotes once you copy in the code.  WordPress will alter them, so you need to copy the code into your files and then delete each quote and retype it.  It should clear a lot of the PHP errors everyone’s getting, since it doesn’t know handle them, and is resulting in unpredictable behavior.

EDIT: (8.27.08) The paths to the files are as follows:

/components/com_docman/includes_frontend/upload.http.php
JOOMLA/administrator/components/com_docman/includes/files.php
JOOMLA/administrator/components/com_docman/classes/DOCMAN_file.class.php

Where JOOMLA is the root / home folder of the joomla installation (not to be confused with the root folder of the ).


Hello I’ve had the message “error uploading. directory ” with DOCman 1.4 RC3, debugged the code and found the – it is a bug in RC3:Effect:
- Error message: “error uploading. directory problem”, after step 2 of uploading a new file,Occurrence:
- with docman 1.4 RC3, (not with RC1)
- on -based webservers (directory paths with backslash)
- if in PHP configuration “magic_quotes_gpc” is set to “on”

Reason:
Bug in RC3:
“DOCMAN_Utils::stripslashes()” removes backslashes in ['tmp_name'], what should NOT be done!!
- in “com_docman/includes_frontend/upload.http.php”, Line 38
- in “com_docman/includes/files.php”, Line 177:

Solution:
In “com_docman/includes/files.php”, line 177
remove DOCMAN_Utils::stripslashes() function:
- incorrect: $file_upload = mosGetParam(DOCMAN_Utils::stripslashes($_FILES), ‘upload’);
- correct: $file_upload = mosGetParam($_FILES, ‘upload’);

In “com_docman/includes_frontend/upload.http.php”, line 38
remove DOCMAN_Utils::stripslashes() function:
- incorrect: $file = mosGetParam(DOCMAN_Utils::stripslashes($_FILES), ‘upload’);
- correct: $file = mosGetParam($_FILES, ‘upload’);

And instead: In “com_docman/classes/DOCMAN_file.class.php”, line 352
add DOCMAN_Utils::stripslashes() function:
- incorrect: $name = $file['name'];
- correct: $name = DOCMAN_Utils::stripslashes($file['name']);

For more information on ['tmp_name'] and backslashes
- see http://ch2.php.net/features.file-upload#42280 (11-May-2004 03:08)

That worked for me. :geek:

Good luck!
Benno

29 Comments :, , , , , , , , more...

ASP.NET: Accessing files on a Network Share

by on Jul.11, 2008, under Technology

Now, there are plenty of places to find resources on this issue, because it’s quite common to have to do so.  My issue, was a little different, in that there were multiple layers of (authentication and authorization) for me to access the files that were needed.  Here’s what the setup looked like:

Web -> WorkGroup -> Firewall -> Domain -> File -> Share -> SAN

As you can see, there are several are hand.  Not only do the accounts have to exist to allow for this communication (and an Administrator account is the only way to go), all sorts of permissions have to be valid for this to function (ie. Local Permissions within each OS on each Server, NTFS (file permissions) on each local server, Access permissions through the Firewall, Access permissions of Domain Resources, Local level permissions, etc).  It was a nightmare, but I believe I figured it out.

There are a few things that needed to be done in this situation.  First, the permissions on the SAN needed to allow Administrators full control.  Additionally, the local user on the file server needed to have administrative privileges, to both the and the SAN, thus allowing the network share.   Next, the firewall rules needed to allow file traffic (I can’t remember the SMB ports right now – and needs netBios and something else to let file transfers go through, as well as authentication).  Finally, the Web Server local user needs admin rights.

To get this to work, I needed everything involved to run with elevated privileges, from , to each thread in the application.  Since there was going to be a large amount of file movement, as well as resource and memory manipulation, it’s required.

Therefore, the admin credentials were inputted into IIS to map the network share from the Web Server to the File Server.  Next, I had to impersonate the admin user in each thread within the application, a pain, but the guide can be found via Google (if I have time, I’ll track them down again). Next, the machine.config needed to be modified to allow the process to run with the elevated permissions.  The web.config needs to be altered to allow impersonation with the credentials as well.

Now here’s the kicker, and something that’s not quite known but buried within ’s documentation.  For this to work (Work Group computer to authenticate to another computer) is to mirror the accounts (same username and password) on both servers (these are local accounts, not domain accounts – since the share was local on the server, the domain can be bypassed. If it were a domain resource, we would have to authenticate via NTLM to an Active Directory server, which would have been a bit more complicated).  This allows the hash sent from one system to another to be identical, and thus, you will authenticate (if you know the username and password on one workgroup computer, and it’s the same on another, chances are you’re who you say you are).

This took me a week to figure out, which was not enjoyable.  I hope this saves you some time.

Leave a Comment :, , , , , , , , , , more...

Vundo / VundoMunde / VundoMundo Trojan Removal

by on Jun.24, 2008, under Technology

So I recently got bombarded with 2 infections of this pesky beast. Some variants are easy to remove (SpyBot can simply pull them out) but the variant I came across was resilient. It loaded a DLL into the Winlogon.exe (injection) executable file (the responsible for authentication to the Operating – Windows cannot run without it) and ran from there. So you can’t kill the process, because the OS will reboot. You can’t delete the DLL file, because the OS has it locked. Basically, it’s like a tumor in the center of your brain… there’s really no winning.

There are a few solutions out there (very few) such as Bayles’ solution and this one from a poster on TechRepublic , but unfortunately, neither was any good for me. Bayles’ works for variants that inject into Explorer.exe, which is loaded once the OS is loaded and you log in. However, winlogon is loaded as one of the first steps in loading the registry, so it’s loaded even before you press control-alt-delete (it’s actually the process that shows you the login screen). The other could have worked had I had administrative privileges on my machine, but I did not (this is my work machine). Therefore, I had to find another to bypass the OS from reinfecting itself, but still have access to the underlying file system.

I could have removed the , but I did not have another laptop to install the HDD into. I couldn’t boot to the Recovery Console using an CD, because I did not know the Administrative password. So my solution? I booted the laptop using an CD I had in my laptop bag. Here’s what I did.

  1. Boot normally in Windows XP and get the names of the infected DLLs using Bayles’ method (again, pendmove won’t work because winlogon is placed in memory (with the infected DLL) before pendmove is loaded).
  2. Reboot using Ubuntu CD – hit enter at the first screen (Run or Install Ubuntu)
  3. Unmount the NTFS file system (on a typical installation, it will be the entire drive) – We do this because the standard driver file is a read-only NTFS driver.
  4. Open a terminal and install the ntfs-3g packages
    1. sudo apt-get install ntfs-3g
  5. Create mount point
    1. sudo mkdir /mnt/test
  6. Mount the hard drive
    1. sudo mount -t ntfs-3g /dev/sda1 /mnt/test
      1. /dev/sda1 – is the partition we want to mount, yours may be different
      1. /mnt/test – is the directory in which to mount the partition
  7. You can then browse to the windows/system32 directory and delete the infected DLLs (in my case the path was /mnt/test/windows/system32/sbbqikklll.dll)
  8. Reboot and then you must run some scanners. I suggest running SpyBot to clean up the rest of the garbage, and then maybe an anti-virus scanner (I used Symantec Corporate). Finally, run the Windows Malware Removal Tool.
    1. This step is extremely important. This trojan downloads other infections to your systems (ads, other programs, etc). Who knows if these other files contain other viruses, trojans, keyloggers, etc.

I hope this helps. Contact me if you need any special assistance.

Leave a Comment :, , , , , , , , , , , more...

Mount your EXT2 Partition On Windows NT/2K/XP (EXT3 too) driver

by on Jun.24, 2008, under Technology

EXT2IFSHere’s a neat little driver that allows you to mount your EXT2 partition under a wndows OS. I’ve tested this and it does indeed work.

EXT2IFS is an Installable File Driver (IFS) for NT 4.0, Windows 2000 (NT 5.0) and Windows (NT 5.1).The driver can read the Second Extended File System (EXT2) and Third Extended
File System (EXT3)

Update:

Found this recently…

Ext2Fsd

Ext2Fsd is an open source Ext2 file system driver for Windows (NT/2K/XP). “Explorer” your ext2 volumes with ease under windows systems.

Update:

Another one!
Ext2 Installable File System For Windows

It provides Windows NT4.0/2000/XP with full access to Linux Ext2 volumes (read access and write access). This may be useful if you have installed both Windows and Linux as a environment on your computer.The “Ext2 Installable File System for Windows” software is freeware.

1 Comment :, , , , , , more...

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop a comment on a post or contact us so we can take care of it!