CVE-2020-0601 detect Windows markers

Microsoft released an update on Tuesday the 14th of January 2020, the first Patch Tuesday of 2020, to fix critical flaw discovered by the NSA in the Windows 10, Windows Server 2016 and 2019 versions of crypt32.dll, the library implementing Windows’ CryptoAPI.

Below you can find all patched files crypt32.dll descriptors.

	arch	build	kb	version	file size	Date
Windows 10	x86	none	kb4534306	10.0.10240.18452	1523080	12.12.2019 9:45:15
Windows 10	x64	none	kb4534306	10.0.10240.18452	1823656	12.12.2019 10:25:55
Windows 10	x64	1607	kb4534271	10.0.14393.3442	1855688	20.12.2019 8:10:27
Windows 10	x86	1607	kb4534271	10.0.14393.3442	1560232	20.12.2019 7:51:02
Windows 10	x86	1809	kb4534273	10.0.17763.973	49467	10.01.2020 22:51:11
Windows 10	arm64	1809	kb4534273	10.0.17763.973	113715	10.01.2020 23:14:31
Windows 10	x64	1809	kb4534273	10.0.17763.973	49467	11.01.2020 1:39:45
Windows 10	arm64	1709	kb4534276	10.0.16299.1622	1578568	12.12.2019 8:27:05
Windows 10	x86	1709	kb4534276	10.0.16299.1622	1578568	12.12.2019 8:27:05
Windows 10	x64	1709	kb4534276	10.0.16299.1622	1877440	12.12.2019 9:19:01
Windows 10	x86	1803	kb4534293	10.0.17134.1246	1659944	07.01.2020 6:48:58
Windows 10	arm64	1803	kb4534293	10.0.17134.1246	2013752	07.01.2020 6:57:50
Windows 10	x64	1803	kb4534293	10.0.17134.1246	1964176	07.01.2020 6:59:45
Windows 10	x86	1903	kb4528760	10.0.18362.592	33801	03.01.2020 21:27:41
Windows 10	arm64	1903	kb4528760	10.0.18362.592	87183	03.01.2020 23:17:43
Windows 10	x64	1903	kb4528760	10.0.18362.592	33801	04.01.2020 0:21:44
Windows 10	x86	1909	kb4528760	10.0.18362.592	33801	03.01.2020 21:27:41
Windows 10	arm64	1909	kb4528760	10.0.18362.592	87183	03.01.2020 23:17:43
Windows 10	x64	1909	kb4528760	10.0.18362.592	33801	04.01.2020 0:21:44
Windows Server 16	x64	1607	kb4534271	10.0.14393.3442	1855688	20.12.2019 8:10:27
Windows Server 16	x64	1803	kb4534293	10.0.17134.1246	1964176	07.01.2020 6:59:45
Windows Server 19	x64	1809	kb4534273	10.0.17763.973	49467	11.01.2020 1:39:45
Windows Server	x64	1903	kb4528760	10.0.18362.592	33801	04.01.2020 0:21:44
Windows Server	x64	1909	kb4528760	10.0.18362.592	33801	04.01.2020 0:21:44

Server hardware warranty info

Sometimes it’s difficult to find any service support related information. Many vendors publish warranty info on the Internet. You need just to know URL.

Lenovo

Manual request and view information: https://datacentersupport.lenovo.com/ru/ru/systemxwarrantylookup

Batch query https://datacentersupport.lenovo.com/ru/ru/warrantylookup/batchquery

EOS informatuion (End of service) linked to model and MTM info. It can be found in specific support announces.

 

IBM

All new IBM storage and old IBM server (currently known as Lenovo) available on page

https://www.ibm.com/support/home/warranty-lookup (registration required). For batch request use link

https://support.podc.sl.edst.ibm.com/support/sfrest/warranty/mt/<MachineType>/sn/<SerialNumber&gt;

note. IBM deosn’t show future support contracts until activated date. If you bought Storwize storage in 2018 with 5 year warranty included, IBM shows support 3-years contract until 2021 and after is end starts show 2years additional contract until 2023.

Server hardware failure statistics

To forecast server failure you need huge server farm statistics. Do you have thousands of servers? No? You came to the right place.

Introduction

Hardware failure is a problem with one of parts:

• disk drive;
• memory;
• power suply;
• systemboard;
• CPU;
• other

 

Here is statistics for 2008 — 2014 in 50 companies.

Google report on disk failures.

Google memory failures report.

Microsoft report on hardware reliability.

SecureCRT/Putty USB eToken auth via SSL/TLS certificate

After enabling authentication using SSH keys you may want to use certifiate on very strong and secure storage — USB token. Read the following info to be able that.

Prerequirements

Putty

It’s simple. Just use tweaked version Putty-CAC, it’s available on Github.

 

SecureCRT

In case of VanDyke product you have to enable driver support. Check if you have file C:\\Windows\\System32\\eTPKCS11.dll by exec the command (Win+R):

cmd /c dir C:\\Windows\\System32\\eTPKCS11.dll & pause

If you haven’t install SafeNet Authentication Client

 

Configuring

To provide using Aladdin USB token certificate for ssh authorization you need to edit you Session/Global Options in Options menu.

Choose «Use identity or certificate file» radio button and paste text «pkcs11key::prov=C:\\Windows\\System32\\eTPKCS11.dll»

POSTGRES queries logging

Decription

To provide security standart compliance like PCI DSS 10.2.2 (All actions taken by any
individual with root or administrative privilege), HIPAA and others all administrators actions must be logged.

To provide this requirement Postgres has mutliple options. Most company will be satisfacted with the folowing solution

Solution

This methon will sufficient if your application communicates with PostgreSQL  with dedicated user and you don’t need to log such requests.

Add the folowing parameters to your postgres.conf

log_statement = 'all'  #Log any requests
log_destination = 'stderr,syslog'  #log to file(if you need) and log to syslog
syslog_facility = 'LOCAL0' #default value

Edit your rsyslog configuration:

$EscapeControlCharactersOnReceive off # Remove special characters from log #011
*.*   @192.168.0.10:514  #send to remote rsyslog server

#### RULES ####
local0.* ~ #Don't log local, we'll send it to remote server. Should be the first rule

Alter appplication postgres user to ignore it all queries log:

Alter role APPUSER set log_statement to 'none';

 

Read log

Multiple line entries may be read with my script

cat /var/log/sql/requests.log|awk 'BEGIN{sqlid=""};{idcur=substr($6,2,match($6,"-")-2)};sqlid==idcur{for(i=7;i<=NF;++i)buf=buf " " $i};sqlid!=idcur{buf=buf "\n\n";print buf;sqlid=idcur;buf=$0;}'|grep --color user

It groups line with the same connection ID.

 

 

XID wraparound. Overflow fix manual

Intro

ERROR: database is not accepting commands to avoid wraparound data loss in database «my_database»
Hint: Stop the postmaster and use a standalone backend to vacuum that database.
You might also need to commit or roll back old prepared transactions.

If you see that message you are screwed. Your sequental transaction id (XID) growed to MAXINT.

To find out the problem table run

SELECT c.oid::regclass as table_name,
greatest(age(c.relfrozenxid),age(t.relfrozenxid)) as age
FROM pg_class c
LEFT JOIN pg_class t ON c.reltoastrelid = t.oid
WHERE c.relkind IN ('r', 'm') order by age desc;

Maximum XID is 2147483648. The closer value table have, the close database stuck moment.

If you don’t know (OMG) which database caused an error run the following script

SELECT datname, age(datfrozenxid) FROM pg_database;

Fixing

The only way to fix it is to run VACUUM on the problem table. You have some tweaks to speed up the process:

1. Remove delays in vacuum process by running before vacuum:

   set autovacuum_vacuum_cost_delay to 0;

2. Run postgres single mode

   postgres --single -D /usr/local/pgsql/data -S 10GB my_database

   Key -S specifies work-mem size.

3. Set in postgres.conf parameter vacuum_freeze_min_age to 1000000000 (1 billion). It tells postgres to reduce XID during vacuum to 1 billion, not to zero.

WARNING. VACUUM without FREEZE do not recalc indexes, so work faster.

 

Prevention

1. First of all enable autovacuum or schedule manual vacuum procedures.
2. Set parameter vacuum_freeze_table_age to less value: 10-100 millions. Posgres forces freeze recalc, when table XID grows greater than vacuum_freeze_table_age.

 

List all schema’s function code:

 psql -U postgres my_db  -c '\df+ partman.*'| \
cut -d '|' -f2,10|sed -s 's/                               //g'|less

View global avtovacuum settings:

select name, setting, unit
from pg_settings 
where name like 'autovacuum%';

Show single table avtovacuum configuration

select relname, reloptions
from pg_class where reloptions::TEXT like '%autovacuum%';

Set vacuum and analyse scale factor and threshold for a table:

ALTER TABLE piblic.log SET (autovacuum_vacuum_scale_factor = 0.1);
ALTER TABLE piblic.log SET (autovacuum_vacuum_threshold = 1000000);
ALTER TABLE piblic.log SET (autovacuum_analyze_scale_factor = 0.1);
ALTER TABLE piblic.log SET (autovacuum_analyze_threshold = 1000000);

List Postgres tables and schemas in tablespaces

select relname, nspname as schema, spcname as tablespace from 
  pg_class cl, 
  pg_namespace ns, 
  pg_tablespace ts 
where 
  cl.relnamespace=ns.oid and 
  cl.reltablespace=ts.oid and 
  relkind='r'; 

Example output:

      relname       |   schema   | tablespace 
--------------------+------------+------------
 pg_authid          | pg_catalog | pg_global
 pg_database        | pg_catalog | pg_global
 pg_db_role_setting | pg_catalog | pg_global
 pg_tablespace      | pg_catalog | pg_global
 pg_pltemplate      | pg_catalog | pg_global
 pg_auth_members    | pg_catalog | pg_global
 pg_shdepend        | pg_catalog | pg_global
 pg_shdescription   | pg_catalog | pg_global
 pg_shseclabel      | pg_catalog | pg_global

Skype system commands

Account

/showplaces — show all your skype sessions

/remotelogout — log out all your other sessions

/resynccontacts — force sync contacts

Common chat

/dumpmsnp — show your current chat status

/msnp24  — brings your chat status online. Needs skype restart

/fork [login1] [login2] […] — creates copy of chat without users login1, login2 etc