I’ve been out of the Microsoft/Windows world for a fair bit of time – my primary work machine is an M1 MacBook Pro, I spend at least part of my day in some type of Linux terminal, and while I do have a personal Lenovo T14 laptop and a desktop running Windows 11, it’s mainly to run “Chrome” or “game” or “Office” and the underlying operating system matters much less.

A few months back, though, I picked up a couple Samsung 970 EVO Plus NVMe M.2 solid-state drives on sale, and took the opportunity for a fresh installation of Windows. My additional hope was that the new installation (on a desktop with a Core i9-9900K, 32GB RAM, GeForce GTX 1080 Ti) would actually seem performant, like I recall used to be possible on reasonable hardware in the Win2K/WinXP/Win7 days. On the desktop, a not-unreasonable number of tabs would often result in a text editor or browser, and so starting clean on a fairly performant SSD, then reviewing the latest hivemind guidance for security and performance seemed like it would be worthwhile.

I did remind myself that crucially, when I was running Win2K Pro, I also didn’t have a pair of 4K-resolution monitors running at 150% scaled resolution; at best I was doing 1280×1024 on a Sony Trinitron (but at a much higher refresh rate!) That era of software also didn’t contain embedded Chromium or Electron components, which chew system resources as a tradeoff for ease of development and cross-platform functionality.

I also expect that most of my tasks for this machine absolutely could be done on Linux – it is probably worthwhile to set up another SSD with a recent desktop distribution and a lightweight window manager – but desktop Office and video games are things I want to actually do with this machine.

What follows are a few notes that got me along the way as well as some personal opinions on why I made certain choices.

Continue reading

I’ve been trying desperately to catch up on my personal email these past couple months, since it’s rare (with the addition of two babies to our family) to have large uninterrupted blocks of time in which to hack. One of the recurring messages has been a “high CPU” notice from Linode every few days. In my experience this can mean a variety of things, ranging from “your site got quite a few visitors in a short timeframe” to “the backup process is going wonky” to “someone hacked your box and is trying to use it to mine cryptocurrency.”

Rather than put a whole bunch of time into investigating the root cause, I know the system needs an entire OS upgrade and we’re running a bunch of services that are no longer in use like IRC and Jabber servers – these have been replaced, at the cost of our freedom-as-in-speech, with Slack.

So, in the spirit of “cattle, not pets”, my goal is to decommission the Linode VM and move into AWS, and automate as much as I can while doing it. Having the suite of services all in one place is ideal even on a $20/month budget, and there are a number of services like Lambda, IAM, Parameter Store and DynamoDB where I could make good use of them and never pay anything directly.

Many of the people I support with web hosting aren’t willing or able to give up WordPress, so we’ll have to maintain that capability, but I’d also like a migration path for myself to a static site generator that publishes to S3/CloudFront. The best server is one you don’t have to run yourself.

Continue reading

My employer recently divested themselves of some end-of-life hardware and several of my coworkers and I came into the possession of Lanner FW-8758 1U “network appliances”. These seemed like they’d make pretty good Linux servers, and I figured I’d document a little bit about the platform and process.

My other home servers are currently a Supermicro 5017C-MF and an IBM x3650 M2, which are both quite noisy. The FW-8758 has four small system fans plus a PSU fan, which together still seem somewhat quieter than the Supermicro. I haven’t put the system under any serious load yet though.

Continue reading

Apparently Microsoft has pulled down the necessary hotfix to disable automatic scheduled maintenance shortcut deletion (eg: if you have multiple unused or “broken” desktop shortcuts) from KB2642357. This has affected me in an environment where a number of users link to applications, folders or files on network drives.

I republish the x64 version of the hotfix so you can use it where necessary, then set the “IsUnusedDesktopIconsTSEnabled” and “IsBrokenShortcutsTSEnabled ” DWORDs to 0x0 in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ScheduledDiagnostics Registry key and avoid this spurious behaviour that I’d once written off as user error.

Windows6.1-KB2642357-x64.msu (enclosed in ZIP file)

I spent most of my Labour Day trying to accomplish two tasks with an EdgeRouter 4 and the other miscellaneous networking gear in the house: setting up a simple VLAN and getting my backup DSL connection working.

Two WANs and a LAN

With two WAN connections (one DHCP/cable, one PPPoE/DSL), I wanted to have specific local network ranges send traffic out to (and receive forwarded traffic from) a specific WAN connection. Note that this isn’t quite the load balancing feature (which I don’t want), but moreso “IP range A uses cable, IP range B uses DSL”. I went through the gauntlet of EdgeRouter support articles and forum posts without much success:

• https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Policy-based-routing-source-address-based- – this somewhat worked, but interrupted connectivity for the “default” route, so I had to revert the changes.
• https://community.ubnt.com/t5/EdgeRouter/Dual-WAN-with-failover-default-route-from-local/td-p/1961389
• https://community.ubnt.com/t5/EdgeRouter/PPPoE-default-route-missing/td-p/749638
• https://community.ubnt.com/t5/EdgeRouter/multi-WAN-for-beginner/td-p/1169440
• https://community.ubnt.com/t5/EdgeRouter/Questions-about-Edge-Router-Pro-and-MultiWAN/m-p/799144#M28614
• https://community.ubnt.com/t5/EdgeRouter/PBR-and-NAT-WAN-DHCP/td-p/2126792
• https://community.ubnt.com/t5/EdgeRouter/clear-guide-on-Dual-Wan-Port-Forwarding/td-p/2155541
• https://help.ubnt.com/hc/en-us/articles/205231700-EdgeRouter-Destination-NAT
• https://community.ubnt.com/t5/EdgeRouter/Source-NAT-SNAT-with-PPPoE/td-p/1886171
• https://help.ubnt.com/hc/en-us/articles/204976494-EdgeRouter-Source-NAT

I haven’t yet solved the problem, but I believe the issue is related to the PPPoE connection not injecting default routes into the main table (hence the need for policy-based routing), plus my second SNAT rule didn’t seem to match traffic. The PPPoE connection has a very volatile dynamic IP address, so source NATing based on address translation rather than masquerade wouldn’t work.

In any event, I’m sure this will be another weekend problem, but it was compounded by…

Continue reading

For future reference when I inevitably forget whether it is more appropriate to restrict folders with NTFS permissions (Security tab) or file share permissions (Sharing tab).

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754178(v%3dws.10)

“For example, some experienced administrators prefer always to set share permissions to Full Control for Everyone, and to rely entirely on NTFS permissions to restrict access.”

Relevant table of examples:

Folder type	Share permissions	NTFS permissions
Public folder. A folder that can be accessed by everyone.	Grant Change permission to the Users group.	Grant Modify permission to the Users group.
Drop folder. A folder where users can drop confidential reports or homework assignments that only the group manager or instructor can read.	Grant the Change permission to the Users group. Grant the Full Control permission to the group manager.	Grant the Write permission for the users’ group that is applied to This Folder only. (This is an option available on the Advanced page.) If each user needs to have certain permissions to the files that he or she dropped, you can create a permission entry for the Creator Owner well-known security identifier (SID) and apply it to Subfolder and files only. For example, you can grant the Read and Write permission to the Creator Owner SID on the drop folder and apply it to all subfolders and files. This grants the user who dropped or created the file (the Creator Owner) the ability to read and write to the file. The Creator Owner can then access the file through the Run command using \\ServerName\DropFolder\FileName. Grant the Full Control permission for the group manager.
Application folder. A folder containing applications that can be run over the network.	Grant Read permission for the Users group.	Grant Read, Read and Execute, and List Folder Content permissions to the Users group.
Home folders. Individual folders for each user. Only the user has access to the folder.	Grant the Full Control permission to each user on their respective folder.	Grant the Full Control permission to each user for their respective folder.

Users with the official Microsoft Outlook client on Android or iOS kept running into ~36MB size limits when attempting to send attachments (given the megapixel sizes of most cell phone photos, this can amount to 3 to 4 pictures attached and the whole message is rejected), and none of the conventional transport/mailbox maximum size settings were the cause. I’m hoping the changes in the following articles are the fix:

• Message size limits in Exchange 2016
• Configure client-specific message size limits

The settings I specifically believe are responsible are:

• maxAllowedContentLength in %ExchangeInstallPath%FrontEnd\HttpProxy\ews\web.config
• maxAllowedContentLength and maxReceivedMessageSize in %ExchangeInstallPath%ClientAccess\exchweb\ews\web.config
• maxAllowedContentLength and maxRequestLength in %ExchangeInstallPath%FrontEnd\HttpProxy\owa\web.config
• maxAllowedContentLength, maxRequestLength and maxReceivedMessageSize in %ExchangeInstallPath%ClientAccess\Owa\web.config

I’ve been arguing with an Exchange 2016 server lately, due to what I suspect is a dodgy IBM-badged MR10i RAID controller in a x3650 M3. It has been kicking disks that seem entirely fine out of RAID1 volumes, which effectively has the same side effect as losing a disk. I intend to publish a few posts with some of the links and practices I’ve used lately.

Original article: How to install LSI MegaRAID Storage Manager (MSM) on ESXi 5.5

The original, excellent instructions from Mike Smith at Serenity-Networks, despite being for ESXi 5.5, seemed to work with some minor adaptations for ESXi 6.5.0 Update 1 (Build 5969303), with the latest versions of software from Avago (Broadcom).

Enable SSH on ESXi host: From the web UI, in the Navigator column, select Host, then choose Actions > Enable Secure Shell (SSH):

Adjust the “acceptance level” to allow installation of unsigned VIB files: In the Navigator column, select Manage, then select the Security & users tab. Then, click the Edit settings button and choose Community.

Get the LSI downloads (SMIS provider and the latest MegaRAID MSM): I found filtering by OEM did not successfully show results. On the Broadcom website, I selected the following categories for download:

• Group: Storage Controllers, Adapters and ICs
• Family: Storage Controllers, Adapters and ICs
• OEM: (left blank – showed up as ‘OEM’ in the search interface)
• Product: All
• Asset Type: Management Software and Tools

There were 679 results; I used Ctrl+F and searched for “SMIS”, which offered a link titled “Latest SMIS Providers” for VMWare 6.0 and 6.5: https://docs.broadcom.com/docs/VMware_MR_SAS_Providers-00.67.V0.04.zip

Then I also used Ctrl+F and searched for “MegaRAID Storage Manager”, which offered MSM for a variety of platforms:

• https://docs.broadcom.com/docs/17.05.00.02_Windows_MSM.zip
  (Windows x86 and x64)
• https://docs.broadcom.com/docs/17.05.00.02_Linux-64_MSM.gz (Linux x64)

Copy the LSI SMIS provider (the file with .vib extension) to the /tmp directory on ESXi host (scp/WinSCP/your client of choice). I found that my sneaky attempt at copying it to a shared volume at /vmfs/volumes/… was hit and miss; when it was a fibre channel mount, the install worked properly, but if the datastore was on a local disk, it died with an error message.

SSH to the ESXi host with appropriate credentials (I did everything as root) and run the following install command:

esxcli software vib install -v /tmp/vmware-esx-provider-lsiprovider.vib --no-sig-check

I also had to disable the firewall on the ESXi host. Bad practice, but I don’t have a list of the specific ports to open at present.

esxcli network firewall set --enabled false

Reboot the ESXi host when complete. You can and probably should do the usual behaviour of taking it into maintenance mode, but in my case everything shut down and came up cleanly as VMWare Tools was installed on each guest.

It was hit and miss as to whether I had to add the line from /etc/hosts on the ESXi server with the hostname to my Windows box. I found that eventually creating both A and PTR records in Active Directory DNS, combined with turning off the ESXi firewall, were sufficient to get the MSM client on a domain-joined Windows server to connect – not even necessarily a guest VM on the same hypervisor.

I also had to change the MSM client settings in the Configure Host dialog to “Display all of the systems in the network of local server”, and not the “ESXi-CIMOM” option:

I had a Windows Server Update Services installation that after a reboot, failed to start the WSUS service with a fairly generic error message. Clients issued an “unable to check for updates” message with an 8-character hex error code, differing depending on the client OS.

To fix it, I followed the directions in this source article on vcloudnine.de: WSUS on Windows 2012 (R2) and KB3159706 – WSUS console fails to connect

• Run elevated Command Prompt and issue the following command:"C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall /servicing
• Ensure the “HTTP Activation” feature is installed, using Server Manager > Add Roles and Features > Features > .NET Framework 4.5 Features. In my case, it was already installed.
• Restart “WSUS Service” from services.msc