Contact

Subscribe via Email

Subscribe via RSS/JSON

Categories

Creative Commons Attribution 4.0 International License
© Rakhesh Sasidharan

[Aside] Registry keys for Enabling TLS 1.2 etc.

Came across via this Exchange blog post. 

  • Registry keys for enabling TLS 1.2 as default as well as making it available if applications as for it. Also contains keys to enable this for .NET 3.5 and 4.0. 
  • Registry keys for disabling TLS 1.0 and 1.1. 

None of this is new stuff. I have used and seen these elsewhere too. Today I thought of collecting them in one place so I have them handy. 

Etisalat blocks outgoing port 25

There, I’ve said it. Hopefully anyone else Googling for this will find it now!

I spent a better part of yesterday checking all my firewalls because I couldn’t connect to port 25 of public mail servers from my VM. As a SysAdmin I have an Exchange VM etc. in my home lab that I wanted to setup for outgoing email … and when I couldn’t connect to port 25 I wondered whether there was something wrong with my network configuration or firewalls (being a VM there are layers of networking and firewalls involved). Turns out none of these is the case. My host itself cannot connect to port 25. The ISP is blocking it – simple!

This is Etisalat at home. Things might be different for business connections of course. And, this is nothing against Etisalat – many ISPs apparently do this to block spam, so this is standard practice. First time I noticed that’s all. 

Edge Subscription process (and some extra info)

It’s documented well, I know. This is just for my quick reference. 

To create a new edge subscription, type the following on edge – 

Copy the file to a Mailbox servers (just one is fine, the rest will sync from this). Then – 

Change the file paths & site etc. as required. To remove edge subscriptions, either on Edge or on Mailbox – 

To set the FQDN on the outgoing (send) connector in response to EHLO do this on the Mailbox server – 

If you want to change the incoming (receive) connector name run this on the Edge server – 

You can find the certificates on the Edge server via Get-ExchangeCertificate. To use one of them as the certificate for the SMTP service do – 

That’s about it I think. 

Assigning and viewing NSX Security tags via PowerShell / PowerNSX

I have a bunch of VM names in a text file. I want to assign an NSX Security tag to all of them. 

To get the NSX Security tags of a bunch of VMs in a text file (so u can confirm the above worked):

These require PowerNSX BTW. 

I had to do the same for a bunch of VMs in a folder too:

Lastly, to find all VMs assigned a security tag:

PowerShell snippet to get the name of each attached monitor

Needed to create this for a colleague. Get the names of attached monitors via WMI/ PowerShell. 

The Get-WmiObject WmiMonitorID -Namespace root\wmi cmdlet returns output like this for each attached monitor:

The Name etc. is in ASCII code so we have to take the numbers, convert to [char], and join them to get the name. Here’s what it looks like. I have to remove the 0 and concatenate the rest.

So that’s what the first code snippet does. At the end of the pipeline I do a -join “;” because my colleague wanted it semi-colon separated per monitor but that’s optional. 

Bluetooth stutters? Use wireless!

I prefer Bluetooth keyboards and mice to wireless ones because that’s one less adapter worry about. Most keyboards & mouse I used so far were wireless though as that’s popular but after switching to the Mac I invested in a Bluetooth keyboard, Apple Trackpad, and a mouse. The former two work fine but the latter (mouse) isn’t perfect. It works fine mostly but I guess I am sensitive, I can notice a lag with it at times. Initially I tried increasing the sensitivity, moving away USB 3 devices and hubs so they don’t cause any interference … but nothing helped. The mouse was fine about 80% of the time but the 20% where it would stutter began driving me crazy. The issue could be the mouse, or the Bluetooth, and so I bought a Logitech MX Master 2S mouse (saw some great reviews of it) and tried it out today. 

With Bluetooth this one too was stuttering. I guess it’s the angle of my usage. I tend to keep my wrist slanted away from the MacBook so maybe the range is getting cut off? I don’t know. Good thing about the MX Master 2S (and one of the reasons I bought it) is that it comes with a wireless receiver too so I switched to that to see if it makes a difference. And yup, HUGE difference! Now the mouse works as expected. 

On that note, the MX Master 2S is a great mouse for your Mac. It’s got 7 buttons, and you can download the Logitech Options software to customize these. I already had SteerMouse but I decided to go with the Options software as that’s more customized for Logitech. You can customize these 7 buttons to do gestures etc – show launchpad, move desktop spaces, the works! A good investment. 

When I started off with the Mac I had a keyboard, trackpad, mouse, and headphones paired via Bluetooth. I switched the headphones to wired as the audio would stutter or when playing audio the trackpad or mouse would stutter. Now I moved the mouse to wireless. Hopefully the Bluetooth can handle the trackpad and keyboard, else I’ll have to connect the trackpad via cable. Sucks that Bluetooth can’t handle the large number of devices. 

Outlook auto-discover & DNS weirdness

It’s 2am and I spent the last 2-3 hours chasing a shitty problem in my home lab to which I haven’t yet found a satisfactory answer. What a waste of time (sort of)!

It all began when I enabled MAPI/HTTP on my home Exchange 2013 and noticed that Outlook (2016 & 2019) was still connecting to it via RPC/HTTP. To troubleshoot that I deleted my Outlook profile to see if a fresh auto-discovery would get it to connect using MAPI/HTTP. That ended up being a long rabbit hole!

Background: all my user accounts are of the form firstname.lastname@raxnet.global. I have autodiscovery setup via SCP (here’s a good blog post to read if you want an overview of auto-discovery) and in the past when I launch Outlook it used to give me a prompt like this – 

NewImage

– followed by this one, where I choose “Exchange” and am done. 

NewImage

Today, however, I was getting prompted for a password after the first screen and when I entered the password it complained that the password was wrong. Moreover, I noticed that it was trying to connect via IMAP and picking up an external IMAP server for this domain (the domain raxnet.global is setup externally too with IMAP auto discovery in the form of SRV records for _imaps._tcp.raxnet.global). That didn’t make sense. All my internal clients were pointing to the internal DC for DNS, and this DC had the raxnet.global zone with itself so there was no reason why queries should be going to the Internet.

NewImage

 

NewImage

(Notice the imap.fastmail.com? That should not be happening.)

Moreover, if I did an nslookup -type=SRV _imaps._tcp.raxnet.global. from my clients they weren’t resolving the name either. How was Outlook able to resolve this then?! (I still don’t have an answer to this so don’t get your hopes up, dear reader). Clients can query the name only if they query an external DNS server but that wasn’t happening in my case. 

NewImage

Here’s an article on Outlook 2016’s implementation of auto discover. It too tells me that SCP is the default mechanism for auto-discovery when Outlook discovers it’s on a domain joined machine. Starting from Outlook 2016 however, there is a special case in that if Outlook feels the account is an Office 365 enabled one it will try and auto-discover using Office 365 endpoints (typically https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml or https://autodiscover-s.partner.outlook.cn/autodiscover/autodiscover.xml). My domain isn’t on Office 365, but what the heck I disabled it via a registry key but no luck it still goes to IMAP. 

Why I don’t understand is why it keeps ignoring SCP. It is as if Outlook thinks I am not domain joined and is magically able to query external DNS. The Windows VM on which Outlook runs can’t query the outside world so how is Outlook doing it?

I verified the SCP end points in Exchange (this is a good article to read) and also came across this script which you can run on the client side to make it query AD for the SCP endpoint via LDAP. (I couldn’t access the blog so had to get a cached copy via Google. So I am going to copy paste the script here for my future reference. All credit to the author of the blog). 

This correctly returned my client machines’ site as well as the autodiscover URL. 

I have no idea why auto-discover was failing. My hunch at this point was that Outlook was querying DNS some other way, because of which it was thinking it is not domain joined and so all the usual auto-discovery was failing until it hit up on the Internet face IMAP auto-discovery. So what was my DNS setup like? 

All my clients were pointing to the DC via DHCP for DNS. The DNS in turn was forwarding to my OPNSense router which had Unbound DNS running on it. I verified again, from the client and DC, that I am unable to resolve the external records of raxnet.global. I suspected OPNSense at this point so I turned off Unbound DNS to see if that impacts the auto-discovery. Sure enough, it did! Now Outlook was behaving as it used to. 

Unbound DNS was set to listen only on the servers subnet. So there was no way a query could come from my clients subnet to Unbound (my bad, I should have checked this by querying Unbound directly – too sleepy now to enable Unbound again and see what happens). I couldn’t see any other settings either so I stopped Unbound and added root hints to the DC so it can talk to the Internet directly. (Here yet another thing wasted my time. I always set DNS servers to listen on “All IP addresses” – including IPv6. With that setting my DC was unable to resolve external names using the root hints. If I disable it to listen only on IPv4, the DC is able to resolve as expected! Something in the IPv6 was causing an issue. Funnily a colleague had mentioned this in the past but I never believed him). 

NewImage

That done, my clients would now talk to the DC for DNS queries (as before), and the DC would go and lookup on its own (unlike before). No more forwarder. I tried Outlook again with this setting and auto-discover correctly works. 

The issue isn’t Unbound or OPNSense. The issue is that when my DC is using a forwarder (any forwarder, even 8.8.8.8 for instance) Outlook thinks it is not domain joined and it can view my external DNS records – breaking auto-discovery. I don’t know why this happens, especially considering the OS on which Outlook is running can’t resolve the external records and can in fact resolve the internal LDAP end-points correctly. Something in the way Outlook is sending DNS queries is causing it to work differently. (Or maybe I am just too sleepy and can’t think of a simple explanation now!)

Exchange 2013 Restore

I need to restore the Contacts folder for a user. I will restore it to an admin mailbox and then email the required contact to the user from there. Pretty straightforward.

1) Create a recovery DB. The recovery DB is called “RDB”. I store it on the D: drive in a folder called “Recovery”.

2) Open Services and restart the Exchange Information Store service.

3) Set the recovery DB as over-writeable.

4) I backup using DPM/ Azure Backup Server. Restore as per here.

5) Make a restore request from the recovery DB for the Contacts folder. I will restore this to a folder called Recovery in the administrator user. The switches below are for that:

The -AllowLegacyDNMismatch is required because I am restoring to a different mailbox.

6) Keep an eye on the progress via the Get-MailboxRestoreRequest cmdlet. You can get stats this way if required:

That’s it!

If I hadn’t restored to a recovery DB via DPM and brought it to a cleanly shutdown state I can follow instructions along these lines to do that.

Setting up IPsec tunnel from OPNsense at home to Azure

This is mainly based on this and this blog posts with additional inputs from my router FAQ for my router specific stuff. 

I have a virtual network in Azure with a virtual network gateway. I want a Site to Site VPN from my home to Azure so that my home VMs can talk to my Azure VMs. I don’t want to do Point to Site as I have previously done as I want all my VMs to be able to talk to Azure instead of setting up a P2S from each of them. 

My home setup consists of VMware Fusion running a bunch of VMs, one of which is OPNSense. This is my home gateway – it provides routing between my various VM subnets (I have a few) and acts as DNS resolver for the internal VMs etc. OPNSense has one interface that is bridged to my MacBook so it is not NAT’d behind the MacBook, it has an IP on the same network as the MacBook. I decided to do this as to is easier to port forward from my router to OPNSense. 

OPNSense has an internal address of 192.168.1.23. On my router I port forward UDP ports 500 & 4500 to this. I also have IPSec Passthrough enabled on the router (that’s not mentioned in the previous link but I came across it elsewhere). 

My home VMs are in the 10.0.0.0/8 address space (in which there are various subnets that OPNSense is aware of). My Azure address space is 172.16.0.0/16.

First I created a virtual network gateway in Azure. It’s of the “VpnGw1” SKU. I enabled BGP and set the ASN to 65515 (which is the default). This gateway is in the gateway subnet and has an IP of 172.16.254.254. (I am not using BGP actually, but I set this so I can start using it in future. One of the articles I link to has more instructions). 

Next I created a local network gateway with the public IP of my home router and an address space of 10.0.0.0/8 (that of my VMs). Here too I enabled BGP settings and assigned an ASN of 65501 and set the peer address to be the internal address of my OPNSense router – 192.168.1.23. 

Next I went to the virtual network gateway section and in the connections section I created a new site to site (IPsec) connection. Here I have to select the local network gateway I created above, and also create a pre shared key (make up a random passphrase – you need this later). 

That’s all on the Azure end. Then I went to OPNSense and under VPN > IPsec > Tunnel Settings I created a new phase 1 entry. 

NewImage

I think most of it is default. I changed the Key Exchange to “auto” from v2. For “Remote gateway” I filled in my Azure virtual network gateway public IP. Not shown in this screenshot is the pre shared key that I put in Azure earlier. I filled the rest of it thus – 

NewImage

Of particular note is the algorithms. From the OPNSense logs I noticed that these are the combinations Azure supports – 

IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024

I didn’t know this and so initially I had selected a DH key group size of 2048 and my connections were failing. From the logs I came across the above and changed it to 1024 (the 2048 is still present but it won’t get used as 1024 will be negotiated; I should remove 2048 really, forgot to do it before taking this screenshot and it doesn’t matter anyways). Then highlighted entry is the combination I chose to go with. 

After this I created a phase 2 entry. This is where I define my local and remote subnets as seen below:

NewImage

I left everything else at their defaults. 

NewImage

And that’s it. After that things connected and I could see a status of connected on the Azure side as well as on my OPNSense side under VPN > IPsec > Status Overview (expand the “I” in the Status column for more info). Logs can be seen under VPN > IPsec > Log File in case things don’t work out as expected. 

I don’t have any VMs in Azure but as a quick test I was able to ping my Azure gateway on its internal IP address (172.16.254.254) from my local VMs. 

Of course a gotcha with this configuration is that when my home public IP changes (as it is a dynamic public IP) this will break. It’s not a big deal for me as I can login to Azure and enter the new public IP in the local network gateway, but I did find this blog post giving a way of automating this

[Aside] Enable ADFS Logging

See https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging.

  1. Enable the ADFS Tracing Logs.
  2. Enable auditing via Set-AdfsProperties -AuditLevel Verbose. Disable via Set-AdfsProperties -AuditLevel Basic.

Mail enable an existing distribution group

FET ports

FET == Front End Transport service in Exchange 2013. Is a part of the Client Access Server (CAS) role, it accepts emails. Receives emails, Sends emails. Stateless, no inspection, queueing etc. Just a simple dude!

Here are the default receive connectors on an Exchange server. 3 belong to FET, 2 to HT (Hub Transport).

NewImage 

HubTransport is the Transport service on the Mailbox server role. 

Here are the ports these various connectors listen on:

These connectors are stored in AD under the configuration partition. 

Screen Shot 2019 01 01 at 1 37 27 PM

FET listens on various ports:

  • Port 25 – for receiving emails from other servers. The receive connector for this is called Default Frontend <servername>. It accepts anonymous connections from external SMTP servers for the accepted domains of this server.
    • You can create additional receive connectors on port 25 if you want to accept anonymous connections for non-accepted domains too (i.e. setup an anonymous relay). See this and this for more info on how to do that. Basically you setup a new receive connector on port 25, restrict it to certain source IPs (the IPs from which you want to accept anonymous connections), and then you modify the AD security properties of the connector to allow NT AUTHORITY\ANONYMOUS LOGON to accept any recipient when sending emails. (An alternate way detailed in the same article is to set the receive connector as Externally secured). I didn’t know the receive connectors were AD objects and you could assign ACLs to it so was pleased to learn that today. :)
  •  Port 587 – for receiving emails from clients (such as IMAP4 & POP3 clients that expect an SMTP server where they can submit emails to). The receive connector for this is called Client Frontend <servername>. This port does not accept anonymous connections, clients have to authenticate.
    • To clarify for myself because I have forgotten this from my past: port 465 is for mail submission where a TLS handshake begins immediately (implicit TLS) while port 587 is where TLS starts only after the clients sends a STARTTLS verb. What this means for Exchange is that port 587 can accept TLS connections but chances are you will get a certificate error when trying to use TLS. You must therefore assign a certificate to this receive connector if you want TLS. Thanks to RFC 8314 for reminding me of port 465 vs 587 and this FastMail page for some history. 
  • Port 717 – for receiving emails from the mailbox server role. The receive connector for this is called Outbound Proxy Frontend <servername>. This is only used it a send connector has the “proxy through client access server” ticked. If this option is not ticked the Mailbox server can send external emails directly to external SMTP hosts. (Reason for doing this is that then all outgoing emails appears to come from the CAS server rather than the Mailbox Server – better from a security point of view as the CAS is what is usually Internet exposed). 

As you can see the FET is for emails from other servers or SMTP clients. It is not used when someone sends an email via Outlook MAPI for instance. This picture from the Microsoft docs on the Exchange 2013 mail flow is worth putting here for future reference. As you can see, when Outlook MAPI is used to send an email it is stored in the mailbox database and the Mailbox Transport service picks it from there. Outlook doesn’t send an email via SMTP to Exchange. 

NewImage

The Mailbox server has two “mail flow” services running on it. 

  • The first of these is what we saw as HubTransport in the screenshots above. This is known as the Transport service in Exchange 2013 (though confusingly referred to by its Exchange 2010 name of Hub Transport in the GUI!) and is a stateful SMTP server – i.e. does things like categorizing etc. as in the immediate screenshot above.
  • The second of these in the Mailbox Transport service (which in turn can be thought of as two components but I am going to ignore that here) and this one’s stateless like the FET. Its role is to take mail from the mailbox database and/ or inject mail into the mailbox database. It also interfaces with the Transport service to send & receive emails. 

At this point it’s worth pointing to this older post of mine with some screenshots of these components to get a better picture of the components and flow. One more screenshot I’d like to add here is this one from the Mastering Exchange 2013 book.

NewImage

The Transport service (aka HubTransport) on the Mailbox server is pretty important (not that Mailbox Transport service is any less important). The Transport service does content inspection etc and has two connectors of its own. It listens on these ports:

  • Port 2525 (if the Mailbox & CAS roles are on the same server – in this case CAS has already taken port 25 for itself) or Port 25 (if the Mailbox & CAS are on separate servers) – for many things (read on). The receive connector for this is called Default <servername>
    • This port is used to receive emails from the FET for internal mailboxes, from the Transport service of other Mailbox servers, and from the Mailbox Transport service on itself or other servers.
    • Looking at the diagram from earlier (repeated below), the three incoming arrows are what it accepts emails from.  The yellow “SMTP Receive” is the Transport listening on port 2525 or 25. It accepts emails from the FET (arrow from top), the Transport or Mailbox Transport of other servers (arrow from left), and Mailbox Transport from itself (arrow from down). 

Screen Shot 2019 01 01 at 5 40 07 PM

  • Port 465 – this is used to proxy client connections (IMAP4 & POP3 email clients) to port 587 of the FET. The receive connector for this is called Client Proxy <servername>.

To summarize, the important receive connectors to keep in mind for a typical Outlook/ Exchange environment are the 1) FET receive connector on port 25, the 2) HubTransport receive connector on port 2525 or 25. If you have IMAP4 & POP3 clients then the 3) FET receive connector on port 587 and 4) HubTransport receive connector on port 465 to matter. And lastly, if you proxy outbound connections via the CAS then the 5) outbound proxy connector on port 717 also matters. 

Badhaai Ho!

2019! Yay. 

Saw “Badhaai Ho” yesterday. Nice to see touching performances from yesteryear actors like Neena Gupta and Surekha Sikri. It’s a good story too, predictable as one would expect, but well taken with not too much drama except what you’d expect and sign up for when deciding to watch such a movie. :) 

Unforgettable moment from the movie: hospital scene when a random stranger turns to Ayushman and asks “Malayali aano?”. Got to be a mallu to get that joke, it was hilarious and totally unexpected!

Watched “Teeefa in Trouble” after that. Eugh, not that great. I am a fan of Ali Zafar and was hoping for more. It’s not a bad movie … just not great! Maya Ali is fun to watch. Predictable plot again, but well taken and so can watch. 

I seem to like one or two good movies; then encounter a dud. Again watch one or two good movies; encounter a dud. One needs a dud now and then to keep things grounded I guess.