 © Rakhesh Sasidharan
|
Posted: May 17th, 2017 | Tags: active directory, ADFS, certificates | Category: Infrastructure | § Was trying to wrap my head around ADFS and Certificates today morning. Before I close all my links etc I thought I should make a note of them here. Whatever I say below is more or less based on these links (plus my understanding):
There are three types of certificates in ADFS.
The “Service communications” certificate is also referred to as “SSL certification” or “Server Authentication Certificate”. This is the certificate of the ADFS server/ service itself.
- If there’s a farm of ADFS servers, each must have the same certificate.
- We have the private key too for this certificate and can export it if this needs to be added to other ADFS servers in the farm.
- The Subject Name must contain the federation service name.
- This is the certificate that end users will encounter when they are redirected to the ADFS page to sign-on, so this must be a public CA issued certificate.
The “Token-signing” certificate is the crucial one.
- This is the certificate used by the ADFS server to sign SAML tokens.
- We have the private key too this certificate too but it cannot be exported. There’s no option in the GUI to export the private key. What we can do is export the public key/ certificate.
- The exported public certificate can be loaded to the 3rd party provider who would be using our ADFS server for authentication.
- The ADFS server signs tokens using this certificate (i.e. uses its private key to encrypt the token or a hash of the token – am not sure). The 3rd party using the ADFS server for authentication can verify the signature via the public certificate (i.e. decrypt the token or its hash using the public key and thus verify that it was signed by the ADFS server). This doesn’t provide any protection against anyone viewing the SAML tokens (as it can be decrypted with the public key) but does provide protection against any tampering (and verifies that the ADFS server has signed it).
- This can be a self-signed certificate.
- By default this certificate expires 1 year after the ADFS server was setup. A new certificate will be automatically generated 20 days prior to expiration. This new certificate will be promoted to primary 15 days prior to expiration.
- This auto-renewal can be disabled. PowerShell cmdlet
(Get-AdfsProperties).AutoCertificateRollover tells you current setting.
- The lifetime of the certificate can be changed to 10 years to avoid this yearly renewal.
- No need to worry about this on the WAP server.
The “Token-decrypting” certificate.
- This one’s a bit confusing to me. Mainly coz I haven’t used it in practice I think.
- This is the certificate used if a 3rd party wants to send us encrypted SAML tokens.
- Take note: 1) Sending us. 2) Not signed; encrypted.
- As with “Token-signing” we export the public part of this certificate, upload it with the 3rd party, and they can use that to encrypt and send us tokens. Since only we have the private key, no one can decrypt en route.
- This can be a self-signed certificate.
- Same renewal rules etc. as the “Token-signing” certificate.
- Important thing to remember (as it confused me until I got my head around it): This is not the certificate used by the 3rd party to send us signed SAML tokens. The certificate for that can be found in the signature tab of that 3rd party’s relaying party trust (see screenshot below).
- Another thing to take note of: A different certificate is used if we want to send encrypted info to the 3rd party. This is in the encryption tab of the same screenshot.
So – just to put it all in a table.
| Clients accessing ADFS server |
Service communications certificate |
| ADFS server signing data and sending to 3rd party |
Token-signing certificate |
| 3rd party encrypting data and sending ADFS server |
Token-decrypting certificate |
| 3rd party signing data and sending ADFS server |
Certificate in Signature tab of Trust |
| ADFS server encrypting data and sending to 3rd party |
Certificate in Encryption tab of Trust |
Posted: May 14th, 2017 | Tags: netscaler, vpx | Category: Asides, Citrix | § Reading about NetScaler VPX as we are looking at implementing VPX Express in our site as part of a POC.
- VPX Express is limited to 5 Mbps (as opposed to say 1 Gbps for VPX-1000).
- The license is free but you have to keep renewing annually.
- The Edition is NetScaler Standard. This and this are two links I found that explain the difference between various editions.
- tl; dr version: Standard is fine for most uses.
- The Gateway part supports 5 concurrent user connections.
- You cannot vMotion or XenMotion VPX.
- This is an excellent blog post on VPX, MPX, and others. Worth a read.
Posted: May 14th, 2017 | Tags: Azure | Category: Asides, Windows | § Just putting this here as a bookmark to myself for later. A good post. ⇒
Posted: May 13th, 2017 | Tags: delivery controller, vda | Category: Citrix | § This weekend the NetScaler gateway on one of our offices failed, rendering the office users unable to connect to their resources. I wanted to repoint all those users to the Delivery Controllers of a different office where the NetScaler was working, and ask users to temporarily connect via that.
I had to two two things basically. 1) Change a registry key to repoint the VDA to the other Delivery Controllers. 2) Restart the VDA service (these machines were running 5.6(!!) so it’s called the Workstation Agent).
|
|
# Change the registry key > reg add \\<computer>\HKLM\Software\Citrix\VirtualDesktopAgent /v ListOfDDCs /t REG_SZ /d "dc01 dc02" Value ListOfDDCs exists, overwrite(Yes/No)? y # Stop Service > sc \\<computer> stop WorkstationAgent # Start Service (wait a bit before doing this) > sc \\<computer> start WorkstationAgent |
Posted: May 13th, 2017 | Tags: netscaler, storefront | Category: Citrix | § I spent the last two days intermittently trying to set up NetScaler and Citrix StoreFront in my home lab. It was a mixed bag partly due to my nature of just jumping into something and figuring it out as I go along :) but compounded by the fact that while there’s a lot of documentation on the Internet they seem to be either outdated or don’t explain the big picture of what we are trying to achieve. (Or maybe I am just slow in picking it up – wouldn’t put that possibility aside!)
Anyways. Here’s a couple of stuff in no particular order.
This PDF is the official documentation on setting up NetScaler with Citrix StoreFront. It’s a good one – lots of screenshots etc. Page 19 onwards seems to be outdated though with the latest version of NetScaler that I have – 11.1 53.11.
When I started this exercise though I was on a much older version of NetScaler – 10.5 56.22. I started setting up the NetScaler as a gateway (e.g. http://ctxstorefront.myfqdn) to my internal StoreFront servers (http://data01.myfqdn and http://data02.myfqdn), and my steps were more or less along the lines of the PDF above which I discovered later. That wasn’t a success though coz when I’d connect to the NetScaler gateway it gave some errors (I forget what now). Digging into this I realized that the wizard also creates a load balanced virtual server on the NetScaler and that was showing as down. Dug into that a bit and found out that the underlying monitor probes to the two StoreFronts were failing. If I separately created services representing my StoreFronts and attach the same monitor (basically, a monitor of type STOREFRONT, with the correct StoreName etc) it fails.
That was good to know coz I learnt a bit about the monitor probes. :) I found the following in my NetScaler logs:
|
|
root@ns105# nsconmsg -K /var/nslog/newnslog -d event ... 2991 15 PPE-0 MonServiceBinding_10.10.1.12:443_(STF-HTTPS)(DATA02-STF): DOWN; Last response: Failure - Probe failed. Fri May 12 08:04:17 2017 2992 0 PPE-0 'server_svc_cfg_NSSVC_SSL_10.10.1.12:443(DATA02-STF)' DOWN Fri May 12 08:04:17 2017 2997 29 PPE-0 MonServiceBinding_10.10.1.11:80_(tcp-default)(DATA01-STF-HTTP): UP; Last response: Success - TCP syn+ack received. Fri May 12 08:04:40 2017 2998 0 PPE-0 'server_svc_cfg_NSSVC_HTTP_10.10.1.11:80(DATA01-STF-HTTP)' UP Fri May 12 08:04:40 2017 3003 15 PPE-0 MonServiceBinding_10.10.1.11:80_(STF-HTTP)(DATA01-STF-HTTP): DOWN; Last response: Failure - Probe failed. Fri May 12 08:04:59 2017 3004 0 PPE-0 'server_svc_cfg_NSSVC_HTTP_10.10.1.11:80(DATA01-STF-HTTP)' DOWN Fri May 12 08:04:59 2017 3005 102 PPE-0 MonServiceBinding_10.10.1.11:80_(STF-HTTP)(DATA01-STF-HTTP): DOWN; Last response: Failure - Probe failed. Fri May 12 08:06:40 2017 3006 37 PPE-0 MonServiceBinding_10.10.1.11:80_(STF-HTTP)(DATA01-STF-HTTP): DOWN; Last response: Failure - Probe failed. Fri May 12 08:07:13 2017 3007 44 PPE-0 MonServiceBinding_10.10.1.11:80_(STF-HTTP)(DATA01-STF-HTTP): DOWN; Last response: Failure - Probe failed. Fri May 12 08:07:57 2017 |
That’s same as what the GUI was telling me but I was additionally able to find what error code was being generated (thanks to this KB article):
|
|
root@ns105# tail /var/nslog/nsumond/nsumond.log Fri May 12 08:20:49 2017: /netscaler/monitors/nssf.pl Script failed. Exit code : 1 Fri May 12 08:20:49 2017: /netscaler/monitors/nssf.pl Exit Reason : (200 OK) Fri May 12 08:20:54 2017: /netscaler/monitors/nssf.pl Script failed. Exit code : 1 Fri May 12 08:20:54 2017: /netscaler/monitors/nssf.pl Exit Reason : (200 OK) Fri May 12 08:20:59 2017: /netscaler/monitors/nssf.pl Script failed. Exit code : 1 Fri May 12 08:20:59 2017: /netscaler/monitors/nssf.pl Exit Reason : (200 OK) Fri May 12 08:21:00 2017: /netscaler/monitors/nssf.pl Script failed. Exit code : 1 Fri May 12 08:21:00 2017: /netscaler/monitors/nssf.pl Exit Reason : (200 OK) Fri May 12 08:21:00 2017: /netscaler/monitors/nssf.pl Script failed. Exit code : 1 Fri May 12 08:21:00 2017: /netscaler/monitors/nssf.pl Exit Reason : (200 OK) |
So it runs a Perl script basically. Nice. Went through that script and here’s the relevant section:
|
|
#######Discovery################################# $url = "$baseurl/Citrix/$store/discovery"; $request = HTTP::Request->new('GET', $url); unless($request){ $errorcode = "Resources not available to create discovery request"; goto ERROR; } $response = $conn->request($request); if($response->code( ) != 200){ $errorcode = $response->status_line; goto ERROR; } |
So it tries to access http(s)://<my delivery controller>/Citrix/<my Store>/discovery and gets a 200 error. Odd that it gets it, because if I try to probe that URL via cURL from NetScaler, I get a 404 error (which is sort of correct; I get a 403 error via IE and that’s the correct one I think):
|
|
root@ns105# curl -I http://10.10.1.11:80/Citrix/Store/discovery HTTP/1.1 404 Not Found Cache-Control: private Content-Length: 1919 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/8.5 Date: Fri, 12 May 2017 09:14:10 GMT |
Anyhoo, that stumped me for a while until I found forum/ blog post where they said upgrading to a newer version of NetScaler supposedly fixes this. So I went down that route, and yes, it helped.
After upgrading though my UI changed. :)
The new UI is very different. But that’s good I think, coz it forced me think at least on what exactly am I trying to achieve here; and to take a step backward and understand what is going on. So here’s my understanding:
- We have StoreFronts. :) That’s the thing you actually connect to.
- We can have a group of StoreFronts for High Availability. You can configure each of these independently or you can keep them in sync from the UI itself.
- For each StoreFront we need to specify a base URL.
- For a single StoreFront it’s easy – http://data01 or whatever (where data01 is my StoreFront server name in this case).
- But what about when I have a group of StoreFronts? If I am keeping them in sync via the UI itself, the base URL I define on one of them will be pushed out to all. So all my StoreFronts will have a base URL of http://data01 even though they might be called data01, data02, etc. That’s a problem coz all my clients will only connect to the first one as that’s where DNS will point clients to.
- To avoid the above situation for multiple StoreFronts we need a common base URL which can be load balanced across all. A regular DNS round-robin situation won’t work coz we also need clients to stick on with whichever StoreFront they connect to, and also some form of monitoring to ignore StoreFronts that are down would be good to. So this is where the NetScaler first comes in!
- Create a Virtual Server on the NetScaler that will load balance the various StoreFront services we define on it. Simple stuff – just HTTP or HTTPS services that are load balanced. Add the STOREFRONT type monitor. And a Persistence of type COOKIEINSERT. That’s all. (Oh, and add SSL certs etc if you are using HTTPS).
- I haven’t gone through this link but am putting it here as a reference to my future self – pretty sure I must have missed something when setting up things now. Also, that link goes into some scenarios such as where we do SSL termination at the NetScalers.
What I realized as I thought about this is that this Virtual Server I create above is the main thing. Going by my URLs above, I should have http(s)://ctxstorefront.myqdn load balance among http(s)://data01 and http(s)://data02. Forget about the whole external access stuff for now.
Once I do this and ensure things are working (they do), now I can think about external access. What does the NetScaler need to do there? It doesn’t need to do any load balancing coz that’s already setup; so all it needs to do is provide a VPN gateway sort of service for external clients to connect to! So that means a new Virtual IP on the NetScaler. Create this using the wizard in the “Integrate with Citrix Products” > “XenApp and XenDesktop”. This will basically create a Virtual Server in the NetScaler Gateway section (note: not in the Load Balancing section). As part of configuring, we have to point this Virtual Server to a StoreFront. Here use the Load Balanced StoreFront Virtual Server that we created on the NetScaler above – this is where it all ties in!
I could use the same internal URL for the external access too I guess and use split DNS – not sure, because I do have to specify this on the StoreFronts and I haven’t tried/ thought of any side effects – but in my case I simply decided to go with a different URL for the external access. Specify that for the certificate and Virtual Server etc, add that to DNS, and now I can access the StoreFronts externally too via the NetScaler.
If I were to go to the Virtual Server in the Gateway section there’s no obvious mapping from this one to the internal load balance Virtual Server. But there is. It’s in the policies section. That has a Published Application pointing to the load balanced URL (including the Store name (actually, there’s two policies – one for the Web another for the Receiver, to capture the different names)) so that’s how the traffic flow works. Users hit the gateway, the gateway does the authentication etc and checks its policies, finds one that offers uses the StoreFront published application at such and such URL, and it looks that up (it is with itself) and thus hits the load balanced Virtual Server, and so on …
Finally! I have some idea of how this all ties in together. :)
Posted: May 13th, 2017 | Tags: powershell, windows updates, wmi | Category: PowerShell, Windows | § Was reading about the WannaCrypt attacks. If you have the MS17-010 bulletin patches installed in your estate, you are safe. I wanted to quickly scan our estate to see if the servers are patches with this. Not my job really, but I wanted to do it anyways.
The security bulletin page lists the actual patch numbers for each version of Windows. We only have Server 2008 – 2016 so that’s all I was interested in.
Here’s a list of the Server name, internal version, and the patch they should have.
- Server 2008 | 6.0.6002 | KB4012598
- Server 2008 R2 | 6.1.7600 | KB4012215 or KB4012212
- Server 2012 | 6.2.9200 | KB4012214 or KB4012217
- Server 2012 R2 | 6.3.9600 | KB4012213 or KB4012216
- Server 2016 | 10.0.14393 | KB4013429
One thing to bear in mind is that it’s possible a server doesn’t have the exact patch installed, but is still not at any risk. That is because since October 2016 Windows patches are cumulative. So if you don’t have the particular March 2017 patch installed, but do have the April 2017 one, you are good to go. The numbers above are from March 2017 – so you will have to update them with patch numbers of subsequent months too to be thorough.
Another thing – I had one server in my entire estate where the patch above was actually installed but turned up as a false positive in my script. Not sure why. I know it isn’t a script issue. For some reason that patch wasn’t being returned as part of the “Win32_QuickFixEngineering” output. Am assuming it wasn’t installed that way on this particular server.
Without further ado, here’s the script I wrote:
|
|
Get-ADComputer -SearchBase "OU=Servers,DC=myDomain,DC=com" -Filter * | ?{ Test-Connection $_.Name -Quiet -Count 1 } | %{ $Computer = $_.Name $WinVer = (Get-WmiObject Win32_OperatingSystem -CN $Computer).Version switch ($WinVer) { '6.0.6002' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter "HotFixID='KB4012598'" | Measure-Object).Count -eq 0) { "$Computer | Server 2008 | Missing KB4012598 "} } '6.1.7600' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter "HotFixID='KB4012215' or HotFixID='KB4012212'" | Measure-Object).Count -eq 0) { "$Computer | Server 2008 R2 | Missing KB4012212 or KB4012215 "} } '6.2.9200' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter "HotFixID='KB4012214' or HotFixID='KB4012217'" | Measure-Object).Count -eq 0) { "$Computer | Server 2012 | Missing KB4012214 or KB4012217 "} } '6.3.9600' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter "HotFixID='KB4012213' or HotFixID='KB4012216'" | Measure-Object).Count -eq 0) { "$Computer | Server 2012 R2 | Missing KB4012213 or KB4012216 "} } '10.0.14393' { if ((Get-WmiObject Win32_QuickFixEngineering -CN $Computer -Filter "HotFixID='KB4013429'" | Measure-Object).Count -eq 0) { "$Computer | Server 2016 | Missing KB4013429 "} } } } |
That’s all. Nothing fancy.
Posted: May 9th, 2017 | Tags: pvs | Category: Citrix | § If you get the following error when running the “XenDesktop Setup Wizard” from PVS console (and a catalog is created with no machines):
Or you get the following error (and again a catalog is created but no machines):
Or you get neither of these but the PVS Console simply freezes when you click OK/ Next at one of the steps and it throws an error about timeout and being unable to connect to the remote server (sorry no screenshot, forgot to take it when I got the error and now I can’t replicate it) …
The solution is simple! Install the PVS Console on your Delivery Controller server and run the wizard from there. For some reason that seems to do the trick. Thanks to this forum post.
Posted: May 8th, 2017 | Tags: dhcp, netsh | Category: Windows | § Wish I had known this earlier. If you want to migrate DHCP servers and have got the two servers setup, run the following on the source server:
|
|
netsh dhcp server v4 export c:\dhcpdb all |
And the following on the destination server (the first command is to just connect to the C: drive of the source):
|
|
pushd \\sourceDC\c$ netsh dhcp server v4 import \path\to\dhcpdb all |
Amazing!
This only does IPv4 scopes, so replace v4 with v6 for IPv6. And this exports all scopes, so replace “all” with the scopes you want if you want a selected few.
Posted: May 7th, 2017 | Tags: windows update | Category: Windows | § Starting with Windows 10 and Server 2016 Microsoft isn’t providing a WindowsUpdate.log file any more. Instead we have to run a cmdlet to generate it manually.
On my Server 2016 the cmdlet gave the following error:
|
|
Copy-Item : Cannot find path 'C:\Program Files\Windows Defender\SymSrv.dll' because it does not exist. At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsUpdate\WindowsUpdateLog.psm1:56 char:5 + Copy-Item -Path $SYMSRV_DLL_PATH -Destination $WORKDIR -Force -Er ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (C:\Program File...nder\SymSrv.dll:String) [Copy-Item], ItemNotFoundExce ption + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.CopyItemCommand |
I checked the path “C:\Program Files\Windows Defender” and there’s no “SymSrv.dll” file present there. That’s because I had removed the Windows Defender feature from my Server 2016 install (we use Sophos, so no need really for Windows Defender). Who thought removing Windows Defender would break this cmdlet?
If I check the module “C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsUpdate\WindowsUpdateLog.psm1” sure enough it looks for this DLL and tries to copy it:
|
|
# Dependencies $TRACERPT_EXE_PATH = "$SYSTEM32\tracerpt.exe" $DBGHELP_DLL_PATH = "$SYSTEM32\DbgHelp.dll" $SYMSRV_DLL_PATH = "$env:ProgramFiles\Windows Defender\SymSrv.dll" ... Copy-Item -Path $SYMSRV_DLL_PATH -Destination $WORKDIR -Force -ErrorAction Stop |
Bugger!
Well, workaround is simple. Copy this DLL from any other 2016 machine (or search through the “C:\Windows\WinSxS\” folder on the same machine and copy it from there) to “C:\Program Files\Windows Defender” and the cmdlet will work.
Or … enable the Windows Defender feature and disable it from Settings.
Posted: May 6th, 2017 | Category: Books | § Wow, the book is so different from the TV show! Damn. Can’t even compare the two. And because I saw the TV show first (and that’s more fast paced) I kept waiting for the book too to pick up pace. And because of that I don’t think I read the book the way I should. It’s not sci-fi, it’s not a thriller, it’s somewhat political (what if Japan and Germany won), and a lot (a lot lot lot!) philosophical (which was amazing really but I didn’t read it with that mind frame as I was waiting for things to pick up pace).
Lots of good stuff about life and fate and objects etc. Some real good stuff really. But because I came from the TV show background I found it slow. And I also didn’t relate much to any character – I don’t think that’s due to the show though, I think even otherwise I’d have found the characters very distant and unrelateable to.
I didn’t enjoy this one as much as “1984”. That was amazing. Some real, deep, blow your brains out stuff! “The Man in the High Castle” was more meandering, well written but not really blow your brains out sort of stuff (at least for me). I’ll remember it for it’s philosophical bits on the I Ching and how objects get value and how it doesn’t matter what the outcome of the war was, etc. But that’s about it – it didn’t hit me on a personal level like say “1984” (or recently “Slaughter House 5”).
Full disclosure: 🙂 I cheated “1984” a bit as I both read it and listened to the amazing audiobook version by Simon Prebble. That would have made a difference I am sure. I am proud of “The Man in the High Castle” in that I actually read it. Took a while as I don’t do much reading, but I stuck with it and now I can say I actually read a book (as in fully read, no audiobook side by side) after a long time.
As an aside: I haven’t seen Season 2 of “The Man in the High Castle” (I got bored midway of Season 1 to be honest, especially with Julianna) but the score (music) is amazing. Check it out if you are into that sort of stuff.
Posted: May 6th, 2017 | Category: TV | § The latest xXx movie is a throwback to olden times. And while I usually enjoy such movies (e.g. The Expendables, and most Schwarzenegger movies) I found this one a bit over the top. I get it – Xander Cage is cool, is daring, loves it when things get messy (turbulent) – but in the whole movie it is sort of like he keeps jumping into trouble (sometimes for no particular reason either but just coz it’s cool) and nothing happens to him. It’s like he’s invincible. I think I would have enjoyed the movie as a child and had more fun with the coolness; but as an adult I found myself constantly thinking “this is so unbelievable”. Most action movies are unbelievable, yes, but the trick is to not take it over the top so the viewer too realizes it’s a bit too much.
That’s my 2fils on xXx 3 anyways. And that said I’ll definitely watch the sequel when it comes out (am sure one will). I liked the main Chinese guy (sorry too lazy to Google his name) – he was fun. And I also loved the green hair gun lady (Rose or something). She had attitude and was fun. :)
Guess that’s it!
Posted: May 6th, 2017 | Category: Musings | § … when you put your phone in the left pocket and the Bluetooth music streaming starts to stutter.
At least that’s what happened to me just now. 🙂 I don’t recollect having any issue with the phone in my left pocket and streaming via Bluetooth from there until today. I think it’s coz the headphone has its Bluetooth receiver on the right side so the left pocket to right ear traversal is more sensitive to increased tummy fat! Sigh.
Posted: May 6th, 2017 | Tags: Iron Fist, Marvel, Netflix, reviews | Category: TV | § I want to wrote opinions of stuff I watch, read, or listen. But I am not good at writing verbosely on such stuff – describing, showering praises or finding faults – so I usually refrain. Nevertheless I do want to record my opinions and thoughts somewhere, and if not on this of then where?
Part reason I don’t want to write much is that I know it’s an act of creativity, thinking up and executing and creating something. A TV show, Movie, or a book or anything ‘art’. And however much I might dislike it that’s just my personal opinion and I have no right to blurt it out in public. I can say in private to anyone as it’s a one to one, but having a blog or some social media gives me no right to say bad about something I personally don’t like. (And we’ll if it’s something I enjoy, then the other part of my reason wherein I suck at expressing my praise amd describing why kicks in and so I can’t write good either!)
Anyhow. On that note. I saw Netflix’s Iron Fist this weekend. I had seen up to episode 7 last month on a binge weekend, got bored and left it, but continued today as my daughter (who too binge watched previously) wanted to finish it.
The second half was better than the first. More fighting. Still a lot of talking, confusion, and personal journey. Reminding me of watching “Batman vs Superman” and thinking how I’d hate to be Superman – such a tortured hero! This was similar. Chap’s got an Iron Fist, not really sure what to do with it except destroy the Hand, filled with guilt and anger and innocence and lied to by nearly everyone around him. If it were me, I would be “no thank you, please keep the iron fist and spare me all the torture!”
I guess my point is that it felt more of a drama than a superhero. If it were a drama genre show and I had signed up to watch it expecting that, I wouldn’t have minded. But I was looking for hero worship and some kick assing here and a plot that’s more “yeah I am the Iron Fist let’s go kick some a$$” than this confusion and lying and family drama. I shouldn’t be surprised I know. That’s how super hero movies are nowadays and especially the Marvel Netflix collaborations.
On an unrelated note I am typing this from my Android phone (I never do that usually) and God! it’s such a torture. I hate the keyboard on Android. Keep making mistakes and most of the time the auto correct suggestions are not what I wanted.
Oh and I almost forgot. Iron Fist has a good score by Trevor Morris. Strangely they don’t mention this in the opening credits but I found the album on Apple Music. Good stuff.
Posted: May 3rd, 2017 | Tags: dns, netscaler | Category: Citrix, Infrastructure | § Two years ago I had removed the root zone on our DNS servers at work. Coz who needs root zones if your DC is only answering internal queries, i.e. for zone sit has. Right?
Well, that change broke our Citrix environment. :) Users could connect to our NetScaler gateway but couldn’t launch any resource after that.
Our Citrix chaps logged a call with our vendor etc and they gave some bull about the DNS server not responding to TCP queries etc. Yours truly wasn’t looking after Citrix or NetScalers back then, so the change was quietly rolled back as no one had any clue why it broke Citrix.
Fast forward to yesterday, I had to do the change again coz now we want our DNS servers to resolve external names too – i.e. use root hints and all that goodness! I did the change, and Citrix broke! Damn.
But luckily now Citrix has been rolled into our team and I know way more about how Citrix works behind the scenes. Plus I keep dabbling with NetScalers, so I am not totally clueless (or so I’d like to think!).
I went into the DNS section of the NetScaler to see what’s up. Turns out the DNS virtual server was marked as down. Odd, coz I could SSH into the NetScaler and do name lookups against that DNS virtual server (which pointed to my internal DC basically). And yes, I could do dig +notcp to force it to do UDP queries only and nothing was broken. So why was the virtual server marked as down?!
I took a look at the monitor on the DNS service and it had the following:
Ok, so what exactly does this monitor do? Click “Edit Monitor” – nothing odd there – click on “Special Parameters” and what do I find?
Yup, it was set to query for the root zone. Doh! No wonder it broke.
I have no idea why the DNS monitor was assigned to this service. By default DNS-UDP has the ping-default monitor assigned to it while DNS-TCP has the tcp-default monitor assigned to it. Am guessing that since our firewall block ICMP from the NetScalers to the DCs, someone decided to use the DNS monitor instead and left it at the default values of monitoring for the root zone. When I removed the root zone that monitor failed, the DNS virtual server was marked as down, and the NetScaler could no longer resolve DNS names for the resources users were trying to connect to. Hence the STA error above. Nice, huh!
Fix is simple. Change the query in the DNS monitor to a zone your DNS servers. Preferably the zone your resources are in. Easy peasy. Made that change, and Citrix began working.
As might be noticeable from the tone of the post, I am quite pleased at having figured this out. Yes, I know it’s not a biggie … but just, it makes me happy at having figured it coz I went down a logical path instead of just throwing up my hands and saying I have no idea why the DNS service is down or why the monitor is red etc. So I am pleased at that! :)
Posted: May 1st, 2017 | Tags: netscaler, newnslog | Category: Asides, Citrix | § Some links to myself on the newnslog files (these are binary log files; high precision; need a tool called nsconmsg to view them).
A typical format of the command is like this:
|
|
nsconmsg -K /path/to/newnslog -d <operation> |
The <operation> can be one of these (this is just a copy-paste from nsconmsg -?):
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
current - display the current performance data past - display the performance data from begining stats - display current statistics counters finalstats - display final newnslog statistics counters last - display last newnslog statistics counters memstats - display current memory statistics statswt0 - display current statistics counters, excluding counters with 0 value lastwt0 - display last newnslog statistics counters, excluding counters with 0 value finalstatswt0 - display final newnslog statistics counters, excluding counters with 0 value (same as '-d lastwt0') devcr - display device creation/removal information devlink - display device link information devname - display all device names symname - display all symbol names & decoding scheme devsymrel - display all device and symbol relationship event - display events nicdata - display NIC debug data eventwait - display events (real time wake) consmsg - display console message oldconmsg - display netscaler old console message (use -s options for different debug level) setime - display the start and end time of data file auditedcmd - display audited command logfromnfw - display seleced log messages from new logging framework copy - alias to copyr copyr - copy data from one file to another file with filter and sample rate change maxvalue - display highest value and time minvalue - display lowest value and time maxrate - display highest rate value and time minrate - display lowest rate value and time distrconmsg - display distribution of counter (use -s options for different debug level) |
The newnslog files are rotated every 2 days (or a certain number of events if I remember correctly). The older ones can be accessed by putting a path to that file (e.g. /var/nslog/newnslog.28.tar.gz in the command above). This will extract the file and show the logs. The Citrix page says we have to extract the logs first, but am guessing that’s old info.
That’s all for now. Will add more to this post later …
|