Setting up the lab environment – Hyper-V

Posted on by
Reply

The host was installed with Windows Server 2016.
This means Hyper-V is a feature that we just need to enable – yay!

  1. Open a elevated PowerShell prompt
  2. Run the command: Install-WindowsFeature -Name Hyper-v -IncludeManagementTools -Restart

The command will automatically reboot once installed
NOTE: In some cases you will have to enable Intel-VT in BIOS.
You can read more about the system requirements here: Systems Requirements for Hyper-V on Windows Server 2016

For the actual setup of guests machines, I will be running mostly Windows Server 2016, Windows 10 and maybe a Linux guest or two.
Don’t forget to review: Supported Windows guest operating systems

Now to the Hyper-V Switch configuration:

I am going to add an external switch, as my client is already connected to the network on the correct vlan.
Keep in mind I got a seperat USB NIC with 2 Ports (USB 3.0 to Dual Port Gigabit Ethernet Adapter NIC w/ USB Port)
This means i will be able to have my on-board primary NIC only for management and use one of the other free ports only for VMs.

  1. Open Hyper-V Manger
  2. Mark your server
  3. Click Virtual Switch Manager in the actions pane
  4. Mark External
  5. Click Create Virtual Switch
  6. Name your switch – Example: External – 254 (254 indicating the vlan)
  7. Remove the checkbox in Allow management operating system to share this network adapter
  8. Mark: Enable single-root I/O virtualization (SR-IOV)
    Not familiar with SR-IOV? Read this blog post by John Howard: Everything you wanted to know about SR-IOV
  9. Click Ok
    You might get a warning that pending network configuration will prevent remote access to this computer – If your connected to the server using another NIC, you will not be disconnected.

This concludes the basic configuration of the Hyper-V host.
We installed Hyper-V and configured a switch with external access.

The next post will be more detailed with the actual Hyper-V guest installations

Where is my cloud key?

Posted on by
Reply

During vlan configuration for my new lab (see previous post Home Data Center)
I had to change some vlans, for some reason my  Hybrid Cloud Device Management controller got “lost in translation”

The setup:
1 x Mikrotik CCR1036-12G-4S-EM
1 x UniFi switch 16 150w
1 x UniFI Cloud Key

It all starts with the adoption of devices onto the cloud key – no problems there.
But when your Cloud Key is lost in a vlan with no connectivity or access to other devices, then its back to basics.

My problem was that I deleted the valid networks/vlans added on ports – BIG mistake!
So nothing really works and you can’t change anything, but tuning a bit on the vlans on the router seemed to open up a bit.

I was able to SSH into the switch (It’s running BusyBox)

 

 

 

From there we can SSH to localhost on port 2222
Click anykey to get the Warning!: The changes may break controller settings and only be effective until reboot.

It will not give a response and will be awaiting a key stroke before your ready to go

Keep in mind all configurations will be lost, once connected back and provisioned by the cloud key.

To enter user privilege mode type: Enable
To enter Global Config mode type: Configure

And now we can configure the entire switch (also without the controller and more advanced settings.

In this case,
Selecting an interface (port 2): interface 0/2
adding a vlan to the interface (port 2): interface vlan participation include 22
and your lost Cloud Key should now be back on the correct vlan.
If you just need to bring back to management network on the switch, you can use: network mgmt_vlan 1
Note: 1 being the vlan you want to participate in.

NOTE:
If you need multiple vlan on 1 port – maybe with a UniFi AP AC Pro, you will see that the AP doesn’t have a configuration for management vlan, so we need to configure the native LAN for the device. It only requires 3 steps, it can be a bit confusing configuring and adding a bit more complexity.

– Defined Netowrk/VLANs in Controller Settings
– Manage or Create Network Profiles for the switch in the Switch Configuration
– Assign Networks/VLANS or Profiles to the Port(s)

There is a nice explanation here: A-non-expert-Guide-to-VLAN-and-Trunks-in-Unifi-Switches

Setting up the lab environment – Deduplication

Posted on by
Reply

The next step for the lab or so-called home data center: Installing and Configuring Deduplication

I was going to use a USB stick for the Windows Server 2016 OS.
The main reason for this: DEDUPLICATION.

I did start out with a USB stick, but due to performance issues this was changed – read the follow-up post (https://blog.thomasmarcussen.com/follow-up-on-the-home-datacenter-hardware/)

The reason for having the OS on a separate volume: Deduplication is not supported on system or boot volumes. Read more about Deduplication here: About Data Deduplication

Let’s get started

Installing and Configuring Deduplication

  1. Open an elevated PowerShell prompt
  2. Execute: Import-Module ServerManager
  3. Execute: Add-WindowsFeature -Name FS-Data-Deduplication
  4. Execute: Import-Module Deduplication

Installing Deduplication

Now we installed data Deduplication and it’s ready for configuration.

My Raid 0 volume is D:
The volume will primarily hold Virtual Machines (Hyper-V)
I’m going to execute the following command: Enable-DedupVolume D: -UsageType HyperV

Enable Deduplication for volume

You can read more about the different usage types here: Understanding Data Deduplication

Some quick info for the usage type Hyper-V:

  • Background optimization
  • Default optimization policy:
    • Minimum file age = 3 days
    • Optimize in-use files = Yes
    • Optimize partial files = Yes
  • “Under-the-hood” tweaks for Hyper-V interop

You can start the optimization job and limited (if needed) the amount of consumed memory for the process: Start-DedupJob -Volume “D:” -Type Optimization -Memory 50

 

 

 

You can get the deduplication status with the command: Get-DedupStatus

 

 

 

 

The currently saved space on my volume is 46.17 GB
That is for a 2 ISO files and a reference machine for Windows Server 2016 and the reference disks copied to separate folder.

More usefull powershell cmdlets here: Deduplication Cmdlets in Windows PowerShell

I do love deduplication especially for virtual machines, hence most of the basic data is the same.
The disks are also rather expensive so getting the most out of them is preferred.

 

Follow up on the home datacenter hardware

Posted on by
1

It’s time for a small update – the previous post is available here: https://blog.thomasmarcussen.com/new-lab-home-datacenter/

The datacenter has been running for about a week now – quite good…. but…..

I’ve been using the Samsung USB as OS drive – Samsung USB 3.0 Flash Drive FIT 32GB
It does have fast read, and a not that slow write, according to Samsung: Up to 130 MB/s

The week passed with setting up and installing VMs – using the actual VMs etc.
But when installing Windows Updates on the Hyper-V host, installing Features/Roles or anykind of configuration, it seems to slow down to useless/freeze.

Running a full Windows Update took about 2 days to reach fully patched level.
During that time it was useless as in no respondig.

I ran a WinSat drive test on the Samsung USB Flash Drive:

Random 16.0 Read: 8.87 MB/s
Random 16.0 Write: 5.45 MB/S

Random reads and writes seems pretty low.

The sequential seems a bit better:

Sequential 64.0 Read: 76.89 MB/s
Sequential 64.0 Write: 86.95 MB/s

The Commands used with winsat:
Winsat disk -drive C: -ran -write (Random 16.0 Write)
Winsat disk -drive C: -ran -read (Random 16.0 Read)
Winsat disk -drive C: -seq -write (Sequential 64.0 Read)
Winsat disk -drive C: -seq -read (Sequential 64.0 Write)

So I decided to replace to Samsung USB 3.0 Flash Drive FIT as a OS Drive.

The new hardware choosen ended up being:

1 x StarTech.com USB 3.0 to M.2 SATA External SSD Enclosure with UASP
1 x Samsung 850 EVO M.2 2280 SSD – 250GB

SM2NGFFMBU33 - StarTech.com USB 3.0 to M.2 SATA External SSD Enclosure with UASPMZ-N5E250BW - Samsung 850 EVO M.2 2280 SSD - 250GB
NOTE: the StarTech.com enclosure does not support NVMe, so did choose a m.2 SSD.

I know that StarTech also have USB 3.1, but i really do want to keep the USB 3.1 port free for an additional RAID enclosure when/if needed. Properly a StarTech enscloure but not sure yet.. (USB 3.1 (10Gbps) External Enclosure for Dual 2.5″ SATA Drives) still looking for a nice USB 3.1 enclosure that supports m.2 NVMe…

Samsung states the specs for the new disk as:

  • Up to 500MB/s Sequential Write
  • Up to 540/s Sequential Read

The actual performance test on the Samsung 850 EVO M.2 2280 SSD:

Random 16.0 Read: 276.51 MB/s
Random 16.0 Write: 271.37 MB/S

Sequential 64.0 Read: 388.85 MB/s
Sequential 64.0 Write: 383.71 MB/s

So in any case it’s quite a performance boost for the OS disk.

 

The new LAB and home datacenter

Posted on by
1

Finally i managed to setup the new lab and home-datacenter.

Due to several home limitations (cost of power, space and noise)

The decision was clear:

1 x Intel NUC Skull Canyon NUC6i7KYK

2 x G.Skill Ripjaws4 SO DDR4-2133 DC – 16GB

1 x USB 3.0 to Dual Port Gigabit Ethernet Adapter NIC w/ USB Port

2 x Samsung NVMe SSD 960 EVO 1 TB

1 x Samsung USB 3.0 Flash Drive FIT 32GB

The NUC can run RAID 0 and 1 on the internal NVMe drives, i’m going for RAID 0 (Stripe)
This is where it gets a bit interesting.. Mostly i’m going to run VM’s within Hyper-V.
Hyper-V and deduplication that is… of course.

I needed to move the OS to another disk, for maximum storage.
Keep in mind, deduplication will not run on OS/System disk.

This is where the USB Flash Drives comes in handy, Windows Server 2016 can run directly on that, leaving me with 2 full NVMe drives in RAID 0 and deduplication – YAY!

that’s the hardware part 🙂

 

 

 

The follow up post is here: https://blog.thomasmarcussen.com/follow-up-on-the-home-datacenter-hardware/

Authenticity of Petya decryption key confirmed

Posted on by
Reply

The author of the original Petya ransomware going by the name of Janus Cybercrime Solutions, has released the master decryption key of all past Petya versions.

This key can decrypt all ransomware families part of the Petya family except NotPetya, which isn’t the work of Janus.

Janus released the master key on Wednesday in a tweet that linked to an encrypted and password-protected file uploaded on Mega.nz.

Malwarebytes security researcher Hasherezade cracked the file yesterday and shared its content:

Congratulations!
Here is our secp192k1 privkey:
38dd46801ce61883433048d6d8c6ab8be18654a2695b4723
We used ECIES (with AES-256-ECB) Scheme to encrypt the decryption password into the “Personal Code” which is BASE58 encoded.

The key is tested and confirmed by Kaspersky Lab.

Disable SMB1 on Windows

Posted on by
1

Disable SMB1 on Windows

To defend yourself against WannaCrypt and other ransomware it is imperative that you disable SMB1 as well as install the patches released by Microsoft.

Open Control Panel > Programs & Features > Turn Windows features on or off.

In the list of options, one option would be SMB 1.0/CIFS File Sharing Support. Uncheck the checkbox associated with it and press OK.

You can also use powershell

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 –Force

On Windows servers you can use the Powershell command: Remove-WindowsFeature FS-SMB1

Protect Yourself Against Petya Ransomware

Posted on by
Reply

The malware requires administrator rights to the local computer. Standard users should not have this in permission. Consider restricting who has local admin rights to prevent execution of exploit code within organisations. Home users should also consider using a Standard User Account for day-to-day operations.

Access Director can help you by removing permanent local admins.

Recommendations for Enterprises

  • Deploy the latest Microsoft patches, including MS17-010 which patches the SMB vulnerability.
  • Consider disabling SMBv1 to prevent spreading of malware.
  • Educate end-users to remain vigilant when opening attachments or clicking on links from senders they do not know.
  • Ensure you have the latest updates installed for your anti-virus software.
  • Ensure you have backup copies of your files stored on local disks. Generally, user files on local drives are replicated from a network share
  • Prevent users from writing data outside of designated areas on the local hard disk to prevent data loss if attack occurs.
  • Operate a least privileged access model with employees. Restrict who has local administration access.

Petya does not encrypt files. it encrypts the Master File Table, which is the index of where all the files are stored on a hard disk drive.

“Petya uses the NSA Eternalblue exploit but also spreads in internal networks with WMIC and PSEXEC. That’s why patched systems can get hit.”
Mikko Hypponen confirms, Chief Research Officer at F-Secure.

PT Security, a UK-based cyber security company and Amit Serper from Cybereason, have discovered a Kill-Switch for Petya ransomware. According to a tweet, company has advised users to create a file i.e. “C:\Windows\perfc” to prevent ransomware infection.

 

Installing PHP for IIS Using Microsoft Web Platform Installer Offline

Posted on by
Reply

You may need to install PHP for IIS using the offline installer

  1.  Download and install the Microsoft Web Platform Installer to a computer that has Internet access and to the server where PHP is to be installed. from http://php.iis.net
  2. Create a local folder for the WebInstallerCache
  3. WebPICMD.exe /List /ListOption:All >C:\TEMP\WebPIOffline\Products.txt
  4. Review the Products.txt for needed products to install.
    I needed PHP54, PHPManager and SQLDriverPHP54IIS
  5. Run the following commands from the computer with internet access
    1. WebPICMD.exe /Offline /Products:PHP54 /Path:C:\TEMP\WebPIOffline
    2. WebPICMD.exe /Offline /Products:PHP54 /Path:C:\TEMP\WebPIOffline
    3. WebPICMD.exe /Offline /Products:PHP54 /Path:C:\TEMP\WebPIOffline
  6. Copy the WebPIOffline folder to the server without internet access
  7. Run the following commands from the computer without internet access to install the products
    1. WebPiCmd.exe /Install /Products:PHP54 /XML:C:\WebPIOffline\feeds\latest\webproductlist.xml
    2. WebPiCmd.exe /Install /Products:PHPManager /XML:C:\WebPIOffline\feeds\latest\webproductlist.xml
    3. WebPiCmd.exe /Install /Products:SQLDriverPHP54IIS /XML:C:\WebPIOffline\feeds\latest\webproductlist.xml

Products should now be installed and you can continue with your configuration

Install Spotify for Kodi (Krypton Jarvis)

Posted on by
Reply

I prefer to use Kodi on my Raspberry pi, its simple and running very well.
Unfortunately there is no native support for Spotify – Marcel van der Veldt to the rescue.

Marcel put up a nice music add-on for Spotify, it even works very will with Spotify Connect/Streaming devices.

  1. Download and copy the Marcelveldt Repository zip file to your Kodi box
  2. Open Kodi -> System -> Add-ons – > Install from zip file (if you copyed to another folder then the repository folder, the use “browse in root file system”)
  3. Install and wait for add-on enabled notification
  4. Go to install add-on from repository and select Marcelveldt’s Beta Repository.
  5. Select Music Add-ons
  6. Select Spotify
  7. Select Install
  8. Wait for add-on enabled notification
  9. Select Spotify
  10. Select Configure
  11. Add your Spotify username and Password
  12. Reboot

..And you’re done! 🙂

You can access your Spotify playlists from music add-ons.
Your device will also be visible for streaming to/from – I tested it from my iPhone 7, works great! 🙂