[Solved] At a Lost with Windows 2012

In trying to get the Splunk tech add-on TA-nessus from Hurricane Labs to work on a pair of Windows servers, I created some DOS batch files that works fine when manually run. They also run fine on a Windows 2008 R2 server running a Splunk Universal Forwarder. Here is one of batch files, update_plugin_lookup.bat:

@echo off

rem -- To get rid of cygwin's complaints about DOS style path:
set CYGWIN=nodosfilewarning

E:\cygwin64\bin\bash.exe "%SPLUNK_HOME%/etc/apps/TA-nessus/bin/update_plugin_lookup.sh" %*

Then the shell script, update_plugin_lookup.sh, is modified to this to work with Cygwin's bash and python:

#!/bin/bash

#unset LD_LIBRARY_PATH

export PATH="/bin:/usr/bin"
cygpath=`which cygpath 2>/dev/null`
if [ "$cygpath" != "" ]; then
    splunk_home=`"$cygpath" "$SPLUNK_HOME"`
    export SPLUNK_HOME=`"$cygpath" -w "$SPLUNK_HOME"`
fi
export PATH="$PATH:$splunk_home/bin"

#cd $( dirname "${BASH_SOURCE[0]}" ) || cd "$splunk_home/etc/apps/TA-nessus/bin"
cd "$splunk_home/etc/apps/TA-nessus/bin"

./update_plugin_lookup.py $*

The problem is, on a Windows 2012R2 server running a Splunk search head, the scripted input running the update_plugin_lookup.bat command only generates a line in the splunkd.log file that reads:

09-23-2014 04:15:00.013 -0400 ERROR ExecProcessor - Couldn't start command "E:\Splunk\etc\apps\TA-nessus\bin\update_plugin_lookup.bat": The operation completed successfully.

I checked file permissions for the local SYSTEM account on the 2012 server, as I suspected that may be a factor. But that did not seem to be the issue.

I have downloaded the PsTools from SysInternals and manually run the batch command as the local SYSTEM user. That worked without a hitch.

I am at a lost of ideas to try at this point, so I am going to post this to Splunk Answers and other forums to beg for help.

[Edit - Problem resolved] :  This turned out to be a file permission issue, after all. I thought I did grant executable permission to local SYSTEM on the 2012R2 server. But I did not succeed in doing that. Then because I was able to run the batch command file as local SYSTEM with the help of PsExec, I let the suspicion slip out of my mind.

Cygwin OpenSSH Server

SSH is a Swiss army knife of secure remote access and much more. It has been prevalent on all operating systems but glaringly missing from all versions of Microsoft Windows. Which is one of the reasons I put Cygwin on every Windows machine I am allowed to install software on.

Installing the SSH service in Windows has become much easier with the newest version of Cygwin, as instructions found online changing from that long to this short.

Yes, it is that simple to setup OpenSSH in Windows now. But problems do occur. The easiest way to fix an OpenSSH SSHD service installation problem is probably to follow the Cygwin SSHD HowTo: How to run the OpenSSH SSHD server on Windows using Cygwin instruction, remove an old installation and reinstall.

One particular installation I botched kept giving me Windows error code 1069 when trying to start the service. I double checked the user id configured for the service but could not find anything wrong. As it turns out, one thing I need is to make sure that the /var/empty folder (in Cygwin) is owned by and writeable to the user running the sshd service, which is cyg_server if you follow the short instructions above and run ssh-host-config -y to setup the sshd service.

After the installation and starting the service, you should be able to test it by opening a Cygwin terminal window and connect to the computer itself using ssh localhost.

If you can connect to the localhost but not from a different computer, you may need to add a Windows firewall exception for SSH by allowing incoming connection to TCP port 22.

While writing this note, I found the two part tutorial The 101 Uses of OpenSSH (Part 1 and Part 2, published in the LINUX Journal on Jan 01, 2001 by Mick Bauer) to be a quite comprehensive read. But still, SSH offers much more.

Monitoring a Lenovo ThinkServer, with Help from Cygwin

The box is running Windows 2008 Server Foundation, which is a bare bone of Windows server software. But it works for a small business that has software that only runs on Windows.

The Lenove ThinkServer 100 series support an Intel SATA RAID controller. To monitor the RAID system, one may install the Intel Storage Management Console as described in this manual on page 10.

But there is a problem. Windows 2008 Server Foundation does not come with a mail server. The Storage Management Console is only capable of sending out notification of any issue in the storage system via plain vanilla SMTP (Simple Mail Transport Protocol), with no support for a smart-host kind of configuration.

Here is where Cygwin and its arsenal of software carried over from the UNIX/Linux world can help. I did not start out knowing what to do exactly. But simple Google search of Cygwin SMTP proxy turns up a lot of reading material. By the way, Cygwin should be on every Windows machine, just for packages like grep, openssh and rsync that comes with it if nothing else.

Following this article about running exim on Ubuntu to send email via Gmail, I have been able to get it up and running in short order. Installing exim is not very difficult. As of this writing, Cygwin comes with exim version 4.76-1. After installation, one runs exim-config to configure it.

There are things that need to be further configured. The line below to add the local network for mail relay:

hostlist   relay_from_hosts = 127.0.0.1 : 192.168.1.0/24

 To route mail not for local domains via Gmail:

begin routers
send_via_gmail:
        driver = manualroute
        domains = ! +local_domains
        transport = gmail_smtp
        route_list = * smtp.gmail.com

 To configure the Gmail SMTP service:

begin transports
gmail_smtp:
        driver = smtp
        port = 587
        hosts_require_auth = $host_address
        hosts_require_tls = $host_address

 Gmail SMTP server requires user authentication:

begin authenticators
gmail_login:
        driver = plaintext
        public_name = LOGIN
        client_send = : your-account@gmail.com : your-account-password

That's it! After that, start the exim service using net start exim. From the Intel Storage Management Console, one may then configure it to use the local server as the SMTP server to send out email when issues occur.

Windows Server 2003 Scheduled Task Problem

This problem popped up for the second time today: When scheduling a weekly task on a Windows 2003 server, I got this error message:

0x80090016: keyset does not exist

A simple Google search led me to this Microsoft Knowledge Base article,

But I could not find the registry entry mentioned in that article, at all:

HKEY_USERS\.DEFAULT\Software\Microsoft\Cryptography\UserKeys\Schedule

It seems that Windows 2003 is a beast vastly different from 2000. Some more research later, I found this blog entry by John Daskalakis. However, I could not find the registry key mentioned there either.

Fortunately, I did find this folder:

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18

So, I simply renamed that folder to something like "S-1-5-18-Not-used" and restarted the server. Problem solved.

Not sure why both articles mention "boot you computer in Safe mode", which seems unnecessary -- I had no problem renaming the folder in a Cygwin bash window.