Craig Box's journeys, stories and notes...


Archive for June, 2007

Fixing the password problem on small business networks

Thursday, June 28th, 2007

I've been involved in commercially supporting Windows networks for almost 5 years now, having dealt with a hundreds of users across dozens of different companies.  Most of the clients we support are "small businesses", which makes sense, as it is quoted that as 97.3% of private enterprise in NZ is small/medium sized, accounting for 49.4% of private sector employment.

These companies, in the most part, don't have the infrastructure for a large, homogeneous IT environment.

And you know what?  They couldn't care less.

They make do with what they always have - buying PCs piecemeal, having Office 2000 on some PCs and Office 2003 on others, and - the kicker - knowing everyone else's passwords, instead of sharing data.  Even though products like Microsoft Exchange allow you to do things like delegate access to someone else's mailbox, they still claim they need to all have their passwords set to 'password', or documented in a book, in case they need to sit at someone else's PC.

People don't do what PCs suggest they should do. No one really wants the multi user functionality that PCs have now.  In small business, people want to be able to use the line-of-business application, a web browser, and access their own e-mail and files. They might like the idea of having some personalisation (some care for it, some don't), but overall, having to log out as you and log in as me takes longer than the effort required just to use the application as set up on your profile.

So, as a sysadmin, I want people to use strong passwords.  I have to wean them off the idea of needing someone else's password to get at their data.  And I want to work how they work, not how I think they want to.  They want the desktop you use when you're filling in for someone to look like it did when they were learning over the first person's shoulder.

The primary solution put forward by Microsoft is "roaming profiles", where you can log into any machine, and have your applications loaded.  Say you've got a shortcut to Word 2003 on your desktop, and you roam that profile to a machine with Word 2000 on it.  Doesn't work.  Good for volume licensed customers with the same software on all PCs, but not good for us.  Doubly bad when you look at how people actually work - the accounts clerk has MYOB and payroll software installed, some managers will have banking software for authorising transactions, sales people may have a line-of-business application that analysts don't need, etc.  It's not worth ensuring that the software is on everyone's machine, it means unnecessary licensing costs, and in the case of things like payroll software, people want to know it's not available to everyone.

So, roaming profiles are out.

When someone is away, their mail and phone are diverted, but their PC sits there unused, or someone has to sit at the desk - they try and find the icons you used to click, but their new profile doesn't have the shortcuts, or the per-user registry keys required for some random application.

Let's look at some other possible solutions:

Terminal services or Citrix MetaFrame

Put everyone on a thin client and make everyone use a central server.  Good plan, large investment required, takes a lot of time to change from an office of fat-clients to a thin-client environment, and not all SME apps are TS friendly.  Also, if you scale to needing more than one TS, then you're back at square 1 with needing the apps to be in synch across two machines.

Virtual machinery

Abstract the access away from the machine - have a bunch of passwords all able to unlock the same machine.  Wasteful.

Change someones password temporarily if you need to use their account

Tried this.  At present, there is no way for the Administrator to change someone's password, store the original hash, and set it back at a later date.  I think it's worth implementing though.

Cheat biometrics

Biometric sensors, like the fingerprint scanner on my T60 laptop, can be 'cheated': in an office of 10 people, with 10 fingerprints able to be stored, why not store everyone's fingerprint on everyone's computer?  Requires buying a scanner for everyone's PC.

Insecure machine accounts, delegated access to data

Why not have everyone have a 20 character password, but have a single password for logging into the machine in the morning?  You could have a "machine user" account on each machine, and delegate e-mail access for everyone necessary to the machine.  A bit more administrative overhead but a possible solution.

Craig's "Silver Bullet" answer

My favourite suggestion is delegating access to your profile, or your profile/PC combination.  This is what Exchange lets you do now with e-mail - why not extend this to user accounts also?  Presumably, the component (a "GINA") that that handles authentication for the fingerprint reader, could be made to start loading another account, separate from the one you entered the password for?

Therefore, we can have a 1:1 mapping of people to passwords, so no-one ever has to know anyone else's, and then we can have a 1:many between computers and users, without needing messy multiple profiles.

Anyone see any problems with this approach?  If not, why haven't you written it yet?  Look perhaps at pGina as a base. My (ex-)small businesses will pay.

Cool shit for cheap. Support a good cause!

Monday, June 25th, 2007

Note: this stuff is all sold.

Today's cool shit you can get for cheap:

  • IBM X220 4U tower server
  • IBM X232 5U tower server
  • IBM X346 2U rack server w/Windows 2000 SBS
  • IBM X300 1U rackmount server
  • IBM X225 4U rackmount server
  • Compaq Proliant ML350 G3 w/Windows 2000 SBS
  • IBM X200 4U rackmount server
  • 3Com OfficeConnect VPN Firewall
  • Cisco C1912 Catalyst 1U Rack 24x10Mbit/2x100Mbit
  • Farallon Ether10-T Starlet/16 Rackmount Hub
  • HP LaserJet 1000
  • Pleaides USB 2.0 / LAN disk enclosure

FoamyEspecially cool is the G3 server, which has its hard drives packed like this.

This should be the last run of servers we sell before I leave IT Partners. Also, be warned that the X200 is my personal machine, and the more you bid on it, the more money I can put on the bar at my leaving party!

Album distribution

Saturday, June 23rd, 2007

Guess what year that acquiring music from the Internet really came into its own...

MP3 album distribution

USB devices and drive letters

Friday, June 22nd, 2007

A year ago, I ranted about the fact that Windows will map a newly added USB drive on the first available drive letter, even if there's a subst'd or mapped network drive on that letter.

Kyle pointed me to USBDLM, the USB Drive Letter Manager. This is a piece of software that, as well as working around this bug, will allow you to ensure that bad USB devices are always mapped to the same drive letter. It's free for personal or educational use, but costs for commercial use. Not that it's really a solution - Microsoft, this is a simple bug that you could fix today. It is an exercise for the reader to get Raymond Chen to tell me why it's not as simple as I think.

Mongrel upload progress problem - cause found

Friday, June 15th, 2007

Per my previous post on upload progress in Rails, I can now confirm:

The certificates must be in PEM format and must be sorted starting with the subject's certificate (actual client or server certificate), followed by intermediate CA certificates if applicable, and ending at the highest level (root) CA.

Which means, cat site.cer chain.cer Equifax_Secure_Global_eBusiness_CA-1.cer site.key > site.pem.

I've backported Pound to Ubuntu Dapper, from Debian Testing. Dapper only has 1.0, which might work, but the configuration has changed beween 1.x and 2.x, which makes the examples incorrect.

SpamAssassin 3.2.0 backport for Ubuntu Dapper

Wednesday, June 6th, 2007

I've built packages for SpamAssassin 3.2.0 for Ubuntu Dapper. They are available in my firewall repository with the dependencies (libnet-dns-perl, libnetaddr-ip-perl, libmail-spf-perl):

deb http://ubuntu.hs.net.nz dapper firewall

If you use this repository, you'll get a new version of ClamAV, and some other packages also. Beware.

It was a bit of a mission to build, but made easier with the Prevu tool. This is like pbuilder for backports, and anyone doing anything with backports should use it. You can use the 0.4.1 release on Sourceforge on Dapper.