TechKnowFile 04

Tools for Windows

System Support

Lloyd Smith

Department of Computer Science

lloyd@cs.toronto.edu

Agenda

Tools for User Support
- System Design
- User Education

Software Tools for Servers
- Samba:	file, print, authentication
- Poptop:	Virtual Private Network (VPN)

Software Tools for Workstations
- Windows :	Cygwin (Xserver)
- Linux OS :	VMWare (hardware emulation)

What's that noise?!?

Tools for
User Support

Userbase

Administrative Staff

20 Windows workstations

5 Linux workstations

25 users

Student labs (CDF)

100 Windows

100 Linux

50 Xterms (Linux)

6 application & compute servers (Linux)

3000 users

Network Design Considerations

Security

Reliability

Redundancy

User preference

Security: UTorSUS.reg

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

"NoAutoUpdate"=dword:00000000

"AUOptions"=dword:00000004

"ScheduledInstallTime"=dword:00000004

"UseWUServer"=dword:00000001

"ScheduledInstallDay"=dword:00000000

"RescheduleWaitTime"=dword:00000004

"NoAutoRebootWithLoggedOnUsers"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]

"WUServer"="http://update.utoronto.ca"

"WUStatusServer"="http://update.utoronto.ca"

Security: lock down C:

xcacls.exe "C:\Documents and Settings\All users\Start Menu" \

/T /E /C	\
/G Administrators:F	\
/G System:F	\
/G Users:R

Other examples:

“Creator owner”:C

Users:RW

Network Design Considerations

Security

Reliability

Redundancy

User preference

Network Design Considerations

Security

Reliability

Redundancy

User preference

Redundancy

“Belt and suspenders” approach

Windows 2000 offline files

Webmail

Network Design Considerations

Security

Reliability

Redundancy

User preference

User Choice

Web browsers

Email clients

OS's

Design Summary

There are two ways of constructing a software design; one way is to make it so simple that there are obviously no deficiencies and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult. - C. A. R. Hoare

User Support Tools

Manuals and books

FAQ's

Webpages

Tutorials

User Support Tools

Manuals and books

FAQ's

Webpages

Tutorials

User Support Tools

Manuals and books

FAQ's

Webpages

Tutorials

User Support Tools

Manuals and books

FAQ's

Webpages

Tutorials

Agenda

“Wetware” Tools for Users
- System Design
- User Education

Software Tools for Servers
- Samba:	file, print, authentication
- Poptop:	Virtual Private Network (VPN)

Software Tools for Workstations
- Windows :	Cygwin (Xserver)
- Linux OS :	VMWare (hardware emulation)

Network layouts

Mainframe
ASCII “dumb” terminals

Peer to peer

Boot from Network

Windows PDC

Samba PDC

Network layouts

Mainframe
ASCII “dumb” terminals

Peer to peer (Macintosh, staff only)

Boot from Network

Windows PDC

Samba PDC

Network layouts

Mainframe
ASCII “dumb” terminals

Peer to peer

Boot from Network (Netware, 1st year students)
1991-1997

Windows PDC

Samba PDC

Network layouts

Mainframe
ASCII “dumb” terminals

Peer to peer

Boot from Network

Windows PDC (Staff 1995-2004)

Samba PDC

Network layouts

Mainframe
ASCII “dumb” terminals

Peer to peer

Network boot
DOS/Win3.1 diskless machines

Windows PDC

Samba PDC (Students 1997 → Staff 2004 →)

What is Samba?

Samba is a suite of tools for sharing resources such as printers and files across a network

Runs on many platforms (Unix, BSD, OS X, Netware, VMS, OS/2)

Provides authenticated access to file and print services

Client software for Windows, Mac and Linux

Why Samba?

Solaris server experience (vs Netware)

Easy remote server administration (ct WinNT)

No client install on Windows machines

Unification with Unix filesystem (first year vs upper year, TA's instructors)

Server hardware spare parts

Free

Samba Experience

Installed samba versions 1.19a to 3.0

Sparcstation 5 running Solaris
Dell GX1 running RH 7.3

WinNT 4.0, Win 2000, Win XP clients

Occasional bugs, issues, gotchas

Overall very positive

Samba Overview

2 daemons smbd, nmbd

/etc/samba/smb.conf

/etc/samba/smbpasswd

Scripts for password change and printing

Assorted client software smbclient smbpasswd smbstatus

SWAT

Samba: PDC

/etc/samba/smb.conf

[global]

workgroup = CDF

domain master = yes

logon path = \\%L\%U\.NTProfile

logon home = \\%L\%U

logon drive = h:

[netlogon]

comment = Network Logon Service

path = /cdfpc/netlogon

guest ok = no

writable = yes

locking = no

public = no

Samba: PDC

Create user accounts for machines in
/etc/passwd

Run 'smbpasswd -ma machinename'

From Windows machine join domain

Change root password for smb authentication

Samba: Passwords

Run crypt to generate /etc/shadow entry
perl -e 'crypt ($password, $salt)`;

Python snippet to generate smbpasswd
def NTPasswordHash( self, password ):
"""Returns a 32-character MD4 password hash (Win NT and above)."""
from Crypto.Hash import MD4
md4 = MD4.new()
md4.update( unicode(password).encode('utf-16-le') )
md4hash = md4.hexdigest().upper()
return md4hash

Samba: home directory

[homes]

comment = Home Directories

browseable = no

writable = yes

public = no

hide dot files = yes

directory mask = 700

create mask = 600

Samba: Printers

/etc/samba/smb.conf

load printers = yes

printcap name = /etc/samba/printcap

[printers]

comment = All Printers

path = /var/samba/spool

browseable = yes

print command = /cdfpc/sbin/smbprnfilt %u %p %I %m;\

/local/bin/lpr -P %p %s; /bin/rm -f %s

lpq command = /local/bin/lpq -P%p

lprm command = /cdfpc/sbin/smblprm %u %U %p %I %m %j

printable = yes

Samba: Printers

Run smbd on print server

Can filter jobs before printing

Can send popups (using smbclient) when job is submitted – not post notification

Samba: Shares

/etc/samba/smb.conf

[staff]

comment = system maintenance workspace

path = /admin

public = yes

printable = no

browseable=no

writable = yes

create mask = 664

directory mask = 775

valid users = @staff

Samba: Preexec

/etc/samba/smb.conf

[wwwsetup]

preexec = /cdfpc/sbin/wwwsetup %H

comment = Setup CDF Home Page function

path = %H

browseable = no

writable = no

guest ok = no

follow symlinks = no

preexec close = yes

Samba: smbclient

Unix command line utility

Provides ftp like functionality to Windows system

% smbclient //b2200-01.cdf.toronto.edu/c$ \

password -U B2200-01\\Administrator \

-c 'PUT newApp.lnk winnt\\profiles\\All Users\\Desktop '

PoPToP

Point to Point Tunneling Protocol Server

Open Source poptop.sourceforge.net

Separate passwords from unix accounts

Works with Window's VPN client

Appears like new NIC when active

PoPToP

All traffic between nodes is encrypted

No need to forward ports

Works for UDP traffic also

Protects smb without need for SSL

Agenda

“Wetware” Tools for Users
- System Design
- User Education

Software Tools for Servers
- Samba:	file, print, authentication
- Poptop:	Virtual Private Network (VPN)

Software Tools for Workstations
- Windows :	Cygwin (Xserver)
- Linux OS :	VMWare (hardware emulation)

Xservers

Xwin32 Starnet

eXceed Hummingbird

Xwin.exe http://www.cygwin.com/xfree/

Xservers

xdmcp cannot be tunnelled over ssh, use in trusted networks

For secure connections over untrusted
networks run WM locally, tunnel X clients
over ssh with '-X'

VMWare

Provides x86 hardware emulation

Runs on x86 hardware (no Sparc)

Commercial product

http://www.vmware.com/

VMWare

Used at DCS to provide access to AMS, MS Office for Linux users

VM can join domain

Automatic Updates can be problem

Services for Unix

Provides selection of unix command line utilities (no X server)

Comparable to GNU utilities

Free as of Jan 2004

http://www.microsoft.com/windows/sfu/

Resources

www.samba.org

Using Samba (O'Reilly)

www.poptop.org

www.cygwin.com

www.vmware.com

www.microsoft.com/windows/sfu

I want to cover the topic of support tools from three angles in this talk. Software on the backend systems, frontend software on workstations, material for end users, the overall “user experience”.

It is intended to be an overview, rather than an in depth discussion of configuring and using every aspect of every tool mentioned. I will concentrate on software that is “off the shelf” i.e. readily available, not developed in house or requiring extensive local customization.

We'll begin with some elements that are more concepts than actual

products. Ideas like system design and user education.

We will look at back-end tools for system administrators,

such as Samba which runs on Unix-like servers and provides services to Windows-like clients

poptop provides PPTP (Point to Point Tunnelling Protocol) for encrypted traffic between nodes, allowing secure connections from untrusted networks.

Then we will see how it looks

Client machines can access services native to the platform they are running on. Tools to provide access to foreign services are available, Cygwin provides an Xserver on Windows, VMWare provides a native windows machine within Linux.

A guy walks into a hardware store and puts a chain saw on the counter.

“Last week I came in to buy a bow saw to cut firewood for the winter.” he says. “You sold me this instead. You said it would cut ten times as much wood in half the time.

I've worked all week with this damn thing and I don't even have enough wood to last till the end of the month! Give me my money back!”

The service clerk examines the saw, saying “I'm sorry sir, there must be something wrong.”

He pulls the cord and the customer looks up and says ...

When you deal with the same gear close up everyday it's easy to lose track of the big picture. Computers and networks exist in corporate environments as productivity tools for employees. If not for their impact on the bottom line of companies there would be no investment in the infrastructure. Companies like IBM and Microsoft made their fortunes because they based their pricing on how much would be saved in reduced expenses. Banks could afford million dollar mainframes only because they replaced thousands of clerks and accountants.

Users need to be able to use the systems efficiently, but they cannot be expected to come in fully prepared. It is important that they become aware of best practices, stay informed of new procedures and can refer back or refresh their memories of tasks they perform infrequently.

Whether it's staff or students you deal with, the pool we draw our users from does not guarantee a particular level of basic experience. If you design your system with the hope that users will instinctively know what they want or even that they will just altruistically share acquired knowledge with others you are setting yourself up for failure.

This means designing systems with the required tasks in mind, documenting it and communicating the information to the “end” users, because it doesn't matter if you call them clients, customers or zooplankton the fact remains that if they die off, we starve.

These are the 2 user communities I deal with.

Admin: day to day departmental infrastructure: Payroll, Finance, HR, Undergrad & Grad offices.

- printing (fonts, FedEx, colour etc)

- system status (email, connectivity etc)

- app eval'n recom'n instal'n (eg screen capture, pdf)

Student: instructional systems. Programs required for coursework. Instructor requests.

Issues:
- “own” vs shared machine

- influx of new students 3 times/year; staff at irregular intervals.

- motivation to pick up new info

- frequency of use of system

Common to both, centrally owned installed managed

workstations. Windows 2000

Topping the list is security.

Security is an integral part of support.

An insecure platform does not provide support.

Enable automatic updates on all Windows machines on your network.

AU: Win2k SP3 or XP SP1

Installable on pre-sp3 2K

NT Win98 end of life – no updates

Type 12 lines using notepad and save it on a network share. Double click or run
“ regedit /s x:\path\to\UTorSUS.reg”

Ref:

Sets NTFS permissions on HD by user or group.

MS's default user settings are getting better, but cannot rely on them to do the right thing.

Ref: jsiinc.com & 2K Resource Kit

N.B. With drive write protected, viruses do not infect machine when users detonate them.

Eat your own dogfood

Say what you mean, mean what you say.

Aside:

Service level agreements ? Users would know where lines are drawn.

“Belt and suspenders” approach

Alternatives or failover plans, network disruptions, burst water pipes etc.

Whenever possible look for ways to

strengthen the network.

Generally consequences to this, increased complexity of network, communicating failover event notification to users and instructions for what to do instead.

Payoff is ability to “ride out the storm”.

offline folders: User's network files cached on hard drive (in c:\winnt\CSC\ ) => possible security issue if data sensitive enough.

webmail (Squirrel mail) provides alternative if user's primary email client config'n is corrupted

User's perspective => just wants it to work most of the time and have an alternative when it doesn't. Some element of choice or empowerment.

Software choices, from OS (2) to email clients, (4-5) web browsers etc.

Receptiveness varies by user. Important way to help is documentation.

User's perspective => just wants it to work most of the time and have an alternative when it doesn't. Some element of choice or empowerment.

Software choices, from OS (2) to email clients, (4-5) web browsers etc.

Receptiveness varies by user. Some adapt readily to change, others can be overloaded by too many choices. Important way to help is documentation.

Pros

Detailed explanations

Cons

Not site specific

Time consuming to read

Resource intensive (money, paper or network)

Difficult to find good reference

Pros

Site specific

Less resources, cost

Cons

Time consuming to create

Need to be kept up to date

Difficult to follow, non graphical

Pros

Graphics/screenshots improve usage

Site specific

Potentially somewhat interactive

Cons

Need to be kept up to date

Time consuming

Eg:

http://www.cdf.toronto.edu/workathome/

Pros

Site specific

Interactive

Cons

Extremely time consuming

Staff and scheduling issues

First/second year students, instructor or TA led sessions hands on once or twice a year

Staff “canned” tutorials, eg RoboDemo

http://www.cs.toronto.edu/~lloyd/TKF04/cvsdemo.swf

We will look at back-end tools for system administrators,

such as Samba which runs on Unix-like servers and provides services to Windows-like clients

poptop provides PPTP (Point to Point Tunnelling Protocol) for encrypted traffic between nodes, allowing secure connections from untrusted networks.

Dumb terminal vs punch cards

Staff and students relatively same (?)

Staff used a Mac network in peer to peer arrangement

Small network 10-12 users

Needed dedicated wires, & appletalk printing.

User logged into one machine with third party password system on that machine. Couldn't use someone else's computer.

Data files were stored locally, co-mingled with application files.

Backups were done with Retrospect.

First year student labs.

286/386 CPU, storage floppy initially

Pentium w/local HD in 1995

Netware avoided much of the problems with the Mac network, at some cost:

annual server license,

learning curve for sys administration

Used by first year students, years 2 - 4 used a different network (Solaris).

NT 3.51 server in 1996 switch-over for staff began the Great Mac Migration

last Mac decommissioned 2001.

Centralized authentication, storage & printing

Small # users at first, ½ remained as Mac users

Initial hardware for server was desktop system reliability issues

Mac supported by enabling NT4 Apple file sharing (gone in W2K ?)

Server hardware replaced in 2000

WinNT 4.0 on desktop

By 1997 desire to move to the new OS/ interface of Win95

Windows NT workstation required local boot

Samba on Solaris switch-over for students summer 1997. NT4 workstation on desktop.

Samba PDC for staff spring 2004

Provoked by NT4 server end of life on security updates

Runs on *nix, BSD, Mac OS X, Netware, VMS, OS/2

To go in the other direction use MS SFU, available free as of Jan 2004.

Authentication:

printing vs lpr

Native windows print management

file access vs NFS
Native support under Windows for client
Linux distros include samba

Server experience vs Netware

Novel's prospects looked rocky

Remote admin, GUI and command line vs WinNT

File unification

1st year vs upper year students

TA's & instructors had to mark code, required scripted/automated methods for marking. Unix scripting tools top notch.

Over six years of use.

Bad News

Server thrashed under heavy login / printing load. (143 MHz CPU )

For first few years frequently revisions & updates were required due to client OS changes (service packs etc.) often after the problems were apparent :(

Joining domain under NT vs 2000

Good News

Stable back from bleeding edge

Works as advertised mostly

1 GHz CPU better performance for supporting 100 pc's (upgraded last year)

smbd provides share services

nmbd provides netbios name services

smb.conf comes extensively commented

various secondary tools

SWAT web interface: use with caution,

disabled by default, accepts connections

from localhost by default when enabled,

overwrites smb.conf stripping out all comments – not used at DCS, but might make adjustments easier for some sysadmins

The account 'root' is required to join the domain. Do not set the same smbpasswd entry for root as for the unix system. This will allow you to give a junior administrator (aka summer student:) the ability to install a lab.

Our in house passwd runs the user's putative password against cracklib to check for insecure passwords (dictionary etc.) If it passes it is hashed in two ways and stored twice.

Unix crypt'd hash goes in /etc/shadow

/etc/samba/smbpasswd gets the MD4 and LM password hashs (LM code not shown, used for DOS and Win9x authentication, hash is less secure. not required or recommended for users.)

Pre-existing users need to re-run 'passwd' to get the MD4 hash entered. (can reset to the same password).

Important: make the full password is passed to the NTPasswordHash routine, our unix system truncates at 8 characters for historical reasons, Windows allows up to 14 characters (more for w2k+3 server) and does not truncate, so a

15 character password won't match.

File and directory create masks: part of security model, readable only by the user for maximum safety.

Can pass smb print jobs through filter to clean up or enhance, eg remove PJL, adding username to output, or send printquota information via smbclient prior to printing.

For users to be able to manage print jobs samba must run on the printserver. If the login/file server just lpr's the job to the lpr server the job disappears from view.

i.e.

h:\> net use \\lpr.cs.toronto.edu\lw

Example of share accessible only by 'staff' unix group.

Run a unix command as the user with preexec by mapping the share. Can get error code and use in batch file.

eg. in logon.bat:

net use \\server\sometest

if errorlevel 2 dothis.bat

if errorlevel 1 dothat.bat

This example used at CDF to set correct permissions on public_html

Smbclient command used from unix prompt

password in clear on command line or user prompted for it (usual way).

Automation (server push) somewhat less useful due to password in clear in push script. We use a pull from client for automated transfers whenever possible.

Useful for interactive file transfer.

The tar command useful eg. to grab user's profile folder/files

Finally let's look at tools for the workstations

To display graphical unix programs requires an X server running on the Windows PC.

Cygwin's xfree port is free, the other choices are commercial. Cygwin's installation process confusing and failure prone in my experience.

Microsoft's SFU does not provide an X server, MS recommends you purchase StarNet's.

xdmcp:

eg

c:\> Xwin.exe -clipboard -query xdmserver

Tunnelling

eg

c:\> Xwin.exe -clipboard

c:\> fvwm.exe

$ ssh -X user@host

Computer Science

2004-04-24T16:31:15

Computer Science