Archives

Fedora 11 Server Installation Guide

By Atiq, on March 31st, 2011%

After reading this article you you should able to configure Fedore server for post installation and configuration of

  • NTP Server
  • SSH Server
  • Apache Web Server
  • SSL installation and Configuration
  • FTP Server
  • Setup Samba File Server
  • MySQL Server
  • PHPmyAdmin to manage mySQL database from remote locations.

[1] Download Fedora and Make a DVD for installing Fedora.

Download Fedora installation DVD ISO-file from Fedora website http://fedoraproject.org/get-fedora. Burn DVD according to instructions described on Fedora website and install Fedora according to instructions. Documentation for Fedora installation is available at their web sites and links are listed as below:

[2] Install Fedora

In this article we’re focussing to setup Fedora 11 Server.

[3] Configure Fedora 11
Initial Configuration After Installing Fedora.

[a] Add a new user.

I used user name as ‘fedora’ on following examples, but set any names you like to use.

[root@dlp ~]#useradd fedora
[root@dlp ~]#passwd fedora
Changing password for user fedora.
New UNIX password: # input password you want to set
Retype new UNIX password: # verify
passwd: all authentication tokens updated successfully.
[root@dlp ~]#exit # logout

[b] Try to switch by user that was added in section [1].

ns login: fedora # input user name
password: # input password
[pixel@dlp ~]$su - # switch to root
Password: # input password for root
[root@dlp ~]# # done to switching to root

[c] Make ‘fedora’ user that was added in section [1] be only a user who can switch to root.

[root@dlp ~]#vi /etc/group

# line 11: add user
Wheel:x:10:root,fedora
[root@dlp ~]#vi /etc/pam.d/su
#%PAM-1.0
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the “wheel” group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the “wheel” group.
# remove ‘#’ that was on the head of line
auth required pam_wheel.so use_uid
auth include system-auth
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session optional pam_xauth.so

[root@dlp ~]#vi /etc/login.defs

# add this line at the bottom
SU_WHEEL_ONLY yes

[d] Set config to forward mails for root to a user who is a system administrator you set as.

[root@dlp ~]#vi /etc/aliases

# Person who should get root’s mail
# bottom: remove ‘#’ and add user name
root:fedora

[root@dlp ~]#newaliases # set new aliases
/etc/aliases: 77 aliases, longest 10 bytes, 776 bytes total

Fw & SELinux :

[1] It’s unnecessarry to enable FireWall because it’s enable on the Routers, so Change it to disabled.

[root@dlp ~]#/etc/rc.d/init.d/iptables stop
iptables: Flushing firewall rules: [OK]
iptables: Setting chains to policy ACCEPT: filter [OK]
iptables: Unloading iptables modules: [OK]

[root@dlp ~]#chkconfig iptables off
[root@dlp ~]#chkconfig ip6tables off

[2] Change to disabled SELinux (Security-Enhanced Linux).

[root@dlp ~]#vi /etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – SELinux is fully disabled.
SELINUX=disabled # change
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted – Only targeted network daemons are protected.
# strict – Full SELinux protection.
SELINUXTYPE=targeted

[4] Installing NTP Server :

It’s an example to install and Configure NTP server for system clock.

[root@dlp ~]#yum -y install ntp
It will install NTP packages

[root@dlp ~]#mv /etc/ntp.conf /etc/ntp.conf.bk
[root@dlp ~]#vi /etc/ntp.conf

# Set servers for synchronizing
server ntp1.ssysadmin.com
server ntp2.ssysadmin.com

[root@dlp ~]#/etc/rc.d/init.d/ntpd start
Starting ntpd: [ OK ]

[root@dlp ~]#chkconfig ntpd on
[root@dlp ~]#ntpq -p

[5] Installing SSH Server

[1] Configure SSH server for Windows clietnts computer to be able to login from them. This is the way with Password Authentication.

[root@dlp ~]#vi /etc/ssh/sshd_config

# line 42: make valid and change ‘no’

PermitRootLogin no

# line 63: make valid

PermitEmptyPasswords no
PasswordAuthentication yes
[root@dlp ~]#/etc/rc.d/init.d/sshd restart

[2] Get an appreciation which you can login from Windows clients by using PUTTY.

[6] Installing Apache Web Server

This is an example to build Web Server. Install Apache for it. In addition to do it, Install PHP and SSL because there are often used with Web Server. And it’s also neccessary to configure router so that TCP and UDP packets to 80 and 443 can pass through.

[root@www ~]#yum -y install httpd php php-mbstring php-pear mod_ssl

[root@www ~]#rm -f /etc/httpd/conf.d/welcome.conf

[root@www ~]#rm -f /var/www/error/noindex.html
[root@www ~]#ln -s /usr/bin/perl /usr/local/bin/perl

Here is an example to configure Apache. I set it that users can open to the public their Web site and can execute CGI in any directories. ( SSI is disabled because it’s not used so often )

[root@www ~]#vi /etc/httpd/conf/httpd.conf

ServerTokens Prod // line 44: change
KeepAlive On // line 74: change to ON
ServerAdmin root@server-linux.info // line 250: Admin’s address
ServerName www.server-linux.info:80 // line 264: server’s name
Options FollowSymLinks ExecCGI // line 319: change (disable Indexes)
AllowOverride All // line 326: change

#UserDir disable // line 354: make it comment

UserDir public_html // line 361: make valid

// line 369 – 380 : remove # and make valid

AllowOverride All // change
Options ExecCGI // CGI enabled
Order allow,deny
Allow from all
Order deny,allow
Deny from all

// line 390: add file name that it can access only with directory’s name

DirectoryIndex index.html index.cgi index.php
ServerSignature Off // line 523: change

#AddDefaultCharset UTF-8 // line 746: make it comment
// line 777: make valid and add file-type that apache looks them CGI

AddHandler cgi-script .cgi.pl

[root@www ~]#/etc/rc.d/init.d/httpd start
Starting httpd:[ OK ]
[root@www ~]#chkconfig httpd on

[2] Create HTML test page to make sure Apache is working.

[7] Config SSL

Configure for SSL that is installed in above section. We made a Certification File for SSL in this example, but if you use server for business, It’s better to buy and use a Certification File from CA like verisign.com, thawte.com, etc…

[root@www ~]#cd /etc/pki/tls/certs
[root@www certs]#make server.key
umask 77 ; \

/usr/bin/openssl genrsa -des3 1024 > server.key

Generating RSA private key, 1024 bit long modulus
………………………………………………++++++
………….++++++
e is 61251 (0×10001)
Enter pass phrase: // input pass phrase
Verifying – Enter pass phrase: // verify

// it’s troublesome to input pass phrase always, so remove it from private key

[root@www certs]#openssl rsa -in server.key -out server.key
Enter pass phrase for server.key: // input pass phrase
writing RSA key
[root@www certs]#make server.csr
umask 77 ; \

/usr/bin/openssl req -utf8 -new -key server.key -out server.csr

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [GB]: US
State or Province Name (full name) [Berkshire]:CO
Locality Name (eg, city) [Newbury]:Denver
Organization Name (eg, company) [My Company Ltd]:sSysAdmin
Organizational Unit Name (eg, section) []:Security
Common Name (eg, your server’s hostname) []:www.ssysadmin.com
Email Address []:root@ssysadmin.com
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: // Enter with empty
An optional company name []:// Enter with empty

[root@www certs]#openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650 // make CertificateFile
Signature ok
subject=/C=US/ST=CO/L=Denver/O=sSysAdmin/OU=Security/CN=www.ssysadmin.com/
emailAddress=root@ssysadmin.com Getting Private key
[root@www certs]#chmod 400 server.*
[root@www certs]#vi /etc/httpd/conf.d/ssl.conf

DocumentRoot “/var/www/html” // line 84: make valid
ServerName www.ssysadmin.com:443 // line 85: make valid and change
SSLCertificateFile /etc/pki/tls/certs/server.crt // line 112: change
SSLCertificateKeyFile /etc/pki/tls/certs/server.key // line 119: change

[root@www certs]#/etc/rc.d/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
  Access to the page that is made in section (2) with https. Following window is shown because Certification File is not by CA. Click Ok to proceed.

[8] Installing FTP Server
[1] Build FTP server to transfer files. Install and configure vsftpd for it.

[root@www ~]#yum -y install vsftpd

[root@www ~]#vi /etc/vsftpd/vsftpd.conf

anonymous_enable= NO // line 12: no anonymous
ascii_upload_enable=YES // line 79: make valid
ascii_download_enable=YES (permit ascii mode transfer)
chroot_list_enable=YES // line 94: make valid

(enable chroot list)

chroot_list_file=/etc/vsftpd/chroot_list // line 96: make valid
ls_recurse_enable=YES // line 102: make valid
chroot_local_user=YES // bottom: enable chroot

local_root=public_html // root directory
use_localtime=YES // use local time

[root@www ~]#vi /etc/vsftpd/chroot_list

fedora // write users you permit

[root@www ~]# /etc/rc.d/init.d/vsftpd start
Starting vsftpd for vsftpd: [ OK ]
[root@www ~]#chkconfig vsftpd on

[9] Samba File Server

Build File server to share files between Windows computer and Linux Server computer. Install Samba for it. I created this File server in a GuestOS named ‘lan’ in this example.

[root@lan ~]#yum -y install samba
Create a shared directory that anybody can read and write, and authentication is not needed.

[1] Configure Samba
[root@lan ~]#mkdir /home/share
[root@lan ~]#chmod 777 /home/share
[root@lan ~]#vi /etc/samba/smb.conf

unix charset = UTF-8 // line 24: add the line
workgroup =WORKGROUP // line 27: change (Windows’ default)
security =share// line 35: change
hosts allow =192.168.0. 127. // line 41: change IP address you permit

// add these lines at the bottom
[Share] // any name you like
path = /home/share // shared directory
writable = yes // OK to write
guest ok = yes // guest OK
guest only = yes // guest only
create mode = 0777 // fully accessed
directory mode = 0777 // fully accessed
share modes = yes

[root@lan ~]#/etc/rc.d/init.d/smb start
Starting SMB services:[ OK ]
Starting NMB services:[ OK ]
[root@lan ~]#chkconfig smb on

[10] Mysql

Install MySQL for database server.

[root@www1 ~]# yum -y install mysql-server
[root@www1 ~]# /etc/rc.d/init.d/mysqld start

[root@www1 ~]#mysql -u root # login to MySQL
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2 to server version: 5.0.22

Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the buffer.

# show user info

mysql>select user, host, password from mysql.user;

# delete user that has no password

mysql>delete from mysql.user where user=”;
Query OK, 2 rows affected (0.00 sec)

# set root password

mysql>set password for root@localhost=password(‘password’);
Query OK, 0 rows affected (0.00 sec)

# set root password

mysql>set password for root@’www1.server-linux.info’=password(‘password’);
Query OK, 0 rows affected (0.00 sec)

# set root password

mysql>set password for root@127.0.0.1=password(‘password’);
Query OK, 0 rows affected (0.00 sec)

# show user info

mysql>select user,host,password from mysql.user;

mysql>exit # logout
Bye
[root@www1 ~]#mysql -u root -p # login with root
Enter password: # password
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 4 to server version: 5.0.22

Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the buffer.

mysql>exit
Bye

Install phpmyadmin to operate MySQL from Web browser. Webserver is also needed.

[1] Install and configure phpmyadmin

[root@www1 ~]#yum -y install phpMyAdmin php-mysql php-mcrypt
[root@www1 ~]#vi /etc/phpMyAdmin/config.inc.php

# add this line around line 13
# set password
$cfg['blowfish_secret'] = ‘password’;
# line 28: change

$cfg['Servers'][$i]['auth_type'] = ’cookie’;

[root@www1 ~]#vi /etc/httpd/conf.d/phpMyAdmin.conf

# line 8: change

Alias /mysql /usr/share/phpMyAdmin
# line 13: add IPs you permit
Allow from 127.0.0.1 192.168.0.0/24

[root@www1 ~]#/etc/rc.d/init.d/httpd reload
Reloading httpd: [ OK ]

[2] Access to ‘http://(your hostname)/(alias name you set)/’  i.e. http://localhost/phpMyAdmin through  web browser.

Credits: yuvalinux @ bs

Leave a comment   Linux, Servers

ASP.NET MVC 3 Extension less URLs on IIS 6

By Atiq, on February 3rd, 2011%

The part that makes it easier has nothing to do with ASP.NET MVC 3 and everything to do with a little known new feature of ASP.NET 4 creatively called the ASP.NET 4 Extensionless URL feature. ASP.NET MVC 3 requires ASP.NET 4 so it naturally benefits from this new feature.

If you have a server running IIS 6, ASP.NET 4, and ASP.NET MVC 3 (or even ASP.NET MVC 2), your website should just work with the default extensionless URLs generated by ASP.NET MVC applications. No need to configure wildcard mappings nor *.mvc mappings. In fact, you don’t even need to set RAMMFAR to true. RAMMFAR is our pet name for the runAllManagedModulesForAllRequests setting within thesystem.webserver setting in web.config. You can feel free to set this to false.

<modules
runAllManagedModulesForAllRequests=”false”/>

When installing ASP.NET 4, this is enabled by default. So if you have a hosting provider still using IIS 6, but does have ASP.NET 4 installed, then this should work for you.

How does this work?

Here is how the v4.0 ASP.NET extensionless URL features works on IIS 6.  We have an ISAPI Filter named aspnet_filter.dll that appends “/eurl.axd/GUID” to extensionless URLs.  This happens early on in the request processing.  We also have a script mapping so that “*.axd” requests are handled by our ISAPI, aspnet_isapi.dll.  When we append “/eurl.axd/GUID” to extensionless URLs, it causes them to be mapped to our aspnet_isapi.dll, as long as the script map exists as expected.  These requests then enter ASP.NET where we remove “/eurl.axd/GUID” from the URL, that is, we restore the original URL.  The restoration of the original URL happens very early.  Now the URL is extensionless again and if no further changes are made

He also has a list of conditions that must be true for this feature to work. If any one of them is false, then you’re back to the old extensionfull URLs with IIS 6.

I’m Getting a 403 Forbidden

This is not technically related, but if you face 403 Forbidden error message. Here is how to fix it.

In IIS Manager, right clicked on the Web Services Extension node and selected the menu option labeled Allow all Web Service extensions for a specific application:


In the resulting dialog, select the ASP.NET v4.0.30319 option.


To double check that everything was configured correctly, look at the properties for my website and ensured that Scripts were enabled.


Also click on the Configuration… button and made sure that *.axd was mapped to the proper ASP.NET ISAPI DLL (aspnet_isapi.dll).



With all that in place, able to run standard ASP.NET MVC web application and make requests for /, /home/about/, etc. without any problems!

One comment   Misc., Servers, SysAdmin   , , , , ,  

How To Fix ‘Microsoft.Jet.OLEDB.4.0′ error

By Atiq, on October 30th, 2010%

Problem:
Server Error in ‘/’ Application.
——————————————————————–
The ‘Microsoft.Jet.OLEDB.4.0′ provider is not registered on the local machine.
Description: An unhandled exception occurred during the execution of the current web request.
Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.InvalidOperationException: The ‘Microsoft.Jet.OLEDB.4.0′
provider is not registered on the local machine.

Solution:

You will get this error on Windows Server 2008 R2 or Windows 7 64 bit. To fix it, switch your Application Pool from Native 64 bit to 32 Bit more under Advanced Settings.

Suggestion:

It is also suggested that you upgrade your application to new ACE OLEDB provider, you can download from here.

2 comments   Developers, Servers, Windows   , , , , , , ,  

Backup IIS7 ApplicationHost.config and Settings

By Atiq, on October 30th, 2010%

Internet Information Services 7 (IIS7) doesn’t use metabase-like file from IIS6. Instead the settings and configuration are stored in schema files and applicationHost.config files.

Since the configuration files are different, the old IIS6 tools will not be able to backup IIS7 settings.

This is the new script that you can use to backup your IIS7 web servers.

1. Using notepad or any text editor create a file backupiis7.cmd

2. Insert the following code and save the file:

Code:
@echo off
cls

pushd "%WinDir%\System32\inetsrv"

echo.| date | find /i "current">datetime1.tmp
echo.| time | find /i "current">datetime2.tmp

for /f "tokens=1,2,3,4,5,6" %%i in (datetime1.tmp) do (
  echo %%n>datetime1.tmp
)
for /f "tokens=1,2,3,4,5,6" %%i in (datetime2.tmp) do (
  echo %%m>datetime2.tmp
)
for /f "delims=/ tokens=1,2,3" %%i in (datetime1.tmp) do (
  set TMPDATETIME=%%k%%i%%j
)
for /f "delims=:. tokens=1,2,3,4" %%i in (datetime2.tmp) do (
  set TMPDATETIME=D%TMPDATETIME%T%%i%%j%%k%%l
)

appcmd add backups %TMPDATETIME%

del datetime1.tmp
del datetime2.tmp

set TMPDATETIME=

popd
echo.

3. The IIS7 configuration will be backed up at the following path:

C:\Windows\System32\inetsrv\backup

NOTE: you can also use Task Scheduler to automate backups.

Leave a comment   Servers, Windows   , , , , , , ,  

Arabic Language Shows ??? in Smartermail Web interface

By Atiq, on October 29th, 2010%

Problem: When someone send email through smartermail web interface anything with Arabic Language shows ????. Is this SM related or something we need to set server side?

Solution: This can be controlled at the User’s Inbox through Settings > My Settings > Account Settings >> Compose. Set the Text Encoding to “Unicode (UTF-8)” (“Arabic (ISO)” might work too) and then try sending the email again. This will affect any outgoing mail after the settings are saved, existing messages will not be changed.

Note: This is per user setting.

2 comments   Servers, SysAdmin, Windows   , , ,  

ASP.Net Vulnerability Patch released: Microsoft Security Bulletin MS10-070

By Atiq, on September 29th, 2010%


Vulnerability in ASP.NET Could Allow Information Disclosure (2418042)

Microsoft released ASP.net Vulnerability path through Download centre, for details please click here.

This security update resolves a publicly disclosed vulnerability in ASP.NET. The vulnerability could allow information disclosure. An attacker who successfully exploited this vulnerability could read data, such as the view state, which was encrypted by the server. This vulnerability can also be used for data tampering, which, if successfully exploited, could be used to decrypt and tamper with the data encrypted by the server. Microsoft .NET Framework versions prior to Microsoft .NET Framework 3.5 Service Pack 1 are not affected by the file content disclosure portion of this vulnerability.

This security update is rated Important for all supported editions of ASP.NET except Microsoft .NET Framework 1.0 Service Pack 3. For more information, see the subsection,Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by additionally signing all data that is encrypted by ASP.NET. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 2416728.

Recommendation. Microsoft recommends that customers apply the update at the earliest opportunity.

See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.

Known Issues. Microsoft Knowledge Base Article 2418042 documents the currently known issues that customers may experience when installing this security update. The article also documents recommended solutions for these issues.

The patch is available through Microsoft download centre

One comment   Community, Developers, Security, Security Misc., Servers, SysAdmin, Windows   , , , , , ,  

Important: ASP.NET Security Vulnerability

By Administrator, on September 18th, 2010%

A few hours ago Microsoft released a Microsoft Security Advisory about a security vulnerability in ASP.NET.  This vulnerability exists in all versions of ASP.NET.

This vulnerability was publically disclosed late Friday at a security conference.  We recommend that all customers immediately apply a workaround (described below) to prevent attackers from using this vulnerability against your ASP.NET applications.

What does the vulnerability enable?

An attacker using this vulnerability can request and download files within an ASP.NET Application like the web.config file (which often contains sensitive data).

At attacker exploiting this vulnerability can also decrypt data sent to the client in an encrypted state (like ViewState data within a page).

How the Vulnerability Works

To understand how this vulnerability works, you need to know about cryptographic oracles. An oracle in the context of cryptography is a system which provides hints as you ask it questions. In this case, there is a vulnerability in ASP.NET which acts as a padding oracle. This allows an attacker to send cipher text to the web server and learn if it was decrypted properly by examining which error code was returned by the web server.  By making many such requests (and watching what errors are returned) the attacker can learn enough to successfully decrypt the rest of the cipher text.

How to Workaround The Vulnerability

A workaround you can use to prevent this vulnerability is to enable the <customErrors> feature of ASP.NET, and explicitly configure your applications to always return the same error page – regardless of the error encountered on the server. By mapping all error pages to a single error page, you prevent a hacker from distinguishing between the different types of errors that occur on a server.

Important: It is not enough to simply turn on CustomErrors or have it set to RemoteOnly. You also need to make sure that all errors are configured to return the same error page.  This requires you to explicitly set the “defaultRedirect” attribute on the <customErrors> section and ensure that no per-status codes are set.

Enabling the Workaround on ASP.NET V1.0 to V3.5

If you are using ASP.NET 1.0, ASP.NET 1.1, ASP.NET 2.0, or ASP.NET 3.5 then you should follow the below steps to enable <customErrors> and map all errors to a single error page:

1) Edit your ASP.NET Application’s root Web.Config file.  If the file doesn’t exist, then create one in the root directory of the application.

2) Create or modify the <customErrors> section of the web.config file to have the below settings:

<configuration>
   <system.web>
      <customErrors mode="On" defaultRedirect="~/error.html" />
   </system.web>
</configuration>

3) You can then add an error.html file to your application that contains an appropriate error page of your choosing (containing whatever content you like).  This file will be displayed anytime an error occurs within the web application.

Notes: The important things to note above is that customErrors is set to “on”, and that all errors are handled by the defaultRedirect error page.  There are not any per-status code error pages defined – which means that there are no <error> sub-elements within the <customErrors> section.  This avoids an attacker being able to differentiate why an error occurred on the server, and prevents information disclosure.

Enabling the Workaround on ASP.NET V3.5 SP1 and ASP.NET 4.0

If you are using ASP.NET 3.5 SP1 or ASP.NET 4.0 then you should follow the below steps to enable <customErrors> and map all errors to a single error page:

1) Edit your ASP.NET Application’s root Web.Config file.  If the file doesn’t exist, then create one in the root directory of the application.

2) Create or modify the <customErrors> section of the web.config file to have the below settings.  Note the use of redirectMode=”ResponseRewrite” with .NET 3.5 SP1 and .NET 4.0:

<configuration>
   <system.web>
     <customErrors mode="On" redirectMode="ResponseRewrite" defaultRedirect="~/error.aspx" />
   </system.web>
</configuration>

3) You can then add an Error.aspx to your application that contains an appropriate error page of your choosing (containing whatever content you like).  This file will be displayed anytime an error occurs within the web application.

4) We recommend adding the below code to the Page_Load() server event handler within the Error.aspx file to add a random, small sleep delay. This will help to further obfuscate errors.

VB Version

Below is a VB version of an Error.aspx file that you can use, and which has a random, small sleep delay in it.  You do not need to compile this into an application – you can optionally just save this Error.aspx file into the application directory on your web-server:

<%@ Page Language="VB" AutoEventWireup="true" %>
<%@ Import Namespace="System.Security.Cryptography" %>
<%@ Import Namespace="System.Threading" %>

<script runat="server">
    Sub Page_Load()
        Dim delay As Byte() = New Byte(0) {}
        Dim prng As RandomNumberGenerator = New RNGCryptoServiceProvider()

        prng.GetBytes(delay)
        Thread.Sleep(CType(delay(0), Integer))

        Dim disposable As IDisposable = TryCast(prng, IDisposable)
        If Not disposable Is Nothing Then
            disposable.Dispose()
        End If
    End Sub
</script>

<html>
<head runat="server">
    <title>Error</title>
</head>
<body>
    <div>
        Sorry - an error occured
    </div>
</body>
</html>

C# Version

Below is a C# version of an Error.aspx file that you can use, and which has a random, small sleep delay in it.  You do not need to compile this into an application – you can optionally just save it into the application directory on your web-server:

<%@ Page Language="C#" AutoEventWireup="true" %>
<%@ Import Namespace="System.Security.Cryptography" %>
<%@ Import Namespace="System.Threading" %>

<script runat="server">
   void Page_Load() {
      byte[] delay = new byte[1];
      RandomNumberGenerator prng = new RNGCryptoServiceProvider();

      prng.GetBytes(delay);
      Thread.Sleep((int)delay[0]);

      IDisposable disposable = prng as IDisposable;
      if (disposable != null) { disposable.Dispose(); }
    }
</script>

<html>
<head runat="server">
    <title>Error</title>
</head>
<body>
    <div>
        An error occurred while processing your request.
    </div>
</body>
</html>

How to Verify if the Workaround is Enabled

Once you have applied the above workaround, you can test to make sure the <customErrors> section is correctly configured by requesting a URL like this from your site: http://mysite.com/pagethatdoesnotexist.aspx

If you see the custom error page appear (because the file you requested doesn’t exist) then your configuration should be setup correctly.  If you see a standard ASP.NET error then it is likely that you missed one of the steps above.  To see more information about what might be the cause of the problem, you can try setting <customErrors mode=”remoteOnly”/> – which will enable you to see the error message if you are connecting to the site from a local browser.

How to Find Vulnerable ASP.NET Applications on Your Web Server

http://asp.net have published a .vbs script that you can save and run on your web-server to determine if there are ASP.NET applications installed on it that either have <customErrors> turned off, or which differentiate error messages depending on status codes.

You can download the .vbs script here.  Simply copy/paste the script into a text file called “DetectCustomErrors.vbs” and save it to disk.  Then launch a command window that is elevated as admin and run “cscript DetectCustomErrors.vbs” to run it against your local web-server.  It will enumerate all of the applications within your web server and verify that the correct <customErrors> configuration has been specified.

command[1]

It will flag any application where it finds that an application’s web.config file doesn’t have the <customErrors> section (in which case you need to add it), or doesn’t have it set correctly to workaround this attack (in which case you need to update it).  It will print “ok” for each application web.config file it finds that is fine.  This should hopefully make it easier to locate issues.

Note: http://asp.net have developed this detection script over the last few hours, and will be refining it further in the future.  I will post an update in this section each time we make a change to it.

How to Find More Information about this Vulnerability

You can learn more about this vulnerability from:

Forum for Questions

There is a dedicated forum on the www.asp.net site to help answer questions about this vulnerability.

Post questions here to ask questions and get help about this vulnerability.

Summary

I will post more details as I learn more, and will also be post the patch that can be used to correct the root cause of the issue (and avoid the need for the above workaround).

Until then, please apply the above workaround to all of your ASP.NET applications to prevent attackers from exploiting it.

This article applies on:

Operating System Component
Windows XP
Windows XP Media Center Edition 2005 and Windows XP Tablet PC Edition 2005 Microsoft .NET Framework 1.0 Service Pack 3
Windows XP Service Pack 3 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2003
Windows Server 2003 Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Vista
Windows Vista Service Pack 1 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Vista Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Vista x64 Edition Service Pack 1 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2008
Windows Server 2008 for 32-bit Systems** Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2008 for 32-bit Systems Service Pack 2** Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2008 for x64-based Systems** Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2008 for x64-based Systems Service Pack 2** Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2008 for Itanium-based Systems Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework 4.0
Windows 7
Windows 7 for 32-bit Systems Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0
Windows 7 for x64-based Systems Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0
Windows Server 2008 R2
Windows Server 2008 R2 for x64-based Systems* Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0
Windows Server 2008 R2 for Itanium-based systems Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0

*Server Core installation affected. This vulnerability applies, with the same severity rating, to supported editions of Windows Server 2008 or Windows Server 2008 R2 as indicated, whether or not installed using the Server Core installation option. For more information on this installation option, see the TechNet articles, Managing a Server Core Installation and Servicing a Server Core Installation. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008 and Windows Server 2008 R2; see Compare Server Core Installation Options.

**Server Core installation not affected. This vulnerability does not affect supported editions of Windows Server 2008 or Windows Server 2008 R2 as indicated, when installed using the Server Core installation option. For more information on this installation option, see the TechNet articles, Managing a Server Core Installation and Servicing a Server Core Installation. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008 and Windows Server 2008 R2; see Compare Server Core Installation Options.

4 comments   Community, Developers, Security, Servers, Windows