This attack is supposed to be presented in 10 days from now, but my guess is that they use compression.
SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello, wi...
SSL compression is turned off by default in nginx 1.1.6+/1.0.9+ (if OpenSSL 1.0.0+ used) and nginx 1.3.2+/1.2.2+ (if older versions of OpenSSL are used). If you see SSL compression, you probably want to upgrade nginx.
Another obvious solution is to recompile OpenSSL without zlib compression sup...
I mean, I don't really ever deal with companies in a consulting capacity so I don't know.
Maybe something like "Just to be clear, if you start and get 1/2 way and call me in to finish it, there's a good chance I'll want to blow away what you've done and configure it from scratch."
Or something to that effect but nicer. Let them know you're not willing to frankenstein their shit-mess.
@MDMarra THink of the VMWare environment you built... or anything with AD... Do you think a coupole of internal IT guys with no experience with it could figure it out?
Can you offer something like "I'll do the project plan, I'll do the implementation details, but I'll let your staff drive so that they get the knowledge transfer." ?
It'll definitely tack plenty of billable hours onto the project and both people end up happy.
If they've already refused training, all you can really do is let them know that you're willing to clean up and potential messes, but you can't guarentee business continuity if you have to blow away misconfigured machines and start over.
@ewwhite I do. Why should I as a responsible citizen not be allowed to indulge myself with a gigantic bucket of sugar water occasionally if I so desire?
We also bought like 80k worth of hardware with it though, so that might have helped. HP may have subsidized the licensing cost to get their hardware in our door.
@MDMarra Yeah, we'll see how this goes. The management is starting to discover that we can in fact roll out new services faster and cheaper with VMs. So now they're requesting stuff that they'd never wanted to pay $5k for.
@MDMarra I seriously doubt they'll even go for even the Essentials Plus 3-server kit unless it's wrapped into some other projects. And then only as a 1-time expense covered by a grant.
@MDMarra I've already tried that tack. The boss has issues with Microsoft products and he doesn't want to use our TechSoup licenses on infrastructure, just on user-facing products like Office.
@ewwhite Exactly. And Good Lord do I want vMotion. The notion of having to manually convert dozens of VMs from one set of local drives to another gives me hives.
@MDMarra Interesting. A friend of mine is a Hyper-V expert for WA state's social services division. I'll buy her a few beers and get her to give me some pointers.
@longneck You don't need to run Data center edition as the host. You can do the same thing by running Hyper-V server as the host and just having datacenter licenses for that box. Also, 2008 Enterprise edition doesn't grant unlimited guests, only 4 guests. Not sure about 2012.
I mean, cost is cost... if you present the costs and show that you've done due diligence to either maximize the benefit/minimize cost or to present all of the options... What else is there to say?
@ewwhite No there's a need for SysAdmins to become more of product and solution people for the business, much easier to "sell" ideas if you are proposing an entire solution as opposed to just a purchase
@ewwhite Agreed, but if you approach it purely from a we need this here big server as opposed to this big server will allow us to support five different departments all running "x" applications for the next 3 years, thats a bit different
@MDMarra yeah that's the rub - your 4 have to be on the same physical host, so if DRS puts a 5th somewhere (or you only have one group of 4 and it splits them 2-and-2) you're technically in violation the way I understand it
I don't think MS would crucify you for it, but... bleh
@longneck Enterprise allows for 4 guests and 1 physical install on the same hardware. There's no requirement that you use that physical install license. You can have those 4 guests on ESXi. KVM, Xen, whatever. If you choose to use Hyper-V, you can use the same enterprise license for the host (not a good idea) or you can use Hyper-V Server (good idea).
@voretaq7 Yeah, I really don't think you'd be dinged in an audit for that as long as it's all the same cluster.
One day.. just one freaking day, it would be nice if MSFT provided a single one page paper that explained all of the specific options for a specific config or feature
@MDMarra probably not - just bugs me that the license says "host" and not "cluster" -- it's more a "Well we found a more serious violation, so we're writing you up for this one too"
You know what would be cool, to get a MSFT rep from the licensing group to write up a canonical answer for the recurring licensing questions that people keep asking about
@BrentPabst Uh, you know MS Sales Reps go through a month-long course on their licensing, right? I'd be shocked if any 2 reps ever gave you the same answer on anything.
@BrentPabst To be fair, if you're connecting from an equivalent version of Windows you don't need the RD Cal (last I looked, MS is as moody as a woman)... So the RD Cal is just making up for the MS Tax you dodged by buying a Linux device. =]
Also, famous one from the CCNA book is that Datagrams are defined as both UDP packets and as what the rest of the world calls the Payload inside an IP packet.
I've been chasing a packet-loss and network stability issue for a handful of end-users on an internal network for the past few days... These issues surfaced last week, however the location was struck by lightning six weeks ago.
I was seeing 5-10% packet loss between a stack of four Cisco 2960's ...
unless someone wants to take a crack before I add a bounty
Client emails... "We have a new port tester that I’m reading the instructions on. Once I’ve read them I will go down and test the ports and let you know if it finds anything."
No, TV doesn't come in over cables; it comes in over your fiber optic internet connection, of course.
Someone's messing with you... or maybe just a historical trivia buff. I think I vaguely recall something about "cable TV" from one of my college classes... Ancient European history, or something like that. Learned about a lot of bizzare ancient stuff in that class too... like wires called "rabbit ears" poking out of the Television for wireless support, and heavy, cube-shaped monitors with tiny display sizes in only 256 or 16 or even ***2*** colors. and crazy barbarism like "CRT" display…
I seem to recall a tool that would aggregate logs and auto-archive them (compress, move to slower storage, etc) based on rules like time and type of log
SSL compression is turned off by default in nginx 1.1.6+/1.0.9+ (if OpenSSL 1.0.0+ used) and nginx 1.3.2+/1.2.2+ (if older versions of OpenSSL are used). If you see SSL compression, you probably want to upgrade nginx.
Another obvious solution is to recompile OpenSSL without zlib compression sup...
