SecureClient messed me up

So I've been spending every spare moment the last couple of weeks trying to configure this new router, an SG580. When trying out the configuration, which should have been straight forward, strange things started to happen.

First, let me describe the layout. I have one leg on the administrative network, one leg on what will be the "IT Department network", and one leg on what will be a secure and clamped down zone. I have a managed switch on the IT segment to test with and a laptop on the secure zone. ICMP turned on everywhere.

From the secure zone, I could ping the switch and every interface on the router except ADM. Moving the laptop to the IT segment, I get the exact same results. However, placing it on ADM, I can easily access the switch in the IT segment and ping every interface on the SG.

The clue came when I wanted a thorough test and picked up another laptop, so that I could ping between all segments simultaneously. The other laptop was able to ping everything. Everyone were able to ping the other laptop - except mine. Mine would do it only when I was within the same subnet.

But my firewall was off - or wasn't it?

It then turned out that the culprit was Check Point's VPN-1 SecureClient. I don't know the internals of it, but it seems to have understood that I was no longer in my ordinary subnet and thereby assumed that the addresses I was trying to reach could only be done through VPN. It had tried to tell me so by offering to connect, but I had dismissed it and told me not to bother me again about it.

As soon as I removed the binding to SecureClient on the network interface, everything went swimmingly.

...and to think, the piece of software that sabotaged me was the one piece of software that was installed on my laptop on the day I started my new job...

Clutter Free installs

There was a known problem with an undocumented solution. After reading the solution of a different, unrelated issue, I tried to use part of this to solve my first problem. It worked.

I'm not going to get into too many details, but the solution included a two step installation of an ODBC-driver before generating an ODBC source with the newly installed driver. The two steps of the installation was the loading a registry file and adding a directory to the global path.

I documented the installation in a MindMap file. And not just any MindMap file. I added it in a Clutter Free Enterprise configuration mind map, using three functions that did not yet exist: Registry, Path and ODBC.

Modifying large portions of the registry can look disgusting unless it's kept in a tree structure, so I added a branch in the MindMap for registry entries. Hence, the command "Registry ODBC Driver" will simply pick the "ODBC Driver" branch from the "Registry" tree, instead of having to list every single key/value pair as separate commands.

The "Path" function adds to the global Path environment variable in the registry and sends a message to all windows applications to reload the environment. This makes the change instant.

And finally, "ODBC" adds system DSNs by format "ODBC driver name;param=value;param=value" etc.

In combination with switches to automatically load this specific configuration file and run the specific solution before automatically quitting, allowed me to set up a shortcut for self help whenever someone new is lacking the driver and ODBC-source.

Problem parking

I'm eagerly waiting for our new desk for our new office, allowing the three of us to cooperate better. Every time a truck stops to deliver something, I peek outside. Coud it be our desk? No, not this time. Then it happens.

At the exact moment the unloading lift touched the ground, a van pulls up, partially on top of the lift, making it impossible for the trucker to unload or even raise the lift again. The van driver jumps out and runs away, leaving the trucker stuck, not able to do his work.



There is something awfully familiar about this situation. You work on one thing, then you get interrupted by someone who just wants your attention, but rendering you unable to do any constructive work until they are done with a job they don't really need your help to complete.

This can also be said about mess left behind on servers from various software installations. While you were planning something different, you suddenly find yourself cleaning up something that should never have been allowed to pile up in the first place. User profiles are typical victims of this phenomena, slowing down logons, eating up disk space and increasing backup sizes.

For this reason, I wrote a small piece of software to clean up some of the typical problem areas on a system. The original had references to specific problem areas on various servers in my old job. These references make no sense any other locations, so I reduced it to go for the typical problem areas on a stand alone computer.

This has already been used with great success in my new job, reducing the daily backup size to be reduced by 65 Gigabytes. I now have another year to introduce a new backup system, instead of one month.

This "reduced" version is available for free on my Trollsilm website, though I'm working on an Enterprise edition specifically to run smoothly on servers, taking only a few % of your CPU power. And best of all, it will be completely configurable to meet your organization's needs.

The One Good Thing About the Earthquake in China and Why I’ll Be Going to Hell

Being a geek, before stepping out of the house, I had to check my mail and then my server logs for any weird activity. Despite the regular patterns, there has been very little going on.

In fact, things have been very, very quiet the last few days.

A while ago, there was an article in The Economist about Steven P. Levitt, a statistician and co-author of a book titled "Freakonomics." Mr. Levitt had found odd things to compare and worked them out. For example, American cities where abortion was either illegal or expensive to be obtained, crime was found to be rampant. The opposite was also true. His assertion was that “Roe vs. Wade” was a cornerstone in the dip in crime in the United States as evidenced approximately seventeen years later (http://en.wikipedia.org/wiki/Roe_v._Wade).

I forget what the other patterns were, but of course his findings were received with hate, anger or accusations of racism and discrimination. Harsh truth usually has that impact on people living in the state of denial.

Regardless of whether these views are seen as a modern criticism of "what's wrong with society today and how we could try to fix it if we all just worked together," versus "having a view that touches a delicate subject that is different from what is considered acceptable; therefore, it is a form of discrimination," as any social worker will tell you, patterns between things do exist.

Not all are patterns are pleasant, which is why I'll be going to hell.

I'm deadly certain that the attention my machine receives from Chinese and Taiwanese computers is simply a coincidence. It's mostly bots from infected machines that probe the entire internet in search of weaknesses, open relays to send out spam and more poorly patched Microsoft SQL servers to infect.

I'm nobody special: I'm just one of many.

A quick search on the internet will yield similar discoveries by others. A quick example:

http://www.google.ca/search?hl=en&q=block+IP+ranges+china

Many IT administrators point out that scanning the culprit machines back yields evidence of infected machines, running illegal software, badly patched or with very little security measures in place. No wonder NIMBDA ran rampant there.

And, it seems, it's not that new of an event either. Check out the dates on these two examples:

http://www.theregister.co.uk/2005/08/31/blocking_chinese_ip_addresses/

http://www.businessweek.com/technology/content/may2004/tc20040517_1934_tc058.htm

Who is taking advantage of these machines? Through the Spamhaus' Rokso listing shows that the majority of active spammers are Canadian, American or Russian with a handful of Chinese (see: http://www.spamhaus.org/rokso/). Many of them operate hijacked servers in China.

That's how we get thousands of spam attempts a day, the daily handful of relay checks from Taiwan and the plethora of brute force attacks. Amusingly, just by blocking the IP ranges of Chinese ISP HINET.NET, I've cut down on attacks by 1/3rd, with the rest originating from anywhere else in the world (Russia and Turkey being very close seconds).

So, where's my pattern?

After the earthquake, suddenly everything malicious from the internet has dropped. I've had between one and three SSH attacks a day (versus one every minute).

I've had one or two spams a day. I don't mean one or two spams made it in my inbox. I mean one or two spams made it as far as talking to my mail server and were rejected before the transaction between the spammer and my mail server had gone past HELO.

Portsentry banned ONE host when they tripped on port 23, since the earthquake.

My old server is getting a bit of a break. Though it is debatable as to how long this bliss will last (hijacked computers in Russia and Turkey are picking up the pace with spam sending), positive patterns can be found everywhere. Even at the expense of 36,000 earthquake victims.

See you in hell.

ICT Leadership

Back in March, I wrote about strategic planning and last week about leadership as something that applies to all. Both of these items highlight that leadership is an attribute of how you work, while administration is part of the job. But administration without leadership is a recipe for disaster. And ICT adminisration without ICT leadership does not help you or the organization you're working for.

Not convinced?

You were most likely hired because you have the technical expertise to run the computer systems in your organization. Most likely, the chief executives do not have the technical knowledge you have, hence the most qualified person to make decisions related to the organization's ICT resources is you, not your superior.

Fine, you lead the way on the technology. You try to educate your superiors, so that they can make educated decisions. You might even start reading books about leadership and come across concepts like SWOT analysis and the 5 Cs of Core strategy, Consequence, Customer, Control and Culture, and you begin to wonder what this has to do with you. You're a technical assistance, not an executive.

But this all does matter even for you. You meet organizational culture every day, and you're part of defining it. You may try to control the direction of ICT development in the organization and educate your peers, or you might be running around to every person's bidding. Your peers are your customers, and their customers are the organization's customers. Everything you do have a consequence. To meet all of this, you must have a core strategy.

How about competition? You have to address competition on different levels: First, there's the competition of your organization. Then there's the competition of your ICT department. Even if you're a one man operation, you still have competition in the form of your job being outsourced to someone else or to a different organization to cut costs. At the same time, you still may have to outsource part of your operations in order to meet demands, in which case it is no longer competition, but a strategic partnership.

The difference between the two approaches to outsourcing lies in leadership.

Hopefully, you have bought into the concept that leadership is also about you, whether you officially have a hierarchy below you or not. The hierarchy is artificial, and leadership is not dependent on it. Leadership is about showing the way in the subjects that you have your compentency, yet you have to follow others in areas where they possess the compentency you lack.

Leadership is not something that you do only in your job, but it can also be applied to your life in general, from career development to personal life. After all, the one person who is most qualified to craft the life you want to live is you.


Because I'm moving to a new location, there will be no new article on Dihturnoaidi until May 19th. If you wish to contribute to Dihturnoaidi, get in touch at gard.abrahamsen at gmail

Are you leading, demanding or bending?

In my previous post, I barely touched the subject of leadership. From my experience, however, IT administrators are probably first in line to claim that they have noone to lead. Particularly in small organizations, where there there is nobody below them in the hierarchy. I disagree with this notion.

Everyone is a leader in one form or another. The IT Administrator's leadership is expressed through their knowledge of IT, and it is observed through people seeking assistance and direction from the IT Administrator. So even if you're not officially leading any people, you are still leading the way of the organization's use and knowledge of IT. Even when your superiors set policies, people will still be looking for you when they have problems that need to be solved.

Leadership is often confused with management and power. However, some of the most well known leaders were people with no power at all. Instead, they inspired people around them. The question is, how do we apply this in the IT world?

Let us have a look at the perpetually returning tech support questions of how to do something in Word. In my experience, the near-constant support to solving the same problems again and again does not inspire workers to learn. Instead, it inspires them to call you again. So the question is, how do you inspire someone to learn?

Since I, as most IT administrators, do not have any education in pedagogics, I'm uncertain if there really is a simple answer to that. After all, everyone are different and thus have different triggers and buttons. Learning these triggers and buttons, and then relate to them, is a key to inspiration. Which brings us back to the many attempted definitions of leadership.

Studies have shown that a common trait amongst the most successful leaders is constant learning. They learn about their fellow coworkers, about their business, about everything they touch. This knowledge is then expressed with an enthusiasm that inspires coworkers to follow their lead. They break new barriers and lead the way, the others follow.

But give this a little thought. If the leader's lead is based on information learned from coworkers, then everyone are actually part of the group's leadership. While it is mostly expressed by this one person, the leadership is more of a bidirectional relationship than a job in itself. Management, on the other hand, is an uninspiring job that behaves like sand in everyone's eyes if it is not coupled with leadership.

So stop being a manager now, and become your organization's IT Leader!

This article was inspired by the first 20 pages of The Leadership Manual by Hilarie Owen, Vicky Hodgson and Nigel Gazzard, ISBN 0-273-67551-6