1) A VMware server
2) Latest Debian netboot ISO
3) PXE bootable Clonezilla
4) Server to store Clonezilla image on

First I had to find the BIOS password to our Barracuda Spam Firewall. It appears that barracuda is running a custom BIOS on this motherboard and you cannot boot to CD (They always hang with a blinking cursor). Enable the LAN BIOS and the option to boot to other devices. When the system reboots, F11 should get you to the boot selection screen. I picked PXE and booted Clonezilla ( How to PXE boot Clonezilla)

Clone the had drive of the barracuda spam firewall to a server on your network. Next we need a VM ready to clone the image from the barracuda spam firewall. Make sure the hard drive for this unit is big enough to clone the image to it (I made mine 275 GB because our barracuda unit has a 250  GB hard disk). Next we need to tell the VM to PXE boot. Make sure the VM is selected. Click “Configure VM” on the right side. Select the “Power” tab, and check the box that says “Enter the BIOS the next time the virtual machine boots”. Next start the VM and make sure the ethernet controller is set to boot first in the BIOS. PXE boot to clonezilla and clone the hard drive of the barracuda spam firewall back to your VM.

After clonezilla is finished cloning the hard drive back. Shut down the VM. Set the system to enter the BIOS when you boot the VM again. Change the BIOS so the hard disk boots first. Now, if the system boots, you are out of the woods. If you get an error on boot saying something like “Could not mount root partition”, then we have some more work to do. The reason you get this message is the kernel supplied by Barracuda doesn’t have the proper storage drivers for the VM. We need to copy a kernel from Debian and use that to boot the Barracuda VM.  Go ahead and shut down your barracuda VM.

Now, we need a second VM with Debian preinstalled on it. I chose a 32-bit version of Debian. Go ahead and install Debian completely in this VM. After Debian is installed, shut down the VM. We need to add the hard disk from the barracuda VM to the Debian VM, so we can copy Debian’s kernel and modules over to the Barracuda VM. Select the Debian VM, click “Add Hardware”, select “Hard Disk”, click “Use and Existing Hard Disk”. Navigate to the hard drive from the Barracuda VM and add it to your Debian VM. Now boot your debian VM.

You should at this point have the Debian VM running with both its hard disk and the Barracuda hard disk. We need to mount the first partition from barracuda disk. On my system the barracuda disk was /dev/sdb . To mount the partition I ran ” mount /dev/sdb1 /mnt”. This mounts sdb1 to /mnt. Next enter “cd /boot”. This is where the Debian kernels are contained. Copy the 4 files to /mnt/boot (The folder for the barracuda kernels). These files are: config-2.6.32-5-686, initrd.img-2.6.32-5-686, vmlinuz-2.6.32-5-686, System.map-2.6.32-5-686. The numbers on the ends of the file names may vary. Next we  need to copy our kernel modules over to the VM. These are under “/lib/modules”. There should be a number that matches the kernel you have on your Debian VM. Copy the entire folder of modules to /mnt/lib/modules.

Next we need to edit the grub config for the barracuda unit. This is located under /mnt/boot/grub/grub.conf. I added the following entry:
title Debian Kernel
root (hd0,0)
kernel /boot/vmlinuz-2.6.32-5-686 root=/dev/sda1
initrd /boot/initrd.img-2.6.32-5-686

You want to put this entry before the line “title Barracuda”, so your entry is the default kernel to be booted. Now we need to change the root password for the barracuda hard disk. To do this edit the file /mnt/etc/shadow .  You’ll see a line that says something like:
root:e8,je#2ciw@$lo0nfielso2!jfJEcw:15153:0:99999:7:::
Delete everything between the first two colons. This will change the root password to blank. If you want to change the root password back later, copy down everything between the :, and you can change this line back later to restore the original root password.

Now shutdown the Debian VM. Now start the barracuda VM. The system should boot. Once you are prompted for a username, type “root”. The system should let you in as the root password is now blank. Now if you type “iptables -L” you should receive an error about missing kernel modules. You can fix this by typing “depmod” (this fix should be permanent, and this is the reason we needed to change the root password).

Your barracuda unit should now be fully functional in a VM. I’ve not tested this fully and I recommend STRONGLY that you test barracuda unit thoroughly before putting it into production. I also recommend reading the post from the link above (About the BIOS password) to find some other cool tricks such as enabling features on your Barracuda Spam Firewall. Please post below about your success or about other issues you may have had that I didn’t.

After you apply changes and reboot, the device should show as 3TB in Windows.

UPDATE:

I had a problem with another drive recently. I had it hooked up through a USB cradle and it kept showing up as 750GB even in Gparted. I removed the drive from the cradle and hooked it directly up to SATA and the drive showed as 3 TB. I then formatted it with Gparted and it works fine in the USB cradle now (I wrote over 2 TB to the drive to verify it was functioning properly).

UPDATE 2:

We’ve been having problems with the backup drives in the older enclosures. We could setup the drive so the entire 3 TB can be used in the enclosure, however after 3-4 days the volume would become “RAW” and we’d lose all the data on the drive (Good thing it was only backup data). We eventually ordered a new enclosure and that fixed the problems. With the new enclosure we no longer had problems seeing the full 3 TB in Windows either.

I guess what I’m trying to say is that in my opinion there isn’t a good phone on the Verizon network. I wish Verizon understood that a good network with crappy phones is a crappy option. So when is this going to change?

First off I started with my iPhone 4. It is running version 4.3.3 of the IOS software. I connected it to a WPA2-Enterprise network, accepted the certificate for our real radius server. I then shut wireless off on the phone. I then changed the radius server on the access point to my WPE version of freeradius (Which was using a certificate NOT signed by an authorized authority). I then turned the wireless back on on my phone. The phone did connect to the network, but it appears that after it saw the wrong certificate it disconnected from the network without sending a password. If I clicked on the network, a new prompt to accept the certificate from my WPE freeradius now appeared. If I accepted at this point, the username and password were captured.

Next we tried a phone running Android 2.3 . We connected it to our network with our normal radius server, but we never specified a “Certificate Authority” when it was connected (There wasn’t anything in this option). Next we shut the wireless off on the phone, then switch the radius server on the access point to the WPE freeradius server. After turnning the wireless back on on the phone, it immediately attempted to reconnect AND sent both username and password.

While this is bad, we found a way to prevent the Android phone from connecting to the wrong radius server. We exported the certificate authority certificate that signed the certificate for our radius server. We copied that certificate to the Android phone and installed it. When we connected it to the WPA2-Enterprise network in the “Certificate Authority” box we could now select our CA. We selected our CA. After the phone connected to our network with the proper radius server, we shut the wireless off on the phone, switched the access point to the WPE freeradius server, then turned the wireless back on on the phone. The phone did not reconnect to the network. Trying to select the network and forcing the phone to reconnect failed as well. The phone would not connect to the network period.

I’ve not had a chance to test Windows XP and Windows 7 against these types of attacks, however I found that someone else had already done this research.

We contacted HP about the issue and they indicated that since we’ve had our scanners for longer than 1 year (The warranty period on them), that they wouldn’t even speak to us unless we paid $100. I think we should all commend HP on supporting your customers when the problem is your own software. So I did some digging around and found that they still had the Windows Vista version up on HP’s site. I downloaded this version, set compatibility to “Windows Vista SP2″ and then ran it as the administrator. The program installed and has worked fine ever since.

After a long long long wait (Just let chkdsk do its thing….. Even if it seems like it is stuck in a loop) chkdsk finished and after rebooting the drive shows up as NTFS.

Recently I had  need to put up a small HTTPS website for a project. I did some digging around found an SSL Tutorial for Apache. After getting the CA and server certificates created and added in Apache, I tried it in Firefox and it worked great. I then tried the same site in Internet Explorer and immediately got a “Internet Explorer cannot display the webpage” with a “Diagnose Connection Problems” button below it. I turned off all add-ons and the firewall on the machine and nothing helped. Wireshark even indicated that Internet Explorer and the site were communicating. I finally decided to load Apache with the “Snake Oil” certificates that Debian creates automatically. Then the site magically worked in IE.

I then found this tutorial on creating SSL certificates. I was able to create a SSL certificate that IE liked by following the instructions in the “Create a a self-signed certificate (Extra)” section.

Subject: Test Email

Sent: 11/7/2010 11:27 AM

The following recipient(s) cannot be reached:

‘destination_email@email.com’ on 11/7/2010 11:27 AM

None of your e-mail accounts could send to this recipient.

Please be aware the email address has been changed to protect the innocent. I did a lot of digging around and eventually narrowed the problem down to the auto-complete cache for Outlook 2007 on the person’s computer. I believe it had corrupted the email address (However, the “display name” which was an email address still looked fine). To fix the issue, we just started typing the person email address. When Outlook 2007 popped up allowing us to click to complete the email address, press the delete key and it will delete the person’s email address from the auto-complete cache. You should be able to manually type the email address again and the email will go through.

Vocabulary:

• SNMP Agent – An SNMP agent runs on the target system and responds to SNMP requests from the monitoring system
• OID – Object ID – A string of numbers the monitoring system sends to the target system. It identifies the item or object
• MIB – Managment Information Base – Think of it as a map that displays several objects. You can build a string for an OID using a MIB
• Community Name – Think of this more as a password than anything. Several community names can be defined with different permissions

To Install the SNMP Service on Windows 2003 Server

Click Start->Control Panel->Add/Remove Programs-> Add/Remove Windows Components
Click “Management and Monitoring Tools” and click the “Details” button
Check the box next to “Simple Network Management Protocol”.
Click “Ok” then click “Next”

To Configure the SNMP Service on Windows 2003 Server

Right click on “My Computer” and select “Manage”.
Click the + next to “Services and Applications”.
Select “Services”
Find the “SNMP Service” and right click on it. Select “Properties”
The “Security” tab contains information needed to monitor a server running SNMP

Useful SNMP Tools

Net-SNMP

snmpwalk is a useful tool. For instance, if you run “snmpwalk -v 2c -c Community_Name 192.168.1.1″ snmpwalk will list all OIDs on a machine.

This can be narrowed even further. If we run:

snmpwalk -v 2c -c Community_Name 192.168.1.1 1.3.6.1.2.1.25.3.3.1.2

This will return all OIDs that begin with “1.3.6.1.2.1.25.3.3.1.2″. For instance this returned:

HOST-RESOURCES-MIB::hrProcessorLoad.1 = INTEGER: 0

This means we have an OID that begins with “1.3.6.1.2.1.25.3.3.1.2″ and ends with “.1″. This shows we have a single processor and the current load is 0.