Slashdot Mirror
Security Issues with Windows 2000 Datacenter?
"My company is currently looking to cluster our SQL 7 servers. We're
considering Win2000 advanced server or datacenter. Around a month ago I sat in a meeting with our VP of IT, and the rest of the network admins I work with. Compaq tried to pitch their Windows 2000 Datacenter or Advanced Server solution. Here is the way the compaq people explained it:
You get datacenter only from an OEM. They look at the apps you're running
and customize a solution for you in their lab. Every datacenter implementation is different, and every datacenter CD is different. Since we would be using an EMC SAN as our clustered storage system they said our implementation would take special customization. They would have to contact EMC engineers and work together. Once you deploy it, the OEM monitors it. And you can't install any service packs or anything without getting an OK from your OEM. Any service packs are customized for your enviroment. The SLA guarantees a 99.999% uptime or your money back. Part of your money at least. Datacenter isn't an OS, but a program in their words.
Now here is the problem. With Code Red and Nimda, how do you patch IIS
running on datacenter in a timely manner? The reason IIS servers became
infected was because the admins didn't patch them in the first place. So say
a new worm comes out in a few months and it takes a few days for MS to
create a hotfix. Datacenter admins can't install it until they get their
customized copy from their OEM. And almost every 2000 server runs IIS for
terminal server. It can take a few days and in the meantime your servers
could be down. And I don't see the SLA covering a situation like this. Meanwhile you're explaining to your CEO how this $500K supposedly guaranteed solution is sitting dead in the water and you can't do a thing about.
Is there something I'm missing, or did Microsoft look over something like
this? Especially when they are trying to push Datacenter as 'Big Iron'."
Erm, what are the big advantages of Datacentre over Advanced server etc?
Laptop Reviews
Another major fear is that the databases will become corrupted by patches. Transition from mysql 3.2.6 -> 3.2.10.
PHP, it kicks ASP!
Ask the vendor to modify the SLA to specifically cover the contingency of exploits and how they will be dealt with. Your vendor might try to claim that the 99.9999 uptime would cover this, but I'd counter that a server which is up but exploited is useless.
No one ever had to evacuate a city because the solar panels broke!
I think this problem is smaller than it seems.
The vender probably has a fix quickly, although it are special computers, they're still i386 compatible (sort of) so the vender won't have to port.
(-% TwistedMind %-)
First of all if your company is wealthy enough to be using Datacenter as a web server I hope they are paying you a decent salary. :)
Its a waste to use Datacenter as a web server or front end machine for applications, its best use is for big honking SQL applications like MS SQL server. Datacenter is a waste for Oracle/NT because Oracle on NT is the worst implementation of Oracle in existence. If you want a big honking box to do oracle for gods sake get a Solaris/HPUX/AIX monster. Big ass database servers should never be directly exposed to the internet anyways, the connectivity should be happening thru a balls to the wall firewall.
I think something that both Microsoft and the OEM's count on is the time it takes from the time a bug is found until the time the bug is exploited! In the case of Code Red and Nimda I think that time spanned months.
Is it not also true that only large OEMs offer Datacenter? I don't think you are going to have a huge problem with the likes of Compaq or Dell providing timely fixes. It may not be available the same day the Microsoft Fix is, but I would be guessing that MS provides enough info to the OEMs to get the fix applied within 3-5 days.
All in all I think the amount you need to worry shouldn't be more than the satisfaction you can get from a 99.999% guarentee
"And almost every 2000 server runs IIS for terminal server"
Erm, I work for a Citrix Gold partner and I've never encountered this before. Installing Terminal Server does not require IIS.
In fact, according to M$ recommendations, you should minimise the services running on the TS box.....That means no IIS.
Also, the "smaller but more servers vs fewer 8 way servers" for TS debate has been done and dusted, and the recommendation certainly isn't for having fewer large servers. The "sweet spot" is a farm of dual processor servers with 1.5Gb of RAM, thus you wouldn't need Data Center anyway - normal W2k Server would be more than adequate.
"Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
Keep these SQL apps behind the firewall.. turn off all IIS features on the sql boxes.. and at least Nimda should not be able to get at it. Any web interface would hopefully not use Datacenter, and use standard Advanced Server, which is easily patchable. If sql was available on the front line, well, they almost deserve it.
-=-Ze End-=-
Lets not forget that the vulnerability code red, etc takes advantage of has had a patch out for several months, but quite a few people never bothered to patch their servers. Chances are the patch(s) will be available shortly after the mainstream ones are released if you have a good vendor.
Besides, say your running *NIX with a specially modified version of apache, and there is some remote exploit that is discovered. Obviously you can't just download the source, compile, and install, for fear of loosing those 'special features'.. You need to patch your source code, which may barf (and then you either have to modify the patch file or do it manually. Which could suck if you have no programming skills, and its heavily modified)...
While most of us would view using a patch trivial (patch, recompile, install), the point is that similar situations could happen.
Datacenter servers are not the only ones: Many e-banking applications (see s1.com, for example) are rolled by vendors, and upgrades do not come out as fast as vanilla IIS upgrades because of this.
I don't know of one bank that uses a non-IIS platform. Kind of scary.
When I was studying, I was taught that one of the reasons to write maintainable code was to prevent lock-in. Good coders don't need to force companies to keep using them, they should produce good enough work that the comapny sees no need to rplace them.
Microsoft of course, do not write good maintainable code. They don't supply commented source, and they don't give the customer any long term rights to use the code as they see fit. Any goodprofessional should avoid microsoft products simply because they will immediately prevent themselves from having any choice at all. It becomes impossible to back out.
almost every 2000 server runs IIS for terminal server Errr, since when? Terminal Server doesn't require IIS to be installed.
I'm not an NT fan (run all UNIX stuff myself) but in general I've learned from bitter experience not to trust any sort of outsourcing solution. Learn to do it yourself, or hire someone who knows their stuff. But make sure you have direct control over your systems or they will spiral into ickiness.
TO BUY A NEW CAR WOULD MAKE YOU SEXUALLY ATTRACTIVE.
Worlds largest crack/xxx/iso/divx/pr0n server!
I've seen it happen to production servers b4 ">
If you aren't allowed to patch your server, then you should isolate it behind a firewall of some sort, so that the chances of infection are minimized. This may not work well for IIS (beyond simply not running it), but it will serve you well in the general case.
Reboot macht Frei.
...is when RedHat|Debian|Slackware comes out with their new RedHat|Debian|Slackware 2000 Datacenter Server!
Just because I AM paranoid doesn't mean they're NOT out to get me.
Is a locked down version of Windows. What happens when you lock it down? Well, intensive testing occurs first to determine what is being done with the box and what possible problems could arrise. Then those problems are solved. Also, only certain applications are certified to run on a datacenter box. The goal here is to achieve five nines. That is have this box up and running for 99.999% of the year. Without thorough testing of applications this level of availability would be impossible.
Part of what you get with a Datacenter purchase is a premier level of support. This includes a named engineer for support, and automatic escalation to the highest level for any support needs. It also includes any updates and or fixes on a priority basis - if you have a Datacenter server you get patches, updates, etc. before anyone else does.
It must be impossible to patch any linux installation if customized solutions are sooo hard to patch. Why would one wait for their OEM to move if they know a patch for one of the applications they are using is available? Download or apply only relevant parts of service packs, and you are done.
Gentlemen, you can't fight in here, this is the War Room!
Get the vendor to patch your servers within 12 hours of Microsoft issuing a hotfix/patch. If they will not put that into the contract, tell them they're not professional enough. If they cannot do something as easy as that, would you really want them running truly business critical solutions for you?
Stop the brainwash
While we are discussing Terminal Server, can anyone perhaps shed some light on whether it is possible or not to increase the bitdepth of a Terminal session? We have an application that looks terrible in the default 256-color mode and I've been banging around in the registry/component interface looking for an option to increase it.
I mean, did MS flat out engineer it for minimum bandwidth requirements (dialups etc) or is there some way to use 15/16/24/32 bit color?
- JoeShmoe
"Would anyone out there actually recommend Datacenter for corporate environments?" -- Sure, Bill Gates, Paul Allen, etc... ;)
Winter 2010: With Glowing Hearts
Then you can negotiate all the details. And remember: 99.999% uptime does not mean that your server stay up that long, but that you have only an unscheduled downtime of 0.001% or less. Applying a patch is, in nearly every case, a scheduled downtime and does not count.
Now imagine you really, really need this patch: you can urge your OEM to install it and keep him free from all responsibility (e. g. a server crash after this does not count to the unscheduled downtime, because it was your decision to apply it). If you trust him to play fair, that's fair for both of you.If the OEM is trustworthy, he'll do what you order him to do, but in that case you will be responsible for the outcome as well.You can't burden someone with responsibility if he can't make the decision (unless you don't play fair).
You found a sword: +4 damage, +5 moderator points
I can't find any info on MS's site right now, but I'm sure that OEMs that supply W2k datacenter are required to have a support team ONSITE at MS's campus 24/7.
;)
This article raises a very good point, but Microsoft's idea behind datacenter was they hat total control over the hardware environment, and they made sure OEMs would stand behind it too, so I'd be very surprised (and dissapointed) if the OEM didn't contact their customers *immediately* with patches whenever there was a hole (and I'd guess they are pretty busy too
Put datacenter behind a firewall, the webserver (advanced server or the like) on dmz and have a secure "pipe" to the datacenter server where you database resides - no need to use the datacenter server as your webserver too, if you can afford datacenter server, you can afford a separate machine acting as a webserver.
Just my opinion, buy hey, I'm a linux guy...
Any technology distinguishable from magic, is insufficiently advanced.
I can see you haven't worked with Microsoft software very much, so I'll give you the solution: Reinstall your machine.
It's *just that simple*, can you believe it? Every time Nimda hits your machine, just wipe out the system drives, reformat and re-install! Easy, right? Sure you may have to reinstall 40 or 50 times a day, but again, if you are familiar with M$ software, you'll know you need tons of backup machines that you can swap out as needed with your infected machines. Make an assembly line of it. Have one guy reformatting, another guy reinstalling and a third guy disconnecting the infected boxes and plugging the fresh machines into the network!
Now, where do you want to go today?
"Your superior intellect is no match for our puny weapons!"
*Nod* all of these servers should be placed far behind a strict ruleset firewall.
But what about Redundancy? That's one thing I don't like about this "datacenter" why should there be only one? Or.. why should an application have to call for just "one" server? Wouldn't it be more wise to develop the application across a dual array of servers? Each one of these servers could be easily patched in a matter of minutes, at the same time. (Say windows2k advanced servers.
I'm personally not a fan of MS server products.. Although I have had to use them for quite a few applications.. but there has to be a way to get by the "necesity" for DataCenter Server.
------------
Sase
"It's the opposite of that."
This is commonly refered to as the Mainframe Mentality: these systems are so critical to a business, you don't make any changes to them unless these changes are a. absolutely critical and b. have been tested extensively in the exact configuration you'll be running them.
Now, it may seem that this would cause every Windows 2000 Datacenter server to be instantly infected with Code Red and friends, but in reality this will not be the case, because:
1. You don't expose your Datacenter servers to the Internet -- never. No matter if you're running Microsoft, AIX, Solaris or Linux: only trusted systems should have strict "need to know" access to your server;
2. Datacenter-type servers typically don't run HTTP servers. You would scale out HTTPDs (more boxes), not scale them up (bigger boxes). Also see rule 1;
3. The config of your Datacenter server is the bare minimum. So, in the case of Windows 2000, you would not ever run IIS or Index Server (the true culprit in case Code Red et al...) on it, just your database server and perhaps your business logic (although that, again, tends to scale out better than it scales up).
In summary: security hotfixes and Datacenter-type environments tend to be mutually exclusive. If you need a patch to your Datacenter server, it pretty much needs to be custom-developed for you. Fortunately, since Datacenter setups are not typically designed by the clueless individuals that gave Code Red free reign, this tends not to be an issue in real life.
Would anyone actually recommend one of those Linux based "all-in-one" appliances that you guys love so much? You have to wait for your vendor to patch those too!! Do you hear anyone asking that question?? Nope.
If anyone out there is running Win2k Datacenter, I've got an important question I've been trying to find the answer to, with no luck so far. Can someone finally give me an answer? The question is this:
Does Windows 2000 Datacenter ship with 3-D Pinball installed by default? If so, is it in the Start menu?
That's all. Thanks.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Comment removed based on user account deletion
Nimda did go behind firewalls. It came in via e-mail or external consultants with laptops that attached to the LAN, and then attacked all intranet servers. As the story says, IIS is used for administering these servers, so they are indeed in a very vulnerable position and need to be patched.
Theres a secret message in this troll comment!
I bet that it is a coded message from bin Laden
to Jon Katz asking to cease and desist from
posting his lame stories to this site.
Thank you and have an Afghan-opiun filled day.
Since you're paying microsoft a shitload of money, I'm sure that something can be worked out. All the friggin losers who were hitting my box with (a la Code Red) were on DSL / @home lines.
Incidentally, the iis vunerability was known since iis 4.0 was released. It was kept secret by MS because of the "If no one knows about it, no one will exploit it". I'm thinking the data center people get the patches that home users don't - sort of like netware's support, there is a $200 per support issue, but they will forward the problem all the way up to the guy who coded the section you are having a problem with.
The lame fuck of the day is 24.202.127.156
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
I searched e2, and found Symbionese Liberation Army, Sealed Lead Acid battery.
:/
Still don't know what it is that you are referring to
As a sort of related issue, we're going to see many more implementations of W2K/DC & MS-SQL, as Sybase have decided to "update" their licensing model and fuck their customers in the arse.
Originally, it was:
Is your Sybase database accessed outside your company? Yes? More money please!
Now its:
Is the data in your Sybase database accessed outside your company? Yes? More money please!
Nte the subtle difference. We've got many front end applications in a DMZ talking to Sybase in our datacentre - the users never see Sybase, nor even know where the data comes from - but now Sybsae want more money...
So our CIO has done a deal with the Great Satan of Software, and we're going to
1. Sell all our Sun kit we use for hosting Sybase
2. Buy shit-loads of cheap x86 servers
3. Have MS "consulting services" port all the DBs and integrate them with our existing applications.
This sig left unintentionally blank.
Specs are hard to write and all vendors have weasel clauses. Just look at insurance policies - damage due to acts of war are generally excluded. With cracking being described as a "terrorist act" you could end up with exploits not being covered.
A big common exclusion is "unscheduled" downtime. One of our vendors would see a router or firewall machine starting to act funny and then quickly "schedule" some emergency downtime that night to reboot it thus avoiding having to pay.
I have not had good experience with outsourcing - never forget that these are the same bunch of folks who are getting skewered for lousy tech support for poor end-users who have paid extra for support packages. Attitudes don't change much across corporations.
Before I would spend the bucks for any sort of "managed services" I would make sure that the vendor guaranteed 100% availibility without exception. Availibility must be defined as a maximum latency (ie. no end user will wait more than 750ms for a response or whatever is needed).
Rationale? Any app that requires this type of support must be available to the end user without fail. That's why you pay the bucks.
OS is "up" but web server is compromised or down? It's no good to the user. The downtime was scheduled? End user doesn't care.
Why 100%? Why not. They are already guaranteeing less than 316 seconds per year of downtime. Let them work their payments for that downtime into the contract cost. I don't want to have to total up downtime and argue over when the year started. I want the vendor to know that any downtime costs them bucks. No argument, no weasel clauses, no exceptions (better keep those machines maintained, protected and patched).
Been there - been burned. We moved our servers from a "managed solution provider" to a generic server farm and got far better service for one tenth the cost.
Put the datacenter server behind a firewall, preferably with some string matching functionality (ie watchdog).
/default.ida, filtering on global.asa is also a good idea ;-) etc ..
the later iptables have a string-patch included, which allow you to target certain port/string combo's, with this it is easy to block worms from the webserver, as long as you know what request it makes.
exampple to block cmd.exe access (taken from my own internal firewall scripts, this will block nimda)
$IPTABLES -A INPUT -p tcp -i ! $INTERNAL --dport 80 -m limit \
--limit $LIMITLEVEL -m string --string "/cmd.exe" \
-m state --state ESTABLISHED -j LOG \
--log-level $LOGLEVEL \
--log-prefix "MS IIS cmd.exe usage:"
$IPTABLES -A INPUT -p tcp -o ! $INTERNAL --dport 80 -m limit \
--limit $LIMITLEVEL -m string --string "/cmd.exe" \
m state --state ESTABLISHED -j LOG \
--log-level $LOGLEVEL \
--log-prefix "MS IIS cmd.exe usage:"
$IPTABLES -A INPUT -p tcp -i ! $INTERNAL --dport 80 -m string \
--string "/cmd.exe" -m state --state ESTABLISHED\
-j REJECT --reject-with tcp-reset
$IPTABLES -A INPUT -p tcp -o ! $INTERNAL --dport 80 -m string \
--string "/cmd.exe" -m state --state ESTABLISHED\
-j REJECT --reject-with tcp-reset
If you wanted to block codered, filter on
(see iptables docs for more info)
G'luck
This is an odd question because both code red and nimda were actually viruses that took advantage of things like directory traversal and admin tools on the system. In short most admins already knew about these issues and fixed them themseleves by disabling the dir traversing and removing the template site.
So in short to answer your question when it comes to code red or nimda you really should not have a problem if you are a good admin. The same is true in the linux world and newbie web programmers that do things like system calls without checking out what is going to be called. If you call something that the users passes to you then obviously they can do things like tracrt ip; rm -rf / and your code would let it. This is not perls fault or php's fault or any other languages fault it is the programmers fault.
As much as I dislike windows, mainly because I have been an asp programmer for a long time and I would rather use linux and do perl programming (which I do now), Microsoft is somewhat right in that a knowledgable sysadmin already had the holes fixed. At the same time they should not send out software with issues like that.
--MD--
If you are really concerned such language and costs will be understandable.
for agreeing with me, but you didn't have to do it in such a hostile manner. I'm not blaming MS. I think MS gets a bum wrap. Of course if you have such a large installed user base, you are going to run into more public problems than an OS with a relativly small user base most of which are techies.
Yesterday my computers asked me if they could DL patches for the two MOSX security holes reported here recently. IIRC, Win 98 used to do the same thing. So why were all those NT and Win2K machines unpatched? If MS has the patches months before the worms appear in the wild, why haven't the machines already patched themselves?
And wtf is "runs IIS for terminal server" supposed to mean? That doesn't even make any sense.
It is called TSweb, and it allows you to log into the server using terminal server without having to have the client installed on the local machine.
You really don't want to put IIS on you Terminal Server. If you're using TS in admin mode you don't need to use TSAC (the web plugin). I find I do just as well with the RDP client application. It works smoother and the win32 version will fit on one floppy if you want to carry it around.
You like most Linux users haven't worked in real enterprise shops on enterprise class hardware and software. First Datacenter-like systems aren't new, Tandom and other has made NT systems with five-9's uptime guarantee for years. Compaq's DataCenter box is based on the old Tandom sysem. They typically run the backend of multi-tier business systems not web services. So they aren't very visible or accessable. There is big money on the line if these system don't deliver. If the systems go down and SLA's aren't met lawyers are on the phone. This is one of the things that will keep Linux out of the Enterprise, there is no one to hold responsible when things go wrong. I work in a LARGE MS and Sun shop. When things go wrong and it takes longer to fix than it should we are on the phone and MS and Sun are on site and calling whoever they need in MS or Sun to get the problems resolved. Until someone offers Linux support at that level it will be left to departmental or web servers.
Loaded statement... entering Slashdot filter code...
Made by Slashdot author = PASS...
Negative against Microsoft = PASS...
Vaguely positive to Open Source operating systems = PASS...
Good to go.
I actually posted this question twice, and I'm glad they used this second posting with our actuall situation. The first one was more of a what if scenario.
As far as terminal server and IIS, you need IIS if you want to use the Terminal Server Advanced Client and go in through the web. I was originally taught to use TS through IE and forgot going in through the TS client.
If we do go with Datacenter, the servers will host SQL 2000 Enterprise in a clustered enviroment. We currently use SQL and have a propritery in house written app for it.
And as far as the Code Red holes being found months prior to infection, I just used this as an example. I remember in 1997 and 1998 NT had new security holes every week. Windows 2000 is slightly better. 6 months ago I remember downloading hotfixes that will appear in service pack 3.
My question still remains, if a new flaw in IIS, the kernel or any other part of the OS is found how long are we supposed to wait for a fix? I forgot the specifics, but I'm pretty sure the compaq people said they customize the source code for your enviroment. They will need a copy of our in-house app, get in touch with the EMC engineers because our EMC box will be our clustered storage and analyze everything else. Then we will get a CD with a customized copy of Windows 2000 Datacenter. Like EMC, the servers will be monitored by another company and they will most likely know of any problems before us. Every so often we will get a new CD with updates, service packs, etc customized for us. But if a new worm comes out in a few months that exploits some currently unknown flaw in Win2000 or any other part of the OS, will we be dead in the water while we wait for a patch? After September 11th we were calling EMC for tech support on our Symetrix and we were basically told get in line. They had richer customers to support first.
Tomorrow I'm going to tell the CTO that we have to replace all our Datacenter machines with overclocked AMD Athlon's running Debian Unstable and administered by a geeky fuck still in high school.
Comment removed based on user account deletion
Both Nimda and Code Red can be avoided by locking down the IIS 5 configuration (... as demonstrated by the MS IIS lockdown tool). No patches (not even OS service packs, i.e. no Win 2k SP1 or SP2) are required! If you add some firewalls in front of your IIS, one of those being e.g. ISA Server 2k, you could use - HTTP forward caching (where all cached requests would be handled on the "other" side of the NAT firewall) - content filtering (to block offensive code such as Nimda). If your admin knows her job, everything should be just fine with your Win 2k Datacenter (except for the noise those boxes tend to make) ...
M.
The issues mentioned in this article are null & void, as a situation like that would most likely never, ever happen. (Then again, you picked Compaq as your OEM, so maybe...*insert rim shot here*)
Comment removed based on user account deletion
So say a new worm comes out in a few months and it takes a few days for MS to create a hotfix.
Is there something I'm missing?
Absolutely. You've got your timelines backwards.
Worms come out a few months after the bugs have been discovered and patches have been made available. We're talking months here. Code Red came out more than 2 months after the bug had been discovered and patches created.
Microsoft has had their patches out in the wild within a few days of a major bug being discovered. The worms however take much longer to be created/deployed/spread. Although it is possible for the worms to come out much faster, they will still be lagged behind the discovery of the bug, and the patches are issued almost immediately.
And if you have an agreement with your provider that you will have 99.999% uptime, then you better believe that they will be phoning you at 2am in the morning to tell you that they're coming over to install a new patch lest they break their contract.
If God gave us curiosity
Noone can recommend Microsoft products where high security and reliability are concerned. ,for personal amusement ,or curiosity ,but that's where it ends.
This is not serious.
In no mission critical service can a single Microsoft product be relied on .
MS can probably be used at home
Remember, 99.999% uptime is 1.44 minutes of downtime per day. Just enough time to reboot a well-tuned system.
This brings up the age-old question; Why are we even using windows?
Sure, on the desktop, windows has the largest user base. Why? Application compatibility, all you apps run on windows. No, its not the most secure, the fastest, the most stable. Its compatible.
Why use windows as a server?
Simple, your desktops are running windows, why not run windows as the server. You get easy configuration, tight intergration, etc. Very rarely will a server run windows, just for the heck of it, nor will a windows server power a network full of linux boxes.
Why use windows as a datacenter server?
I honestly cant answer this question. Unix is known specifically for its scalability to run on the biggest and baddest boxes around (read mainframes). IBM and Sun have been in this market for years. Microsoft is a new contendor in this market. Sure, ibm and sun both made their own hardware, but their mainframes were designed with a few specific tasks in mind.
Sure, a datacenter server shouldnt be exposed to the internet, but microsoft has the ability to expose these vital machines to the net. Generally, for an application of this magnitude, the os with the highest performance which fits the needs of the people owning the server gets chosen. I dont have numbers to back this up, but i highly dobut that windows is winning that race.
Which brings me to another point.
Why do we use any os in particular?
Why do we use linux as a server?
Its scalable, runs on many platforms, fast, secure, plays nice with others, open source (big + for developrers using machines this big, so they can fine tune it to their specifications), and most of all, secure (yes i know i said secure twice... its that important)
Why use linux on a desktop?
No reason in particular. Only that it's free. It isnt very usable (Jakob Neilsen definition of usable, as in intuitiveness, rather than if it works or not). Its confusing, and few desktop apps run on it. But, its secure and stable, and thats a big +
Why use mac os (classic)as a desktop os (or beos or any of those niche oses)
They're usable, theyre not necessarily secure or extremely stable, but they have a lot of desktop apps, and are relatively easy to use, yet remain powerful enough for the demanding user.
-- If you try to fail and succeed, which have you done? - Uli's moose
Comment removed based on user account deletion
All it took was one nimrod getting infected and then tunneling in through the VPN software. Damn near everyone behind the firewall was running (of course unpatched) IIS because the standard software install didn't disable it. But you know, there's corporate IT for you in a nutshell. Did the CIO catch flack for it? Was any attempt made to improve procedures so this wouldn't happen again in the future? Hell no! They patched everything for that one problem and then went back to their complacent little lives. I guess they think lightning never strikes twice.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
The thing you're overlooking is that the Nimda and Code Red viruses came out AFTER the bugs they exploited had been discovered and patched.
This hypothetical DataCenter would not be impacted because the patches would have been tested and applied long before the viruses hit.
As much as we like to joke about Microsoft being "Swiss Cheese," the truth is most bugs have patches available long before there are exploits. DataCanter would mean all of the relevant patches would be tested and applied long before the viruses hit.
The only reason my servers were hit by Nimda was because I trusted out Chucklehead Network Admin to understand the difference between downloading and installing a patch. I told him to patch it, but did he listen? Apparently not. I guess flirting with the head of the Insurance Department was more important than the bulletin from the Microsoft Security Mailing list. Never mind the fact that I had to show him how to import a contact list into Outlook, never mind the fact that Clippy is too complex for him to comprehend, just ignore the guy who BUILT our infrastructure when he tells you to apply a patch that will protect the servers from the SINGLE MOST COMMON WORM ON THE NET!
I gave him the @$@(*& URL and told him to install the patch. All he had to do was paste the URL into the server's web browser, click a file name and select "Run from present Location" then Click YES on anything else he saw! But did he DO it? NOOOOOOO. He SAID he did it, but that's not the same thing as DOING it!
But hey, he managed to screw the trailer girl he'd been hitting on, so I guess out server down time and the dozens of root.exe files I had to delete were worth it, huh?
And before the tolls start in I am NOT jealous that he got laid. I spent the last 24 hours in bed with my girlfriend, and get more action in a week than he does in a month. He's the one going after the company's chain smoking pot addicts when he's supposed to be working.
And don't get me started on the 300 megs of porn on his hard drive! We only have a single T1 for the whole company's in-house operations. Thank GOD we host our servers off site or our clients would never get in. He downloads the W2K service pack off the Internet each time he installs it instead of running the local copy I saved to the server.
And don't get me started on his MP3 collection. He must eat up 90% or our bandwidth. Uploading a 50k Perl script takes me 20 minutes because he's downloading porn and MP3s, but because he's screwing the comptroller' s daughter he never gets in trouble for it. Meanwhile _I_ get grilled for out poor network performance, and just because he DENIES having downloaded all that crap he's excused and I'm told "There must be another cause."
And now he's studying for an A++ exam, and his comment to me? "Why do I need to know all this IRQ S***, we use Windows 2000. That's not in computers anymore."
ARGGGGGGGGG!!!!!!!!!!!!!
"Live Free or Die." Don't like it? Then keep out of the USA
I know exactly what TSweb is, and that is not a clear reference to the TSAC. Nevertheless, TSAC doesn't require IIS be on the terminal machine anyway, it can run off any box. It's still just an RDP connection.
The most important thing is that 99.999% uptime per year means a downtime of 5minuites and 16 seconds.... most PC's dont even reboot in that time frame :)
no text
why should there be only one?
Because it is the destiny of W2KDC to engage in ritual combat with other servers and OSs. W2KDC servers are monitored 24x7 by a covert group called "watchers". A W2KDC can only be brought down by cutting off the head of the sysadmin - or not paying your support contract.
are belong to us!
There is one thing that should be made clear. Microsoft has created patches before the worms were out, not after. System admins had months to patch their system before many of the worms were released.
He obviously didn't even bother to check, but rather was just spewing FUD. Using Netcraft, I found out the following (now that you got me curious)... these are the (Canadian) banks that I trust with my money nowadays...
www.tdcanadatrust.com - IBM_HTTP_Server/1.3.12.2 Apache/1.3.12 (Unix) on AIX
www.ingdirect.ca - Netscape-Enterprise/4.1 on unknown
www.cibc.com - Netscape-Enterprise/3.6 SP2 on Solaris
www.bmo.com - Netscape-Enterprise/3.6 SP3 on Solaris
www.royalbank.ca - Netscape-Enterprise/3.6 SP3 on unknown
You can accomplish anything you set your mind to. The impossible just takes a little longer.
Is it possible to cluster SQL server in order to yield increased performance?
Intuition tells me no, which is why you see so many large database servers.
But is it possible at all?
You can run it from any webserver.. it's active-X.. it's client side.
Also, you only need it available once.. you don't have to have it on each terminal server. You don't have to have it on ANY terminal server.. you can stick it wherever it's convenient... and use it to connect to as many terminal servers as you want.
solaris s0laris so14r15
you'll soon discover that most things that bring your server down won't be covered under the bullshit SLA.
Windows 2000 Advanced Server and Datacenter support network load balancing. Kind of like Beowolf where the machines divide the tasks among them. Never used it. We only had clustering running on advanced server at work to test it.
SQL 2000 Enterprise and Exchange 2000 Enterprise support clustering on advanced server and datacenter server. I assume they support network load balancing too.
Spot on! This whole article is flawed, the purpose of Datacenter and the restrictions on it is by design! Premium support means just that, when patches come out from MS, sure it means a few days(/weeks?) etc to be verified, but each M$ advisory has more than just a link to the patch, including steps to limit vulnerability in the interum.
Also the big thing to remember here is each of those exploits used in Nimbda / CodeRed were patched by ms MONTHS before either of those worms came out.
Like any highly customized - specialized vendor supplied unix, Datacenter is limited by design, and for damn good reason!
ms premier support for NT, Win2k, and Exchange is handled by clueless outsourcers like Stream International and other shithole support boiler-room/sweatshop operations. Once you get to the "third level" at the outsourcer your case gets to a first level support shithead at microsoft. I can guarantee that it will take over a month to talk to anyone that actually works for Microsoft or has ever touched a computer in a real live production enviroment.
Awhile back my organization had several major security concerns with both Win2K Server and Win2K Datacenter, most of which dealt with LDAP. After our concerns were finally escallated high enough within Microsoft, a surprising reply was sent to us... it basicly stated that some of the holes were to be patched by Q4 2001 but that we should consider upgrading to what they called 'whistler datacenter' (essentially the server and datacenter versions of Windows XP) for complete security. I for one am tired of feeding the M$ machine.
For everyone proposing firewalls etc:
Of course the W2kDC wouldn't be exposed to the internet. But, Code Red and Nimda could get into the corporate network through internet connected external webserver that then launches attacks all over the corporate intra. That's why some company could have hundreds of infected computers: not because all of them were exposed to the internet, but because one server that sees both internet and intra is compromised. And that may be under somebody else's responsibility. It takes just one lazy admin...
I don't know anything about W2kDC, so I don't know if running IIS on them would be required or not. Just that I've seen gazillion cases where some stupid application required IIS for some functionality that was pretty much essential for the application to be useful at all. Apparently everything by MS that has an administrative interface is nowadays "administrative WEB interface" that requires MS IIS to work, and administering the software without using said interface might be hard.
Supposed there are Patches for Datacenter on a fairly regular basis, lets say once a month.
Lets say applying 1 patch to Datacenter takes like 5 minutes including the reboot.
This means the server does not reach 99.999% uptime already.
Since when? IIS is not neccessary for TS -- the advanced client for TS works on an IIS page but you only need one web server which can allow you to access any TS server in your environment -- in other words don't run IIS on your Data Center server -- it doesn't need it.
The SLA guarantees a 99.999% uptime or your money back
Let me see, 99.999% uptime on a windows system. That translates to 4 minutes and 12 seconds downtime per year. I don't know about you guys, but on this planet that's not what I call a credible proposition. On windows, that' more like winning the lottery. I surely hope somebody in that meeting had the sense to laugh.
-- Another senseless waste of fine bytes.
As someone who just had Unisys install an ES7000 with Datacenter and talking to the install people. You can do anything to the box that dose not touch the kernel. How Unisys explained the 5 9's SLA is that they will have a copy of you set up and will apply patches to them before they are installed on your system, but I cases like code red they will issue them to you and put it on the test server to test. They aren't going to keep you from installing a critical hot fix but when possible they will test it before they unleash it upon you.
Try shoving the FreeBSD mascot up your ass. OUCH!
This may not be modded up high enough for the +4 folks to see it, but I have to say that the people posting at +4 and above have some really great comments.
It's nice to see Slashdot as a technical community, not just a Linux one. I know, I know, *nix is the preferred OS of many of the readers/posters, but it's nice to see such an array of comments and extremely constructive ideas and comments. Nice Comments, all.
Actually, that is *NOTHING* like Beowulf at all.
Beowulf is about squeezing speed out of multiple machines. Beowulf is not about load balancing. Beowulf is not about high availability.
From the FAQ
1. What's a Beowulf? [1999-05-13]
It's a kind of high-performance massively parallel computer built
primarily out of commodity hardware components, running a free-software
operating system like Linux or FreeBSD, interconnected by a private
high-speed network. It consists of a cluster of PCs or workstations
dedicated to running high-performance computing tasks. The nodes in
the cluster don't sit on people's desks; they are dedicated to running
cluster jobs. It is usually connected to the outside world through
only a single node.
Some Linux clusters are built for reliability instead of speed. These
are not Beowulfs.
Slashdot? Oh, I just read it for the articles.
Ask the vendor! If they are working with you, they'll be more than happy to answer (and I'm sure even in writing). Don't open the obvious flame war to all the trolls.
-k
That has absolutely nothing to do with my question.
Load balancing is NOTHING like beowulf.. beowulf is about using appropriate parallel-processing libraries (PVM, etc) to squeeze performance out of a cluster of machines.
As for the machines 'supporting clustering'.. that's an industry buzzword that's not terribly meaningful. ALL operating systems 'support network load balancing' in this respect.
Win2k advanced server & datacenter do NOT automatically cluster anything; clustering is application specific.
My question is whether database servers in particular can be clustered in order to increase performance (some queries to one machine, some to another). My theory is that they generally can't, because, in order to remain coherent, each machine would have to receive all transactions anyway.
(Certianly lookups could be done with replicated databases.. that's not what I mean though.. I mean real transaction processing stuff)
although according to my calculation it's 5 min 15 secs. per year. so patching every fix that M$ released seems totally unfeasible. But they would certainly have backup servers running at the same time, especially for cheap (relatively) boxes running IIS-if the OEM only made use of one webserver in their costly DataCenter solution, then they deserve to be out of business.
According to the MCT/Drone that taught us at my office, Datacenter can be modified to handle up to 64 processors based on hardware.
Essentially, we were told 99.999% of Windows business operations would never have any realistic need for Datacenter. This was designed for the poor bastard who has to run a site like E-Bay on windows/IIS.
[SARCASM]Or handle a national ID card DB...[/SARCASM]
With all of this said, if you're doing something that requires this much horsepower (64 GB of RAM and 32+ processors?) you should be running linux. I mean, how much of your horsepower on this type of machine is wasted by Windows just to handle the SMP?
Who did what now?
arent the exploits used by code red/nimda relatively old? it seems to me even with windows 2000 datacenter, the vendors would have released updates well before these worms were written.
wr0ng
If you are stuck in this unfortunate arrangement (having to run a customized version of Windows is a bigger nightmare than having to run regular strength windows) this is my recommendation:
Uninstall IIS, FTP, and SMTP services. (Your call if this is a best practice in every circumstance...
First, there is no legit use for Datacenter server other than SQL Server. Any DB large enough to warrant Datacenter could not be adequately administered using IIS. Second, rule #1 of SQL server is NEVER EVER RUN IIS ON YOUR SQL SERVER. If you break this rule, you do so at your own peril even without Code Red, Nimda, and whatever next week's major compromise is.
Who did what now?
First, why would you want to run IIS on your SQL 7 box? You DO NOT need IIS for terminal services, I have no idea why you think that.
Second, why are you looking at Datacenter when you want a clustered SQL solution? Advanced server is the product that you probably want here. You don't buy a mack truck to move a couch...
You should read up on Compaq's Data Center program at http://www.compaq.com/datacenter
1 .html#q1-1 says "Hot fixes and patches will be reviewed on a case-by-case basis for early release."
Specifically, this link http://www.compaq.com/solutions/datacenter/answer
You are most certainly not left out in the cold with this program. The "don't you dare update drivers, or install service packs and hotfixes" is there to prevent people blowing things up, when they shouldn't be touching the system, like with the recent Terminal Services hotfix.
Datacenter's change control is really no different than you would see in a mainframe environment.
Imagine a Beowulf cluster of these!
Microsoft has always had a policy of lying about the outsourced scum they use to provide support. It's doubtful that this shitty "windows datacenter" will be any different.
I generally wouldn't use Win2k in a production environment. While SQL server I think is a great product, the weak link in the chain isn't SQL-Server it's the operating system. I've gotten bitten too many times with windows, and I've never really gotten bitten with Solaris.
I remember when I first started my own company, we were looking for venture capital. There were vc companies that wouldn't even talk to us unless we switched over to solaris. It the time I thought, "screw them." Now I'm dumber, but know they were essentially right.
--Stupidity is Self Curing!
Not to defend data server (which we run on an enterprise basis at my company with no problems - our Dell Service packs are always up to date)
But what sort of a response did you actually expect to get by posting this on here ?
I mean come on now - this is Slashdot
MS Product = BAD
Free Source = GOOD
Therefore asking ANYONE on here to take a logical and intelligent look at this is a waste of time - in the last year i havent seen much in the way of balanced and intelligent comment on anything other than how good anything LINUX is and how bad anything MS is - thats the fact
Stop posting TROLL news articles - thats all this is.
Imagene a cluster of these (nimbda infected dataservers with oc3 to the internet)....
Microsoft got the top spots in the TPC-C transaction performance benchmark by using clusters of SQLserver2000. The feature that makes it worth using these clusters is 'partitioned views', which is something like: having a view on a set of data that is retrieved from more than 1 machine, i.e. what you want.
Never underestimate the relief of true separation of Religion and State.
datacenter is only a way for microsoft partners top make more money... i think that an advanced server is enough for almost any company. they just want to sell their "customized" solutions for companies that don't trust in their sysadmins.
".Sig Stealer" was here
How's about proxying the IIS server through apache, and caching the site somewhere with getwww, switching to the cache when IIS becomes unusable ? This way, for, say n * $1000 (n being the amount of clustered http servers you need) you can keep any site up for a couple of days cheaply.
Of course, any poster that says that you've got to keep the DB and the httpd on separate boxen is dead on in the first place.
Back to playing MAME for you, junior, leave enterprise computing to people who know what they're doing.
Well, according to eeye's Marc Maiffret, the predecessor of Code-Red was a .htr worm that went more or
less unnoticed because Microsoft quitely released
a patch.
While in the past a worm followed more or less closely after the exploit, this may not be the case in the future.
Just imagine if the exploit-coder and the worm writer were the same person !
Would you release the exploit while you have the worm in the works ?
Windows 2000 - from the guys who brought us edlin
Come on.
At a functional level, the thought of having customized patches made 'just for you' probably sounds quite appealing to most large scale MS users - to think that Microsoft are dedicating their time in some manner to cater for this company's needs to fine detail is pretty good.
Unfortunately I don't have any experience as an end-user of these apparent focus support promises, but i've never actually heard of this coming up before..
Of course, any large scale cluster on _any_ platform will create havoc if it is exploited - this news posting is just a troll to bring up the old iis-sucks-cos-of-vbs-etc hole yadda and view it in a different light and try and scaremonger people.
It all boils down to how good your admin is. Whatever platform you choose, you need to make sure your SysAdmin is as good as they need to be to make your shit secure - that's the bottom line.
"Never let the truth get in the way of a good story..."
I would imagine due to the partitioning abilities you would have a seperate partition for web services, in which case your SLA may not prevent you from patching such installation beyond the core os.
http://www.unisys.com/hw/servers/es7000/
Incidently Compaq resell OEM versions of this box.
Microsoft released MS-051 that was supposedly to fix an exploit for Term Srvcs. It fixed the hole all right. It also fixed NOBODY being able to access the Term Server either. Once a bug is released for DC. Where are you going to test it? DONT take the Vendors word for it, until you've tested it YOURSELF!
if you would use the ms products for an e-business-platform, datacenter is not the recommended product as os for the web-layer. there you should take an advanced server with apllication center to load-balance and replicate the webs. on the other layers, datacenter is really great. and if you implement high-availability-solutions, you can take down a partition without stopping the services to the outside. this shutdowns are planned, and so on, not in the sla's to achieve 99.999%. we are working with 3 es7000 and 10 partitions with MS win2k DC-editition since February, and just to the moment i've seen one bluescreen on all machines....
Doesn't this sort of discussion belong somewhere other than slashdot? Who cares whether you should use datacenter or not?
Here in NC (where I am located)First Union Bank uses this software and I believe they ended up going with some sort of advanced IDS system, that actually has some sort of counter-response to an attack built in. They did this because of just this situation where the OEM vendor couldn't get them patches quick enough, they basically let their systems become infected and stopped all non-authorized traffic going either way. Problem with this tactic is that although code red/nimda where relatively harmless the next version may not be so harmless and may take out there data center.
We are what we repeatedly do. Excellence then, is not an act, but a habit.
Everyone keeps saying you should just keep the Datacenter server behind the firewall. Considering that Nimda has an infection vector through a MIME-type bug in a browser as well as an e-mail infection vector it will bypass your external firewall without a problem. Even if you put a firewall internally to separate the datacenter server from the rest of your LAN, you still have a browser with security problems (since its part of the OS now).
If you have datacenter edition you have an enterprise contract, the person who submitted this has very little clue. We run MANY copy of DC, COMPAQ and M$ are our vendors and they have 2 hr response time on ALL critical ENTERPRISE level services. You DON'T us DC server unless you have a contract, YOU CAN'T even install the product without special codes. Nice editorial work /.
/. back or will it be sold off as assets ?
Just what I expect from an enquirer like source that you've become over the last few months. Will you guys still be alive when Andover goes under very soon ? Will you get control of
errr....umm...*whooosh* *whoosh* Is this thing on ?
sed s/\n/\n#/ etc/inet.d
openBSD is only especially secure as a default install, which means, essentially, turning all the services off. Kernel root exploits come about as common as linux, and they're using almost all the same apps
5 Nines on Windows - I get this all the time. In fact the only thing that gets in the way is the odd fix. I think that configured the right way the ES7000 and Windows datacenter could make 100% - no problems.
BTW Windows DC is dictated by MS. If MS say a patch is required, its REQUIRED. No Admins to get in the way - OEM's do as they are told - bean counters happy.
Run Hogwash... its modification of snort that actualyl makes firewall decisions based on snort rules... so you can detect an attack and refuse to allow it into your network.
hogwash.sourceforge.net
It's my understanding, given to me by a top Microsoft consultant (this guy was a fricking wizard), that service packs only replace files that actually exist on the target computer; that is to say, if you don't use, for instance, some Novell DLLs, they don't get placed onto your system.
Now, while Compaq or whoever are handing you a custom solution, they're not handing you custom code, are they? They don't rewrite lsass.exe, for instance, right? So whatever combination of Microsoft code they give you should be detected and updated properly by the logic in the service pack. Or so it seems to me at first blush.
Like I said, please correct me anywhere I've screwed up.
-vasudeva,
parenting http://users.downcity.net/~vasudeva/,
helping birth http://www.megarad.com
Personal me, collaborative you
I guess posting real facts vs speculation could be considered flamebait, but only on /.
/.'s plans regarding the potential shutdown/sell off of andover resources. Do they have a plan for the future ?
As to the Andover question I'd like to hear
http://support.microsoft.com/support/kb/articles/Q 265/1/73.ASP