Slashdot Mirror
Microsoft Releases Windows Server 2003 SP1
Masq666 writes "Microsoft has wrapped up development on the first major update to its Windows Server 2003 operating system and released it for download, The company said that Windows Server 2003 Service Pack 1 is currently available for download via Microsoft's site and will soon start showing up on new servers. Among the primary benefits of the free update is the inclusion of security enhancements similar to those added to Windows XP with last year's Service Pack 2. News.com.com has more details and commentary."
Does it still require an activation code of some kind or not ?
Trolling using another account since 2005.
£10 says it has a major security vunerability found in it within the first week of release.
First new and improved script-kiddie exploits available in 3...2..1...
Servers set to auto crash!
I've been using the latest RC as a desktop OS for a while, and it's pretty good; it does have some issues with Steam, but then again, it's not meant to be a gaming OS, just a server OS.
All in all, though, it's damn stable and secure as is, and it's pretty responsive.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
OK, I am not a Windows Server 2003 admin, but is it just me, or is it really odd that Microsoft is just now including a firewall?
If you don't know what AltaVista is (was), get off my lawn.
So what is "later this year" in Microsoft time?
This?
http://www.winsupersite.com/showcase/longhorn_pre
Longhorn Milestone 9 (M9) and platform complete
March 2005
Longhorn Beta 1
Late May 2005
Longhorn Beta 2
October 2005
Longhorn Release Candidate 0 (RC0)
Late February 2006
Longhorn Release Candidate 1 (RC1)
April 2006
Longhorn release to manufacturing (RTM)
May 24, 2006
In all seriousness, I definitely like the new "PSSU" (Post-Setup Security Updates) feature. Awful name, but it does the following when someone first installs Windows 2003:
1.) Blocks all incoming traffic.
2.) Immediately guides the first person who logs on through downloading updates.
This would be such a terrific blessing for new XP users: block traffic and immediately send them off to the update site. Excellent idea.
Enhancements
In addition to finding and updating security holes before hackers can exploit them, Service Pack 1 includes improvements to functionality that originally shipped with Windows Server 2003. Such enhancements make a great product better and raise the security, reliability, and productivity of Windows Server 2003. Below are brief descriptions of some of the key enhancements included in Service Pack 1:
Stronger defaults and privilege reduction on services--Services such as RPC and DCOM are integral to Windows Server 2003, but they are also an alluring target for hackers. By requiring greater authentication for RPC and DCOM calls, Service Pack 1 establishes a minimum threshold of security for all applications that use these services, even if they possess little or no security themselves.
Support for "no execute" hardware--Service Pack 1 allows Windows Server 2003 to utilize functionality built in to computing hardware, from companies such as Intel and Advanced Micro Devices, to prevent malicious code from launching attacks from areas of computer memory that should have no code running in it. For both 32-bit and 64-bit systems, this enhancement closes the door on one of the broadest and most exploited avenues of information attack.
Network Access Quarantine Control components included--Windows Server 2003 SP1now includes the Rqs.exe and Rqc.exe components to make deployment ofNetwork Access Quarantine Control easier. For more information, see Network Access Quarantine Control in Windows Server 2003.
IIS 6.0 metabase auditing--The metabase is the XML-based, hierarchical store of configuration information for Internet Information Services (IIS) 6.0. The ability to audit this store allows network administrators to see which user accessed the metabase in case it becomes corrupted.
New features
Microsoft is taking the opportunity afforded by the release of Service Pack 1 to introduce powerful new functionality to Windows Server 2003.
Windows Firewall--Also released with Windows XP Service Pack 2, Windows Firewall is the successor of the Internet Connection Firewall. Windows Firewall is a host (software) firewall, a firewall around each client and server computer on a customer's network. Unlike Windows XP Service Pack 2, the Windows Firewall is off by default on Server 2003 Service Pack 1, and must be turned on to begin protecting systems. The Windows Firewall is enabled for a brief time during Service Pack 1 clean installs for the duration of the new Post-Setup Security Updates portion of setup.
Post-Setup Security Updates (PSSU)--Servers are vulnerable in the time between initial installation and having the latest security updates applied. To counter this, Windows Server 2003 with Service Pack 1 uses Windows Firewall to block all inbound connections to the server after installation until Windows Update delivers the latest security updates to the new computer. After updating, Windows Firewall is turned off until it is configured for server roles. PSSU also guides users through immediate configuration of Automatic Updates.
Security Configuration Wizard (SCW)--SCW is a wizard that configures server security based upon existing server roles. SCW asks questions about server roles and then stops all services not necessary to perform those roles. SCW will not add roles, but will configure the server around the roles it performs. Like boarding-up unused doors, this new feature helps reduce the attack surface of Windows Server 2003.
Isn't Windows Server 2003 designed to be used on important machines? If yes, what benefit do these patches have? I doubt that many system administrators don't know about firewalls, and those who do probably don't know anything about patches, updates and service packs either.
True, but they have a few excellent ideas in there. I'm a little "meh" about the "security configuration wizard" (personally, if you're using a wizard to configure security you probably shouldn't be admining a server in the first place.
The PSSU feature, though (as I mentioned in another post), that blocks incoming traffic on first boot and immediately directs the user to download updates is awesome. Why other companies haven't thought about this, I have no idea. I really hope this gets put into the next consumer version of Windows.
Having carefully RTFA, I found a few typos, corrected above
"inclusion of security enhancements similar to those added to Windows XP with last year's Service Pack 2"
Does that mean the personal firewall is now also enabled by default on Windows Server 2003?
and how many programs does this SP break?
I like muppets.
That $245 is per incident, not per hour.
if you steal from one source, that is plagiarism, if you steal from many, well, that's just research.
I say wait until SP2.
IMHOP, the more interesting tidbit from this article is the info that XP 64-bit should go on sale next month :-) As the proud owner of 2 athlon 64's, that's actually something I would want to know about....
sometimes, i wonder if i'm the only conservative on teh intarweb. ah well, back to mah hogs and warmongerin'....
Ok, I have used Windows for development in 95 and 98 releases and now use OS X very happily. What surprises me is we are in late March of 2005 and Windows 2003 SP***1*** is being released.
--- Old Time NeXThead
Microsoft is also using the Windows Server 2003 SP1 code base as the starting point for the next desktop version of Windows, code-named Longhorn, which is slated to arrive next year.
Wasn't Longhorn supposed to originally be released this year? If they're going to use this service pack as a code base, they must be a long, long, long way off from a longhorn release . . .
(personally, if you're using a wizard to configure security you probably shouldn't be admining a server in the first place.
[sarc]
But wizards help to let everyone have a server. Its the logical follow up to having spelling and grammar checking in your software. Pretty soon, you won't need to learn about anything to administer a windows cluster. Heck, you won't even need a mouse or schooling. Just a microphone, voice recognition software and that MIT metaphor software. You'll just growl at your computer and it will magically do what you want.
[/sarc]
"1.) Blocks all incoming traffic."
Wow, that's just so brilliant...
I'm really at a loss of words to describe this brilliance.
Just think of it, closing all open ports from incoming traffic by default now. Wow. Why didn't anyone else come up with this great idea before?
I sure hope MS gets a patent for this, they sure deserve it.
"2.) Immediately guides the first person who logs on through downloading updates."
Now that's great. After all it is supposed to be a server OS, so people who deploy it can't be expected to know about things like updates, etc...
Brilliant again.
Way to go Microsoft. Cashing in by making your Service Pack bluescreen computers, resulting in lots of incidents. $245 a pop, and they can resolve them all by just telling the person "Reinstall Windows and don't run the Service Pack"...
What a crock.
"Longhorn release to manufacturing (RTM)
May 24, 2006"
I always thought that "RTM" meant Read the Manual. as in RTfM...
who knew...
- Joe
In other news, WinServer 2003 has had the same security holes that Windows XP had for years, without being fixed, until finally possibly being addressed in this SP1. Sounds like a no-brainer crack strategy is to look at the security patches in any MS service pack, then exploit them in the other versions of the OS on which the SP doesn't install. You'll have months to play in the blindspot.
--
make install -not war
It is quite hefty but then this is what I expect from "Service Packs" especially in one giant chunk.
"Download time remaining: 22 minutes"
So now I'm chained to box since I suspect at some point I need to click something on some dialog to complete installation (this is an assumption but past history on other updates tells me I should watch the process to make sure it goes all the way through).
On the other hand I had to setup sever based off of FC3 yesterday and out of the box it required to download 450MBish of stuff broken into 150+ individual downloads. After installing the gpg keys, I started the update ('yum -y update') and walked away from it. Other systems have something that is just as easy and dare say fool proof.
I would really like MS to bite off things in smaller chunks. I do recognize the fact that every part of the 329MB download is probably necessary but why not roll out in both a large chunk and small chunks to accomidate different enterprise configurations? I like having options on rollout but I constantly find Windows rollouts very lacking.
If you install this on SBS2003, do NOT run the new wizards - wait until SBS2003 SP1 is released in the next month or so.
I downloaded the SP1 first thing this AM. I will now sit on it while waiting to see if they pull it and release SP1a.
:-(
I sure it was a test server. I can't imagine any *good* admin configuring a production system to automagically recieve updates.
It sucks to be you today.
Keep the Classic Slashdot.
We are having the same problem, blue-screen of death, no safemode nothing. Any idea on how to fix?
File Name: WindowsServer2003-KB889101-SP1-x86-ENU.exeo ad Size: 337230 KB
Downl
Date Published: 3/30/2005
Version: SP1
Even without specifics, it blows me away that a service pack is almost 330MB. How can you explain something like that? If it's supposedly not insecure, and that much of an improvement over W2K Server, yet still requires fixes to the tune of half the size of the original install CD... then what am I suppsed to think?
Honestly. Can anyone give a legit reason why this is acceptable?
I'm against picketing, but I don't know how to show it.
Among the primary benefits of the free update is the inclusion of security enhancements similar to those added to Windows XP with last year's Service Pack 2
In other words now you've finished dealing with the chaos that was caused by XP SP2 you can now start dealing with the chaos that is S2k3 SP1
Hmmmmmm..... Deep fried and look like Squirrel.
Ouch. Making sure Auto Update is off now.
-----BEGIN PGP SIGNATURE-----
12345
-----END PGP SIGNATURE-----
Mod down! Come on , this update isn't even on Windows Update yet! This is just a cheap blow at MS, which will now be repeated by 1000s of lame ass slashdotters. way to go mods!
If you don't know how to download and deploy the network redistributable version of service packs you shouldn't be touching a windows box.
1) They are easy to crack remotely with default installs.
2) Weekly if not daily patches are required.
So, Microsoft comes out with SP1 and people are already whining.
1) What is the "no inbound connections by default" stuff going to help?
2) The length of time between Windows 2003's release and its first service pack.
C'mon people, put it together.
This is beta software and not part of Windows Update. There's literally NO WAY it could have been automatically downloaded and installed: it must be manually downloaded and then explicitly installed.
Slashbots are morons for a) believing this troll and b) modding it up.
Just once i would like to see MS take a "when it's finished" attitude about their OS releases. I'm really starting to be annoyed by the thought of scheduled patches and fixes. I understand that OSes are probably the most complex bit of software written but the idea of a release occuring while the dev team then immediately starts patching is a bit off putting. I know, MS isn't the only one that does this and I know this isn't a new complaint but we all need to vent. I'm surprised that a whole new branch of psychology hasn't sprung up dealing with OS rage. By the amount of flamebait being spewed by all camps (except the Amiga crew ... they're still blissfully happy listening to their Flock of Seagulls and A-Ha albums while doing pixel art ... lucky bastards) I'm surprised that none of the developers have really taken the hint. But when you have that much of a market share who do you really have to answer to other than shareholders? Hmmm ... if only i could figure out how to code clay tablets and start the whole industry over ... Cunieform v1.5 - Code Name: Babylon ... although at release 5.0 I think I might run into some legal troubles with Mr. J. Michael Straczynski.
"It's difficult to meditate on amphetamines." - Joe Walsh
I disagree that the primary message is that the user is incompetent. If your server insecure out of the box in such simple ways that they can be fixed using a security wizard, you're using the wrong operating system. This is a server OS, it makes no sense to have it be insecure by default.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
cocksucker. You have to download it and install it explicitly.
How did it "automagically" deploy on your box when MS isn't putting it on Windows Update until July? It can only be manually downloaded until then.
It is available through Windows Update right now. I don't know if it will work through Automatic Updates, but if you manually activate Windows Update the scan results page will inform you that it is one of the "Critical Updates and Service Packs".
Applying a brand new update for any OS (be it Linux or Windows) on a production server is simply stupid, I have only now just downloaded the information sheets on SP1 to deploy on our lab servers. Your also stupid if you have automatic update running at all on a production server.
Now I think you are most likely lieing as it hasn't been released to automatic updates (Microsoft isn't that much of an asshole). Second Microsoft support is pay for hour (at least I have never seen any), it's pay per incident, and if you were smart you would get a hold of your consultant (you do have a certified partner that you work with?), who gets free business down support, in which your case would qualify.
You can also download SP1 here, though I wouldn't recommend it.
According to these links, Microsoft has finally figured out how Linux boots with tftp:
BartPE using PXE
Booting Windows from a Debian box
It's nice to see Microsoft pick this up. Booting Windows with standard tools, what a concept!
I'm sooooo spoiled with anaconda kickstarts... can Microsoft make deploying servers as easy as RedHat/Fedora?
I had a pranoid thought the other day. It seems that the MS policy for supporting products runs for about 5 years. Support for 2K pro was dropped earlier this year. XP was first released in May 2001, longhorn May 2006. Is this the forthcoming strategy for the forced upgrades the we all know and love?
Our diversity is our strength
Good point, but, still there are better ways to release updates than to force a re-install of the DLLs
Laugh....
So I'll bite and run a manual sync of our WUS (Windows Update Services) servers.
No 2003 SP1 yet. Try to more creative with your trolling.
Ever feel like you are driving the getaway car?
Red Hat sucks, exactly.
I agree that MS Win 2003 is out-of-the-box more secure than RH FC3 EE.
We just ordered 320 Server-Licenses and will be replacing these "Linux-boxen" that my predecessor has "maintained".
Speak for yourself.
I've found a few SP1 patches that have been delivered caused a compelete inability to boot 2003 and all are related to norton corp edition. I would uninstall before applying SP1. Or at least image your system first.
I imagine they've recompiled all the system DLLs using newer compilers. They've got better automatic buffer overflow protection than they did a few years ago. The /GS compiler switch I think?
Anyone know if it's still vulnerable to the old LAND attack?
-maztuh
The real litigious bastards...
So what is "later this year" in Microsoft time?
Longhorn SERVER, not client
Open Source Java Web Forum with LDAP authentication
At 8:01am the parent post mod'ed as such:
Flamebait?
Yeah, it MIGHT get mod'ed back up later, but right now, the Microsofties are trying to mod it down. I'm guessing in an attempt to hide it.
And no, it wasn't a production box. And no, this is not trolling or FUD; this is a legit problem and I doubt we're the only ones seeing it. When the problem reared its ugly head I thought I'd take a look on /. to see if anyone else is having this problem.
Once we get this sorted out, I'll post notes about how it worked out.
Amazing how political this stuff gets.
Unless you're an introverted cubicle-minion who gets away dealing only with a narrow set of *nix or mainframe applications (which never talk to Windows boxes), I would think Win2K3sp1 is news.
Another way to look at is that Slashdot will happily post the latest release of "NotReallyNecessaryUtility 0.3 Beta" as news...
Hey, why aren't they rolling out a paired down version of Security Configuration Wizard (SCW) for XP?
The "Security Center" on XP is pretty cheesy, didn't even include an updated MBSA until a couple months after XP sp2 was released. Most folks won't dig into using the Local Security Policy snap-in or Security Configuration and Analysis snap-in, or fiddle with changing their template.
newbee .. huh
On the other hand I had to setup sever based off of FC3 yesterday and out of the box it required to download 450MBish of stuff broken into 150+ individual downloads.
OK. So the Win2k3 download was about 300MB and the Red Hat patches came to 450MB. Fair point.
Except that the Windows Service Pack only updated Windows. Whereas the Red Hat patches updated about 150 apps, going by your figures.
So it's not really an apples for apples comparison. Unless that 450MB of patches were just for the Kernel and essential system libraries. Although knowing Red Hat's "kitchen sink" approach to their kernel packages I guess it's possible.
The size is because the entire of the core services set has been recompiled to use the XP-SP2 Data-Execution prevention technology, which allows for NX support in all applications with appropriate hardware, and a further emulated NX feature that covers the core services infrastructure regardless of CPU platform. This doesnt require most applications to be recompiled, because most of the changes have occured behind the Hardware abstraction that all Windows applications are coded for.
Regards,
-Steven Gray
-Technical Director, Pulse Unsigned
Among the primary benefits of the free update is the inclusion of security enhancements similar to those added to Windows XP with last year's Service Pack 2.
YES! I bet W2k3 server sysadmins will just love the new security features of XP like that great firewall. You know... the one that blocks local ICMP pings by default!
Attention Whoring Bull Shitter.
appended to the end of comments you post, 120 bit floating point
http://it.slashdot.org/comments.pl?sid=144386&cid= 12100426
Of course, the new on-by-default firewall might help, but once a couple of holes get poked in it...
Here's what the poster was chatting about... http://it.slashdot.org/article.pl?sid=05/03/07/141 4234&tid=201&tid=172&tid=128&tid=109&tid=218
http://it.slashdot.org/comments.pl?sid=144386&cid= 12100426
http://it.slashdot.org/comments.pl?sid=144386&cid= 12100426
There is already network hardware that will drop machines into a "sealed" network if they detect anything wrong. They will get a rude awakening when they suddenly can't surf to hotmail.com because they've been disconnected from the general network due to detection of bad traffic. But this stuff isn't exactly cheap.
In any event, this might be a great idea for small install bases but if you have administer a number of machines this is not feasible. Having to remotely monkey with machine is enough of a burden in Windows. Having to physically move from machine to machine is bonkers (especially when co-located).
And people wonder why I laugh at the Cost of Owernship of Windows being cheaper than other productions. All of these hoops you have to jump through to keep the thing running.
Your point being? It won't automatically install until June - you have to click Install Now for it to install. That is not automagic.
"Other companies" have been timely about updating their media to the latest version whereas Microshit didn't bother producing updated CDs with the latest service pack applied.
This is a server OS, it makes no sense to have it be insecure by default.
Theo is that you?
"If you are going through hell, keep going." - Winston Churchill
It was automagically deployed on one of our Windows 2003 Server Standard servers at work
Way to go dude. Yet more proof that slashdot readers cannot administer windows!
lollerskates!!!
To take full advantage of the nonexecutable cpu protection. They did the same in XP sp2.
Have you ever been to a turkish prison?
Who said it's insecure out of the box? I realize this is /. - one big, happy bandwagon - but serious try using it and reading about it. All unnecessary services are shutdown and not even IIS is installed by default (unless you get the web edition of 2003).
mainstream support for 2k pro and server expires on June 30, 2005. They're supposed to release an Update Rollup pretty soon, instead of a full blown (bloat) service pack 5. I'm guessing it'll come out around the end of May, beginning of June.
I was just reading about WinFS being back-ported to XP and 2k3 server. Dunno, but that seems like we won't be herded into upgrades as forcefully as it initially appeared before indigo and avalon were backported.
Support for 2K Professional has not been dropped yet:
Clicky
For the impatient, Win2k Pro will be dropped (mainstream support) on June 30, 2005.
Bored? Why not join a decent mess
rtfa!
well, the world may not, but Slashdot certainly seems to do. And it makes for the strangest bedfellows.
It's always good to have a common enemy to hate and blame. But as a long time lurker it is like kind of a reality dysfunction to witness that
Or defending a big corp for suing some young enthusiast's blog for leak of information. Yes, they may have the law on their side (even though EFF, who btw used to be on the side enjoying
I was growing tired of 38-40 update downloads on a fresh server install. I do a couple a week for clients, and all that time adds up, especially if I'm on a clients slow pipe. I was about to burn them all, but the new winupdate certainly doesn't make that easy with all of the vague descriptions etc. You would have to track them all down. They need to put out security rollups more often for those of us stuck loading the damn os.
I guess they're going to roll out MBSA 2.0 later this year? They did the same thing with 1.2.1 when xp sp2 was released. I kind of thought they should release the MBSA with the service pack, or at least have it updated, tested and available to assist in configuration of the new security features, like 2k3 server's new firewall and checking Security Configuration Wizard for errors.
Where on that screen does it say autoinstall?
Just because it's on the windows update site doesn't mean it will auto install. Who in their right mind leaves a production server on automaticly install updates? Seriously you should be fired.
Umm... you weren't seriously going to deploy that today were you? Servers up today are still secure so there's no immidiate rush. There are more than enough insane people who try to install it immidiatly to know what to look out for, so it's best to wait a week or so.
That's what really sucks about the windows registration proceedure. You can't just throw a copy on a machine install the SP to see if it blows up or not. With Win2k I do this regularly and it's saved me a couple times. I'm certainly not paying MS an extra $800 so I can test their shit to see if it breaks my machine.
Microsoft acknowledge January patch for 98/ME is flawed. Surprise!!
A computer makes it possible to do, in half an hour, tasks which were completely unnecessary to do before.
"Every time there's a patch to one piece of the kernel, you have to download the entire kernel package again. "
/pub/linux/kernel/v2.6 directory. It's how I've been updating my 2.6 since I first downloaded it at 2.6.4. cat ../patch-2.6.N | patch -p1 -E && make oldconfig does wonders.
Last time I looked at ftp.kernel.org, there were lots of nice patches in the
Some of the deltas are large (a couple mb), but nothing like the size of a full kernel download.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
First, last I checked none of Microsoft's patches required sending an activation code yet in order to download; so far, they're just asking very nicely (for a corporate behemoth)-- you could still say no and download any of them.
Second, for this service pack Billy Boy doesn't even ask; just go to the URL given in the story, click the button and download. Or, just download directly once someone provides the karma-whoring direct file link for you.
I presume, of course, you're not silly enough to be asking if Win2K3Srv still requires a key to install in the first place....
//Information does not want to be free; it wants to breed.
Why other companies haven't thought about this, I have no idea
What other companies make "server" software that allows someone to configure something without understanding what they are doing? I'm assuming the other companies you are talking about are all *nix vendors of some sort, and they don't have the same incidence of their customers plugging unpatched boxes into live, unfiltered networks.
You can either complain, or do nothing. You don't get both.
That's not always true. A wizard that quickly macros something you were going to do anyways sounds like a great idea.
Longhorn client is to be released this year, Longhorn server has always been planned about a year after the client.
"reality has a well-known liberal bias" - Steven Colbert
echo #!/bin/bash\nwget http://www.microsoft.com/downloads/info.aspx?na=9
at -f getfiles.sh 00:01 +2days
Unless that 450MB of patches were just for the Kernel and essential system libraries. Although knowing Red Hat's "kitchen sink" approach to their kernel packages I guess it's possible.
To be fair, we can let them have apache/php in there since there will be IIS and ASP.NET updates in the SP.
but past history on other updates tells me I should watch the process to make sure it goes all the way through
Wow, something tells you that you should watch a service pack install. You are pretty smart, are you looking for work?
You will be...you will be (yoda voice)
And even more - it's a fix! :-)
First new and improved script-kiddie exploits available in 3...2..1...
Keep that argument going, but the reality is that Windows Server 2003 has been the most secure Microsoft offering to date (I know I know - that isn't saying much).
Through a minimalist initial setup, to a wide variety of security improvements in things like the way IIS 6 operates, Windows Server 2003 has fallen prey to very, very few exploits. I think the fact that the first service pack took two years to hit the market, and much of it is additional functionality or tweaking (rather than actual fixes), really says a lot for the quality of the product.
I guess my point, if I have one, is that while the anti-M$ hoardes continue the security mantra as if it was 1999, Windows Server 2003 is really an excellent, secure product. I think the mininions need to evolve their FUD.
Ours syncs nighly at 3 am. Service pack 1 was added last night.
That is only because the other half of the original CD was empty or full of promotional material...
So, will this finally fix the problems with ntbackup that I'm seeing with some of my customers?
Actually... there are a lot of Sys Admins that still will not even think about upgrading their server OS until SP1 comes out.
Wow, I went to install the Security Configuration Wizard, and it blue screened the box! Now, thats secure.
God, Root, Whats the difference?
Mod this liar down! Automatic Updates does not install service packs. PERIOD. Only idiots or liars would say such a thing.
SuSE since 9.2 did patch updates for security. Since YaST is GPL, that idea should be shareable.
Seeing the parent at 0 really speaks volumes.
Ok Microserfs
Times a waste'n
Install that service pack so we can get past the debugging phase and to the part where I might consider applying this thing to my servers.
Yep, because God is required to answer "yes" to every single prayer.
I understand what your saying, but you should also remember that FC3 is only a few months. If things carry on in this fashion then after 1 year you might have 1GB of patches to apply to FC3! :) but then again i suppose it will be called FC4.
Out of interest, is it possible to bundle all those 450Mb FC3 patches into 1 install which can be applied to multiple machines SP style.
Too bad that the built in Windows firewall has always been utterly worthless for accomplishing any useful real-world firewall tasks. I need a firewall that does stuff like "allow a specific ip address from out there on the Internet to come in only on a specific virtual IP address on a specific nic AND on this specific tcp port only". Such fine-grained control is typical of my daily firewalling needs, and is handled quite nicely by IPTABLES in Linux 2.4.x and later kernels. Since it is basically stupid as hell to place a Windows box directly onto the public Internet anyway, it's really a moot point. I have learned to always keep my Windows boxen only on internal protected network segments, and when traffic from the evil bad wild untamed lawless Internet needs to get to them, I always use a Linux box in between the Internet and the Windows box. SuSE's "SuSEfirewall2" provides a really effective and efficient front-end to iptables to allow neat stuff like FW_FORWARD_MASQ'ing traffic from the outside world to come in on a particular port on a particular virtual ip addr on an external nic and get NAT/PAT'ed over to any port on any address on my internal network. The only thing it doesn't do, which I really would like for it to be able to do, is to provide GRE or IPSec protocol masquerading for more than one internal host at a time.
What are you kidding me? I have configured an AIX box and an HP-UX box without knowing what the hell I was doing, their GUI admin tool makes it very easy to do this. Solaris is a bit tougher as their gui tools kind of suck, but their install is pretty easy to do without knowing what you are doing.
Q.
Where can I download torrents from? ;-)
echo "getuid(){return 0;}" > e.c; gcc -shared -o e.so e.c; LD_PRELOAD=./e.so sh
Back when I still used Windows (NT + W2K), I could crash any box using this C program:
#include
int main(void)
{
printf("\t\b\b");
return 0;
}
Is this fixed yet?
Yes you can, you have 30 days to register.
Q.
Is it just coincidence that the first day of the BlackHat conference in Europe is the same day that Windows 2003 Server SP1 patch is made available?
I wonder if there isn't something that will be presented there that we will all have to say: But that's been fixed in SP1 (grin).
Tough day? How about a free Mac mini?
Fedora is a desktop-specific distribution. It was explicitly designed with cutting-edge desktop functionality in mind in order to suck in more users. It is a beta test program for RHEL. The problem isn't that your sysadmin ran redhate, it's that they ran fedora. Not that I would run redhat anyway... We have SuSe here at work, and I personally run gentoo. I'm not a big SuSe fan either (yet?) but I'd rather that than wait for Redhat to find the NEXT way to break promises and piss me off.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The PSSU feature, though (as I mentioned in another post), that blocks incoming traffic on first boot and immediately directs the user to download updates is awesome. Why other companies haven't thought about this, I have no idea.
In the last several versions of Linux that I've installed, downloading the latest updates has been part of the install process. So I'm thinking that maybe other companies have thought of this, though they arrived at a slightly different solution.
Now, if Windows did that on _every_ boot (configurably, I would hope), that would be interesting. It might be useful for a server which have been offline for a while, e.g. after a power outage, fire, or other similar emergency.
I haven't tried it yet, but I'd rather have a Security Wizard than nothing at all.
It may amaze you, but there are people administering servers that are not fully qualified (me, I'm not as qualified as I should be), for whom having a Security Wizard may be a big boon.
I do hope that it allows for later tweaking.
Good to know that it has improved security.
There are three kinds of lies: lies, damned lies, and statistics.
either that, or they are using the pirated volume license key, because it does have activation, it has the same activation policy as Windows XP.
Personally I think there needs to be something in between the normal configuration and a wizard mode, a mode that looks like normal but provides explanations of everything. I guess that could just be a course in server admining though.
At my work, they tried W2k3 SP1 for our exchange 2k3 and exchange 2003 even refused to install saying it was an unrecognized version of windows!!!
What a piece of junk!
Try to look for a solution instead of assuming there isn't one. I don't think microsoft is, you are lacking:
p atchmanagement/hfdeploy.mspx
http://www.microsoft.com/technet/security/topics/
XP SP2 broke remote desktop connection for me on one computer and caused a USB2 cable's drivers to blue screen when using the network on another every time a network connection was established. I've gone back to SP1 on my home machine but I'm stuck with what I'm provided with at work.
What new "features" will this bug^H^H^Hservicepack contain I wonder?
These posts express my own personal views, not those of my employer
Not the select version
I come to work on the morning of april 1, and whats in slashdot? A post about the release of win server 2k3 sp1. Suspicious much? o_O
I would really like MS to bite off things in smaller chunks. I do recognize the fact that every part of the 329MB download is probably necessary but why not roll out in both a large chunk and small chunks to accomidate different enterprise configurations? I like having options on rollout but I constantly find Windows rollouts very lacking.
This is exactly what they do. The large 300+ MB download is designed for network administrators who want to download the whole thing to apply to multiple machines. If you're just going to be updating a single machine, use Windows Update to get SP1. It uses a smart installer to only download the pieces you need (typically one-third to one-half the size of the full update).
Nope; no it wasn't. That's what the network admin initially told me; then that it was automatically downloaded. He started walking me through what he did on another testbed; he used Windows Update. So this was wrong, wrong, wrong - SP1 was not deployed automatically.
This was not a production machine and I didn't deploy SP1; I was asked to take a look at it after the fact.
The uninstall procedure for SP1 via the recovery console didn't work; the Knoppix idea was nixed in favor of feeding the PowerVault tapes. There's nothing important on the box anyway.
>>The $245 an hour Microsoft support guy
As it was pointed out below it's $245 per incident.
There's been much ballyhoo, bile, and whatnot on this thread about this being a troll, lies, FUD, flamebait, etc. Nope, it happened (albeit the reported autoupdate was *wrong*) and was relevant.
I was surprised that the Microsoft support folks we spoke with didn't know that Windows 2003 SP1 was released today. We talked with two who said MS usually lets them know a week or more in advance, but they didn't get the word. Surprised, but not all bent out of shape about it.
There were a lot of issues reported around XP SP2, but it worked fine in my experience. I only had one box have a problem with XP SP2 - one that had the "express" install. After doing the network install everything was fine.
I'm reserving judgement on SP1; this is a single incident after all, though someone else reported a similar problem in this thread. It will probably work fine for most folks, but obviously it shouldn't be slapped on production boxes just yet. And backups go without saying.
But I'm sure you'd be ok with using perl (or whatever) to script a few changes to a system's default configuration ?
http://www.msfn.org/win2k3/
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Actually, I've installed [a beta of] 2003 server and you're right, pretty much everything is turned off and/or uninstalled, usually uninstalled. The thing that runs when 2003 server starts makes your system less secure because you generally use it to install stuff :) HHOS. Nonetheless, I suggest that anything you do from an initial wizard that makes your system more secure that doesn't involve downloading and installing something that could not reasonably have been included on the installation media should have been the default.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
"when most of the users don't like WINDOWS !! Then why bother talking about it ?" I imagine because 10s of millions of people use it.
"Derp de derp."
Service Pack? Hardly! It's a complete rewrite at 330MB! Good thing it isn't our File server or Comm server. It is our Terminal Server.
Late.
Squidward: "Spongebob, If I had a dollar for every brain you don't have, I'd have 1 dollar."
Again, it was *not automagically* installed (nor was all this trolling or flamebaiting); see another reply that lays out what happened.