Automatic Windows Logon on Domain Member Machins

On a Windows machine, you can normally use Start => Run => control userpasswords2 to enable automatic login for a given user when the system boots. On computers that are part of a domain, this is not the case. However, while the functionality is removed from the user interface when you join a domain, it is still available if you’re comfortable mucking about with the registry.

Using Regedit, go to “Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon“.

There are 4 keys you need to set to allow automatic logon:

  • AutoAdminLogon, REG_SZ => 1
  • DefaultDomainName, REG_SZ => YourDomainNameHere
  • DefaultPassword, REG_SZ => YourSecretPasswordInClearText
  • DefaultUserName, REG_SZ => YourUserName

Add or edit the keys to match your domain setup and reboot. Autologin should function as intended after this.

AutoLoginWindowsDomain

Fixing empty search results in the Windows 10 Settings (the shiny new Control Panel)

This happened on a few machines I am responsible for, after the upgrade to Windows 10.
You click “Start”, type “updates”, it suggests “Check for Updates” in the “Settings” app, you click <enter> and it opens an empty settings window with no search results. Great.

After looking around for a while, I stumbled over the fix, detailed by winaero.com and rchived here.

In short:

  1. Win+R
  2. %LocalAppData%\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalStatez
  3. Right click the directory called “Indexed”, go to Properties => Advanced
  4. Click “Allow files in this folder to have contents indexed in addition to file properties”
    If this option is already selected, de-select it, finish point 5, then go back through this list again to re-select it
  5. Click OK a few times, and agree to propagate the settings to subfolders and files

Hooray! Search works.

Working Search

W: [pulseaudio] authkey.c: Failed to open cookie file ‘/home/user/.config/pulse/cookie’: No such file or directory

W: [pulseaudio] authkey.c: Failed to open cookie file '/home/user/.config/pulse/cookie': No such file or directory
W: [pulseaudio] authkey.c: Failed to load authorization key '/home/user/.config/pulse/cookie': No such file or directory

I had this problem on an embedded box, with no X11, or even a screen. Turns out that at least some versions of Debian have an issue where not all programs agree on where the cookie file should be stored. Doing ls -la in my home directory revealed I had a ~/.pulse-cookie file, but I didn’t, as the warning message stated, have a ~/.config/pulse/cookie file.

I made this warning go away by symlinking where one program was looking for the cookie to where the cookie actually was.

mkdir -p ~/.config/pulse
cd ~/.config/pulse
ln -s ../../.pulse-cookie cookie

..and Bob’s your uncle. No more warnings.

Export certificates marked as not exportable in the Windows certificate manager

So, you need the private key for a certificate on Windows, for some innocent snooping around with Wireshark, but someone marked it as not exportable. Now what?

Cue Gentil Kiwi and his tool Mimikatz.

For future reference for myself, I’ve archived a copy of the source here, and the binaries here.

The following commands will extract the certificates from the local store:

crypto::capi
crypto::certificates /systemstore=CERT_SYSTEM_STORE_LOCAL_MACHINE /export

The password for the pfx files is “mimikatz” (no quotes).

To convert a pfx to a pem file, you can do something like this:

openssl pkcs12 -in CERT_SYSTEM_STORE_LOCAL_MACHINE_nicecert.pfx -out cert.pem -nodes

If it’s for use in Wireshark, you also need to add -nocerts:

openssl pkcs12 -in CERT_SYSTEM_STORE_LOCAL_MACHINE_nicecert.pfx -out cert.pem -nodes -nocerts

My tweaks to Kali Linux (note to self)

Here are some of the things I did to make Kali Linux 2016.1 suit my taste, mostly intended as a note to myself, but posted here in case it helps anyone else.

General checklist

  • Install aptitude and update everything
  • Add settings icon to left panel
  • Enable mouse tap to click in “Settings => Mouse & Touchpad”
  • Tweaks => Power => Don’t suspend on lid close
  • Enable sound, but disable alert sound (sonar)
  • Disable all power saving (“Power”)
  • Enable privacy settings, purge stuff after 7 days (“Privacy)
  • Tweaks => Extensions => Disable Easyscreencast
  • Settings => Keyboard => Input Sources => Remove superfluous keyboard layouts

Install fun stuff

apt-get -y install \
dconf-editor \
gnome-power-manager \
autossh \
vim \
screen \
iotop \
iftop \
virtualbox \
torbrowser-launcher \
aptitude

Automatically log in as root

Edit /etc/gdm3/daemon.conf

AutomaticLoginEnable = true
AutomaticLogin = root

Enable smartmontools

Edit /etc/default/smartmontools

start_smartd=yes

Shut down with power button

Note: shutdown option missing as of 2016-05-16

gsettings range org.gnome.settings-daemon.plugins.power power-button-action
gsettings set org.gnome.settings-daemon.plugins.power power-button-action 'shutdown'

Encrypted swap

For separate partitions, use the existing guide for Debian.
For swap files in encrypted filesystems, do this:

dd if=/dev/zero of=/.swap bs=1G count=16
chmod 600 /.swap
mkswap /.swap
swapon /.swap
echo "/.swap none swap sw 0 0" >>/etc/fstab

Disable auto-locking and that stupid slide screen

gsettings set org.gnome.desktop.session idle-delay

Install qemu and virt-manager

apt-get -y install qemu-kvm virt-manager
systemctl enable libvirtd.service

Set a custom default window manager (like xfce)

I now use the default environment, but it’s here in case anyone finds it interesting anyway

apt-cache search kali-desktop
apt-get -y install kali-desktop-xfce
update-alternatives --config x-window-manager
update-alternatives --config x-session-manager

Enabling Quick Launch in Windows 10

I have my taskbar set to “Use small taskbar buttons” and “Never combine”, probably as much out of habit as anything else. This means that when I pin programs to the taskbar, opening one of them, suddenly making it display a title for one or more windows, will push any pinned programs to its right further towards the right edge of the screen. In turn, this means that my pinned programs are almost never where I expect to find them, and I have to look around. Annoying.

The classic “Quick Launch” solved this by only displaying a launch shortcut, and never turning into the actual taskbar entry for the program it launched. Thus they all stay neatly in place next to the start button.

Like this:

quick_launch_win10

Not like this:

bad_pinning_win10

Well, Windows 10 can do this too, though it is slightly harder to enable than on previous editions of the operating system.

In short:

  1. Right click the taskbar
  2. Select “Toolbars => New Toolbar…”
  3. Enter “shell:Quick Lauch” into the “Folder” field and press enter (note the lack of a space between : and Q)
  4. Press “Select folder”
  5. Notice the “Quick Launch” appearing next to the systray.
  6. Right click the taskbar again and unlock it (click “Lock the taskbar”)
  7. Right click the toolbar header at the left side of the quick launch
  8. Deselect “Show Text” and “Show title”
  9. Drag the quick launch to where you want it
  10. Lock the taskbar again

A more detailed description can be found here. I archived a copy here.

Find and kill long running MS SQL Server queries

I have to admin this is cargo cult SQL to me, but here’s how to find running queries, sorted by their total elapsed time:

SELECT [sqltext].[TEXT],
[req].[session_id],
[req].[status],
[req].[command],
[req].[cpu_time],
[req].[total_elapsed_time]
FROM [sys].[dm_exec_requests] [req]
CROSS APPLY [sys].[dm_exec_sql_text](sql_handle) AS sqltext
ORDER BY [req].[total_elapsed_time] DESC

To kill a given query, use:

kill <session_id>

..without the brackets <>, where session_id is the corresponding column output from the query above

If you want to kill all long running queries in a single go, try something like this:

DECLARE @cmd varchar(8000) = '';
SELECT @cmd = @cmd + 'kill ' + CONVERT(varchar(5), req.session_id) + ';'
FROM sys.dm_exec_requests req
CROSS APPLY sys.dm_exec_sql_text(sql_handle) AS sqltext where req.total_elapsed_time > 15000

SELECT @cmd;

EXEC(@cmd);

Adjust the ‘15000’ (milliseconds) timeout to a reasonable time for your application.

You’re welcome.

SPF exists for a reason, and postfix makes it ridiculously easy

In the bronze age, messages came in, signed bob@lamuella.com, and you’d simply have to assume they were from the Almighty Bob. Today, email is still technically in the iron age, but at least we have SPF.

In a nutshell, when lamuella.com enables SPF for their domain, they can be sure that other people, which mail servers check those records, will not receive spam mail with forged senders @lamuella.com. This also means email that passes this sort of check can be rated as slightly less spammy in automated spam filters.

To further elaborate on that, here’s what SPF is, does, it not and does not:

SPF IS/DOES

  • Allow a host to verify that an email from an SPF-enabled domain was sent from a mail server that legitimately serves that domain.
  • Prevent spammers from sending email from your SPF-enabled domain.
  • Force your users to send their email through your (hopefully extra extra safe) server, thus forcing them to comply with your encryption routines and filters.
  • Allow you to easily discard lots of spam mail, as such junk is often sent from forged domain names that happen to exist and have valid SPF records.

SPF IS/DOES NOT

  • Allow your server to verify the sender address from non-SPF domains.
  • Prevent spammens from sending email from your SPF-enabled domain to a recipient server that doesn’t inspect SPF records.

That said, SPF is easy to enable on Postfix, and I strongly urge you to do so if you haven’t already.
I found this handy guide, for Ubuntu, but it works just as well on Debian, and I archived it here in case the link is dead at the time you read this.