what did you learn today? (part 2)

Dzov

Ars Legatus Legionis
13,171
Subscriptor++
Until late last year, our HQ’s voicemail for a 200k annual student community college district, was an old Packard Bell or maybe Compaq pentium PC.

NEC IP PBX.

We only got rid of our last ancient ASA 4 years ago.

By the time everyone is finished dumpling the latest hotness, we’re just getting roped in.

In 2010:

HP: hey, would you like to get a great deal on BladePC?

2023: finally finished unracking the last few chassis
Heh, our old voicemail server (merlin legend, I think?) was a 386 and I believe a 40 MB HD. This was for maybe 50 to 100 users.
 

SandyTech

Ars Legatus Legionis
13,428
Subscriptor++
We use papercut on all of our Ricoh devices, most people use PC integrated scanning but we have a few power groups that know how to drop down into the Ricoh native app. I don't think we've done SMB scanning in forever though, it's always been email delivery. (Papercut can drop stuff into some shared folders)
Not sure if I can sell the firm on it, but I'll give it a shot for sure. The most annoying part is that these are mostly documents they could easily download from the state's e-filing portal or CM/ECF or PACER.
 

oikjn

Ars Scholae Palatinae
971
Subscriptor++
Is it possible to pull the zone file of a domain publicly?

Found a domain whose DNS is set up on an account that is long forgotten. 🙄 I want to move it into are usual DNS with the other domains, but it seems like typical DNS import features can only look up commonly used CNAME names. There are likely other CNAME records that need to be pulled before I can switch the nameservers.
I've used DNS Checker in the past when we found a phishing attempt was made on our domain using a similar one. I use that to check every once and a while to make sure that domain is still totally offline.
 
  • Like
Reactions: ColinABQ

Xelas

Ars Praefectus
5,503
Subscriptor++
We use papercut on all of our Ricoh devices, most people use PC integrated scanning but we have a few power groups that know how to drop down into the Ricoh native app. I don't think we've done SMB scanning in forever though, it's always been email delivery. (Papercut can drop stuff into some shared folders)
<shudder> The most obtuse, irritating, and dysfunctional "control panels" I deal with occasionally are those on our Ricoh printers. Unfortunately, our megacorp is all-in 100% with HP and Ricoh, inflicting misery and pain to tens of thousands of employees daily.
The HP drivers need to be blown away and reinstalled if a printer is set with a static IP because trying to change the printer port post-install never seems to work right. And the less is said about "HP Smart" print drivers, the better.
 

Dzov

Ars Legatus Legionis
13,171
Subscriptor++
The HP drivers need to be blown away and reinstalled if a printer is set with a static IP because trying to change the printer port post-install never seems to work right. And the less is said about "HP Smart" print drivers, the better.
There have been several times where I've set an IPv4 address in the driver and Windows or whatever replaces that perfectly fine IP address with some WSD Port nonsense. Drives me up a wall.
 
  • Like
Reactions: Xelas

sryan2k1

Ars Legatus Legionis
44,576
Subscriptor++
We're 100% Ricoh and HP. We use the Ricoh universal and the HP universal driver, and only have like 2.5 models - MP(C)6503's and LaserJet Flow MFP E52645.

Neither have driver issues and pretty much just work. The Ricoh's are all new enough to have SOP (Android) and honestly are the least bad of any MFD we've used over the years.



But hey, what do I know about printing

1720466170113.png
 

MilleniX

Ars Tribunus Angusticlavius
6,828
Subscriptor++
Is it possible to pull the zone file of a domain publicly?

Found a domain whose DNS is set up on an account that is long forgotten. 🙄 I want to move it into are usual DNS with the other domains, but it seems like typical DNS import features can only look up commonly used CNAME names. There are likely other CNAME records that need to be pulled before I can switch the nameservers.
This is kinda a lateral approach, but you're running the services that domain points to, right? Given that, you should be able to get most of the important names in the zone from service logs on the back-end. Besides web request URLs, there's also SNI in TLS initiation, HTTP referrer, names appearing in forwarded email headers, and so forth. If any of those is a CNAME, you can then look it up to see what it's configured to alias.

The unfortunate case would be if there are aliases of subsidiary names in that domain to external providers. For that sort of thing, you'd probably have to go trawling through links in the sites for anything that has non-relative URLs, with varying degrees of effort involved.
 
  • Like
Reactions: wobblytickle
Is it possible to pull the zone file of a domain publicly?

Found a domain whose DNS is set up on an account that is long forgotten. 🙄 I want to move it into are usual DNS with the other domains, but it seems like typical DNS import features can only look up commonly used CNAME names. There are likely other CNAME records that need to be pulled before I can switch the nameservers.
it is not. Unless you try a zone transfer and it works, or you're actually an admin of the DNS zone (or a server it lives on).
 
  • Like
Reactions: Vince-RA

Dzov

Ars Legatus Legionis
13,171
Subscriptor++
Is it possible to pull the zone file of a domain publicly?

Found a domain whose DNS is set up on an account that is long forgotten. 🙄 I want to move it into are usual DNS with the other domains, but it seems like typical DNS import features can only look up commonly used CNAME names. There are likely other CNAME records that need to be pulled before I can switch the nameservers.
You can try playing around with dig in linux, but I don't think you can find cnames that way. Your best bet is to contact the host and convince them to share the info, or figure out what email address it was registered to and take that over.
 
I did the thing! And the thing went!

I have a parts-built server running an SIEM, and the RAID5 is down a disk; since it's running Centos7, I figured I would start proving out a complete pave-over rebuild on Ubuntu. I had been running a backup script pulled from various posts on their support forum, but actually going through the complete restoration procedure showed it was either 1: not getting all the files or 2: storing them in a manner that made retrieving them tedious and error-prone. So I reworked the script, fired up a VM, installed the platform, ran the restoration script against my backup, and all my agents came up in the dashboard. So nice knowing I can actually schedule a fix instead of reacting to something not working, for a change.
 

sofiamurphy

Smack-Fu Master, in training
1
Today, I learned about the significant benefits of EHR software system in modern healthcare. These systems streamline patient data management, enhance clinical decision-making, and improve overall operational efficiency in healthcare settings. By integrating EHR systems, healthcare providers can reduce errors, enhance patient safety, and achieve better coordination of care among multidisciplinary teams. This technological advancement ultimately leads to improved healthcare outcomes and patient satisfaction, marking a pivotal shift towards more effective and patient-centric healthcare delivery.
 

SandyTech

Ars Legatus Legionis
13,428
Subscriptor++
I never move us to a new version of vSphere until u3 is released. I don't think I'd want to keep running 6.7 these days, but I can understand the sentiment as to why someone would.
With some of the pricing coming out of those clowns, I've got customers that can't afford to go any higher than they are now.
 

Marlor_AU

Ars Tribunus Angusticlavius
6,975
Looks like it's not going to be a good day for anyone using CrowdStrike. Seems like anything with it installed is stuck in a BSOD boot loop. This should be fun...
I've heard horror stories here in AU from companies running CrowdStrike. It's all down. Every server. Every end-user PC. One company I deal with has thousands of endpoints, and most of the IT staff work from home on Fridays. They can't even access their machines to coordinate a response.

It's BSOD boot loops all round.

It looks like the workaround is going to involve booting into safe mode and manually removing the CrowdStrike files. On every machine. This will particularly be "fun" when the company has a remotely-distributed workforce, and where all machines are running BitLocker.

EDIT. It's huge:
 
Last edited:
  • Like
Reactions: CPX

Marlor_AU

Ars Tribunus Angusticlavius
6,975
Yep, my employer here in Sweden is affected as well. I can't use the VPN-service to work from home. This will be a clusterfuck.
Where the machines are BitLocker protected, it's probably going to require hands-on time with every single machine. Some companies will need to deal with tens of thousands of geographically-distributed users.

But the immediate challenge for many companies is getting back in to the system to access the BitLocker keys to begin with.
 

denemo

Ars Scholae Palatinae
949
Subscriptor++
Where the machines are BitLocker protected, it's probably going to require hands-on time with every single machine. Some companies will need to deal with tens of thousands of geographically-distributed users.

But the immediate challenge for many companies is getting back in to the system to access the BitLocker keys to begin with.
Well in our case it only affects (as far as I know) some of our servers that are managed by another company. That company apparently had clowdstrike installed on those servers. So from business-perspective we seem to do fine at the moment.

It's just that we the workers can't inspect the system from a distance at the moment.