Session (ID X) remote control failed

Posted on December 2, 2013.

You may find it impossible to remote control a user from Task Manager on Windows Server and get the above error.

If it only works when using the built-in administrator account, then this may be because UAC is enabled. Task Manager needs to be UAC-elevated in order to perform the remote control task.

The long-term fix is to disable UAC like discussed in this Technet forum post.

A quicker method, and if you want to keep UAC enabled, is to elevate Task Manager by going to the “Processes” tab and clicking “Show processes from all users” button. This elevates Task Manager to show all processes and then allows you to remote control.

Compile Owncloud libocsync0 for Debian Wheezy from source

Posted on November 9, 2013.

I was trying to get the Python Owncloud CLI package to work on Wheezy. It requires libocsync0 which is available in unstable but it has many depends that would push the box further into unstable than I would of liked (samba and sftp plugins require unstable versions of samba, ssh, libc6, etc.).

To get libocsync working on wheezy, I did the following:

# Add unstable repository to APT
cat << EOF > /etc/apt/sources.list.d/unstable.list
deb     http://ftp.uk.debian.org/debian/     unstable main contrib non-free
deb-src http://ftp.uk.debian.org/debian/     unstable main contrib non-free
EOF

# Pin unstable low so it isn't default
cat << EOF > /etc/apt/preferences.d/unstable.pref
Package: *
Pin: release a=unstable
Pin-Priority: 400
EOF

# Download source files to /usr/src
cd /usr/src && apt-get update && apt-get source ocsync

# Get build depends 
# (If you note down what packages are installed NEW here, you can manually remove them afterwards)
apt-get build-dep ocsync

# Remove unstable repository
rm -f /etc/apt/sources.list.d/unstable.list /etc/apt/preferences.d/unstable.pref && apt-get update

# Change to the new ocsync source directory, in my case it was
cd /usr/src/ocsync-0.90.4

# run through compile (instructions at http://www.debian.org/doc/manuals/maint-guide/build.en.html )
debian/rules clean
dpkg-source -b ./
debian/rules build
fakeroot debian/rules binary

# .deb files are now in /usr/src
ls -la /usr/src

# install required package
dpkg -i libocsync0_0.90.4-1_amd64.deb

# Add unstable repository to APT

cat << EOF > /etc/apt/sources.list.d/unstable.list

deb http://ftp.uk.debian.org/debian/ unstable main contrib non-free

deb-src http://ftp.uk.debian.org/debian/ unstable main contrib non-free

EOF

# Pin unstable low so it isn't default

cat << EOF > /etc/apt/preferences.d/unstable.pref

Package: *

Pin: release a=unstable

Pin-Priority: 400

EOF

# Download source files to /usr/src

cd /usr/src && apt-get update && apt-get source ocsync

# Get build depends

# (If you note down what packages are installed NEW here, you can manually remove them afterwards)

apt-get build-dep ocsync

# Remove unstable repository

rm -f /etc/apt/sources.list.d/unstable.list /etc/apt/preferences.d/unstable.pref && apt-get update

# Change to the new ocsync source directory, in my case it was

cd /usr/src/ocsync-0.90.4

# run through compile (instructions at http://www.debian.org/doc/manuals/maint-guide/build.en.html )

debian/rules clean

dpkg-source -b ./

debian/rules build

fakeroot debian/rules binary

# .deb files are now in /usr/src

ls -la /usr/src

# install required package

dpkg -i libocsync0_0.90.4-1_amd64.deb

1 Comment

Windows 7 on XEN HVM — Slow Remote Desktop

Posted on October 20, 2013.

Update: The same issue and fix are relevant for Windows Server 2008 R2, Server 2012 and Windows 8. Maybe all versions of Windows using the GPL PV drivers.

I just installed a Windows 7 guest onto a Debian Wheezy Xen dom0. I installed these GPLPV drivers v11.0.372. Using RealVNC to setup the machine was fast and responsive, however once I switched over to RDP the machine was acting like a mule. The RDP session was slowly redrawing the screen as each new application loaded. Internet Explorer’s default MSN page with its ever changing news feed image was causing the session to almost lock up.

The fix is to disable Large Send Offload on the Xen network adapter.

Simple instructions:

Press the Start Orb
Type: “devmgmt.msc” and press enter
In device manager, find Network Adapters
Right click, “Xen Net Device Driver” and choose Properties
Under the advanced tab, click “Large Send Offload” and adjust the Value to “Disabled”
Click Okay (if you did this via RDP, you will lose the connection as the network is reset, just reconnect)

5 Comments

logcheck — various filters

Posted on September 6, 2013.

As mentioned earlier, I have a few of these logcheck filters I have created over the past few years. I use Debian and CentOS so other distros may not perfectly match.

These work in conjunction with the default filters, hence their naming scheme of local_<service>.

Dovecot
login, logout, mysql connections, lda delivery, ssl regen

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)-login: Login: user=<[-_.@[:alnum:]]+>, method=[[:alnum:]-]+, rip=[.:[:alnum:]\s]+, lip=[.:[:alnum:]\s]+(, mpid=[[:digit:]]+)?(, (TLS( handshake)?|secured))?$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)(-login)?(\([-_.@[:alnum:]]+\))?: (Connection closed|Disconnected( for inactivity|: (Logged out|Disconnected in IDLE))) bytes=[[:digit:]]+\/[[:digit:]]+$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (dovecot: )?((deliver|lda)\([-_.@[:alnum:]]+\)|lda\([-_.@\w]+\)): sieve: msgid=<?[^\(]*>?( \(((added by )?[^[:space:]]+|sfid-[_[:xdigit:]]+)\)?)?[[:space:]]*: (stored mail into mailbox '.*'|marked message to be discarded if not explicitly delivered \(discard action\)|(forwarded to|sent vacation response to|discarding vacation response for message implicitly delivered to|not sending vacation response to system address|discarding vacation response to mailinglist recipient|discarded vacation reply to|discarding vacation response to (auto-submitted|precedence=bulk) message from|discarded duplicate (vacation response|forward) to) <[^[:space:]]*>)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)-login: Disconnected \(no auth attempts\): rip=[.[:digit:]]+, lip=[.[:digit:]]+(, (TLS|SSL|secured))?.*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: auth: mysql: Connected to [._[:alnum:]-]+ \(postfix\)$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: ssl-params: (Generating )?SSL parameters( regeneration completed)?$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)-login: Login: user=<[-_.@[:alnum:]]+>, method=[[:alnum:]-]+, rip=[.:[:alnum:]\s]+, lip=[.:[:alnum:]\s]+(, mpid=[[:digit:]]+)?(, (TLS( handshake)?|secured))?$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)(-login)?($[-_.@[:alnum:]]+$)?: (Connection closed|Disconnected( for inactivity|: (Logged out|Disconnected in IDLE))) bytes=[[:digit:]]+\/[[:digit:]]+$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (dovecot: )?((deliver|lda)$[-_.@[:alnum:]]+$|lda$[-_.@\w]+$): sieve: msgid=<?[^$]*>?( \(((added by )?[^[:space:]]+|sfid-[_[:xdigit:]]+)$?)?[[:space:]]*: (stored mail into mailbox '.*'|marked message to be discarded if not explicitly delivered $discard action$|(forwarded to|sent vacation response to|discarding vacation response for message implicitly delivered to|not sending vacation response to system address|discarding vacation response to mailinglist recipient|discarded vacation reply to|discarding vacation response to (auto-submitted|precedence=bulk) message from|discarded duplicate (vacation response|forward) to) <[^[:space:]]*>)$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)-login: Disconnected $no auth attempts$: rip=[.[:digit:]]+, lip=[.[:digit:]]+(, (TLS|SSL|secured))?.*$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: auth: mysql: Connected to [._[:alnum:]-]+ $postfix$$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: ssl-params: (Generating )?SSL parameters( regeneration completed)?$

local_dovecot (1.5 KiB, 2,029 hits)

Managesieve (part of Dovecot)
login, logout

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ managesieve-login: Login: user=<[_@\.[:alnum:]-]+>, method=[[:alnum:]]+, rip=[[:digit:]\.]+, lip=[[:digit:]\.]+(, mpid=[[:digit:]\.]+)?(, TLS)?$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ managesieve\([_@\.[:alnum:]-]+\): Disconnected: Logged out bytes=[[:digit:]]+\/[[:digit:]]+$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ managesieve-login: Login: user=<[_@\.[:alnum:]-]+>, method=[[:alnum:]]+, rip=[[:digit:]\.]+, lip=[[:digit:]\.]+(, mpid=[[:digit:]\.]+)?(, TLS)?$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ managesieve$[_@\.[:alnum:]-]+$: Disconnected: Logged out bytes=[[:digit:]]+\/[[:digit:]]+$

local_managesieve (320 bytes, 1,989 hits)

OpenVPN
login related

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: TCP connection established with (\[AF_INET\])?[.[:digit:]]{7,15}:[[:digit:]]{2,5}$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: (Local|Expected Remote) Options String: '[., _[:alnum:]-]+'$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: TCPv4_SERVER link (local \(bound\)|remote): (\[AF_INET\])?[.[:digit:]]{7,15}:[[:digit:]]{2,5}$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: TCP connection established with (\[AF_INET\])?[.[:digit:]]{7,15}:[[:digit:]]{2,5}$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: (Local|Expected Remote) Options String: '[., _[:alnum:]-]+'$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: TCPv4_SERVER link (local $bound$|remote): (\[AF_INET\])?[.[:digit:]]{7,15}:[[:digit:]]{2,5}$

local_openvpn (506 bytes, 1,982 hits)

PostFWD
statistic log lines: dnsbl, rules, stats, cache, rate

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfwd\[[[:digit:]]+\]: \[(DNSBL|RULES|STATS|CACHE|RATE)\].*$

1	^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfwd\[[[:digit:]]+\]: \[(DNSBL\|RULES\|STATS\|CACHE\|RATE)\].*$

local_postfwd (104 bytes, 1,964 hits)

ProFTPd mod_ban (optional module)
obtained, detached, removed, showing ban list

^\w{3} [ :[:digit:]]{11} mod_ban\/[[:digit:]\.]+\[[[:digit:]]+\]: (obtained|detached|removed) shmid [[:digit:]]+ for BanTable '[/[:alpha:]\.]+'$
^\w{3} [ :[:digit:]]{11} mod_ban\/[[:digit:]\.]+\[[[:digit:]]+\]: showing ban lists$

1 2	^\w{3} [ :[:digit:]]{11} mod_ban\/[[:digit:]\.]+\[[[:digit:]]+\]: (obtained\|detached\|removed) shmid [[:digit:]]+ for BanTable '[/[:alpha:]\.]+'$ ^\w{3} [ :[:digit:]]{11} mod_ban\/[[:digit:]\.]+\[[[:digit:]]+\]: showing ban lists$

local_proftpd-banlog (230 bytes, 1,796 hits)

rSYSlog
start, exit, reload/hup, mark

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: imklog [0-9.]+, log source = /proc/kmsg started.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Kernel logging \(proc\) stopped.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: -- MARK --$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cronmark: -- MARK --$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] start$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] exiting on signal [0-9]+.$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed(, type 'lightweight'.)?$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: imklog [0-9.]+, log source = /proc/kmsg started.$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Kernel logging $proc$ stopped.$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: -- MARK --$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cronmark: -- MARK --$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] start$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] exiting on signal [0-9]+.$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed(, type 'lightweight'.)?$

local_rsyslog (954 bytes, 1,933 hits)

OpenSSH
closed user request, closed preauth 127.0.0.1

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [[:digit:]\.]+: [[:digit:]]+: Closed due to user request\.$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection closed by 127.0.0.1 \[preauth\]$

1 2	^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [[:digit:]\.]+: [[:digit:]]+: Closed due to user request\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection closed by 127.0.0.1 \[preauth\]$

local_ssh (255 bytes, 2,018 hits)

swapspace
allocating, retiring, adding (kernel)

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ /usr/sbin/swapspace: Allocating swapfile '[0-9]+'
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ /usr/sbin/swapspace: Retiring swapfile '[0-9]+'
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[0-9\.]+\] Adding [0-9]+k swap on [0-9]+.  Priority:-[0-9]+ extents:[0-9]+ across:[0-9]+k SS

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ /usr/sbin/swapspace: Allocating swapfile '[0-9]+'

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ /usr/sbin/swapspace: Retiring swapfile '[0-9]+'

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[0-9\.]+\] Adding [0-9]+k swap on [0-9]+. Priority:-[0-9]+ extents:[0-9]+ across:[0-9]+k SS

local_swapspace (324 bytes, 1,962 hits)

Quick Disk Usage Bash Script

Posted on August 18, 2013.

The command, du (estimate file space usage) is a core Linux program I use often.

When trying to find where space is being used on a disk I run the following command:

du --max-depth=1 -xh

This produces a list of all directories with their total size in human readable format. However it isn’t sorted, and it doesn’t tell me how much is being used in the current directory.

So I wrote a script which lists the directory sizes in human readable format, sorts them by size, and also has a seperate entry for the current directory, along with total.

Typical output:

$ ddu 0K ./proc 0K ./run 0K ./sys 4K [.] 4K ./boot 4K ./data 4K ./dev 4K ./lib64 4K ./media 4K ./mnt 4K ./opt 4K ./selinux 4K ./tmp 12K ./srv 32K ./home 76K ./root 5.5M ./sbin 5.5M ./bin 5.7M ./etc 12M ./lib 341M ./var 761M ./usr -- 1.1G [total]

Download
ddu.sh (846 bytes, 1,504 hits)

#!/usr/bin/nooblet.org

/* not just your average nub */