Mobile Working
When setting up a GlobalProtect Portal/Gateway with AzureAD you may find you receive the error message:
AADSTS700016: Application with identifier <Entity ID> was not found in the directory ‘<Directory ID>’.
The fix here is easy – the GlobalProtect client injects a :443 at the end of the domain name which isn’t mentioned in the guide from Microsoft (https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/palo-alto-networks-globalprotect-tutorial) but is in the guide from Palo Alto Networks (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE).
Interestingly the Reply URL doesn’t specifically require it (although mentioned in the Palo Alto guide) but either way easy to fix.
While iterating through an issue with our Ruckus SmartZone (with Ruckus R510 Access Points) controllers I was looking for a way to see when the Access Points had applied the new configuration; lone behold it’s quite easily done through both the CLI and the GUI.
Anyone who has used the new SmartZone controllers will know all too well that’s it’s not the fastest GUI to work with – thus if you have the option I’d suggest you go with the CLI method which is very responsive (and much more consistent!).
Via the CLI
Via the GUI
Today I had the pleasure of presenting at the Oxford ICTF Conference on Multi-Factor Authentication and Password Stores with Smart Cards and YubiKeys, the video recording is online now here – https://youtu.be/WGtCxS2YFNA and the presentation can be downloaded through the link below.
A special shout out goes to the Yubico press office for providing a set of YubiKey 4s, YubiKey NEOs and Security Keys which helped fuel a very lively Q and A session!
Presentation.pdf (5.5 MiB, 3,573 hits)
As some readers may know I currently work in Higher Education and while all of the business data is trivial to backup providing any level of backup service to students and academics is significantly harder. The challenges faced include the myriad of Operating Systems in use (Windows/OSX/Linux), the fact that the devices being backed up are inherently ‘untrusted’ (i.e. owned by the individual) and that they are often on networks (be it eduroam/public/home) that have no direct connectivity back to the internal trusted network.
Most enterprise class backup systems just aren’t suited to this kind of environment in that they cannot be securely published through a firewall or have exorbitant licencing costs for the number of devices to be protected (a few file servers vs 500+ student owned laptops).
One solution to this issue cropped up at a recent trade show where Synology were demonstrating their Synology DiskStation Manager NAS software which set itself apart from the traditional enterprise backup solutions with…
- Support up to 16,000 users on high end models (and 2048 on the kind of model that we would consider using) with no extra licencing costs, users can have storage quotas set either by group or per user
- Secure remote access (simply publish a single port which can be protected by HTTPS for encryption in transit)
- Home grown backup clients for modern versions of Windows, OSX/macOS and Linux
- On the point of OSX/macOS the backup client for Synology does not rely on Time Machine and so overcomes the issues associated with having to be on the same network as your backup device
- Home grown Btrfs file system which auto detects (and fixes) corrupted files through metadata along with extensive snapshot support
- Up to 32 recovery points and real-time file protection (when connected to the DiskStation)
So time for some screenshots! Below we have the initial setup of the Disk Station Manager and the installation of the client on a Windows PC.
- A business needs to provide backup to remote workers
- Those remote workers do not connect to the trusted network often
- Perhaps they don’t like VPNs/DirectAccess (and so rules out using Offline Files)
- and those remote workers do not use a commercial ‘cloud’ service to protect their data with
- Perhaps trusting a 3rd party to host the data is not an option
- The remote workers use OSX/macOS
- Those remote workers do not connect to the trusted network often
…then using a Synology DiskStation should be a serious consideration for that business.
Looking for some fun ways to get more out of your your Smart Card deployment? If so have you tried……?
- Use Smart Cards to login to your Servers via Remote Desktop
- Use Smart Cards with the PowerShell Get-Credential Commandlet
- Use Smart Cards with your Firewall for single sign on
- Use Smart Cards to login to IIS Web Applications (just a box to tick and a radio option to select)
- Store multiple identities on your Smart Card and assign different (and perhaps more complex) PINs to the identities
Have a look at the screen shots below for some more details…
If you are looking for a free tool to manage some of the more intricate features of the Gemalto IDPrime .NET and MD cards then the Mini-Driver Manager (downloadable from http://www.gemalto.com/products/dotnet_card/resources/development.html) may well fit the bill. However it has one small downfall in that out of the box it only allows you to manage cards with the Admin Key set to 48 0s or 48 Fs with neither option being much use to anyone once they have changed the Admin PIN.
Luckily these values are only set in a INI file so its pretty easy to change them to anything else.
Please note that this guide uses a feature in Notepad++ to elevate an application to have local Admin access, you can download Notepad++ from https://notepad-plus-plus.org however you could also use plain old Notepad you’ll just need to launch it as an Administrator and browse to the INI file within Notepad.
On with the guide!!
So after meaning to play with Smart Cards in greater detail for some time we’ve just received a set of cards and accessories from Smartcard Focus (http://www.smartcardfocus.com/) including….
- Gemalto GemPC Shell Token V2 (IDBridge K30) (a USB dongle style Smart Card reader which you can see in the screen shot sequence below)
- Gemalto IDPrime .NET smartcard – SIM cut (to go in the IDBridge K30)
- Gemalto IDPrime .NET card – just your standard Smart Card
- Omnikey 3121 – just your standard Smart Card reader
One of the first things I wanted to do was get PIN complexity and policy defined; the chaps over at Gemalto provide a number of tools which can be used to manage the cards which can be downloaded from the links below…
http://www.gemalto.com/products/dotnet_card/resources/development.html
http://www.gemalto.com/products/dotnet_card/resources/libraries.html
So time to get on with the guide (which also shows you which downloads are needed from the links)!
48 0s typed out… 🙂
000000000000000000000000000000000000000000000000
Front Ports
Is the desktop dead yet? Well with the 4th Gen Lenovo X1 Carbon (i5-6300U/8GB/256GB) and the ThinkPad OneLink+ Dock it might as well be! This powerful little dock has just a single cable to plug into your laptop which provides power and connectivity to the dock.
For connectivity the dock includes
- On the front…
- Stereo/microphone audio combo port on the front
- 2x USB 3.0 ports on the front one of which is ‘always on’ powered – great for charging up your phone
- On the back…
- 2x USB 2.0 ports (or as I now call them ‘Keyboard and Mouse ports’)
- 2x USB 3.0 ports
- 1x Gig Ethernet port
- 1x VGA port
- 2x (full sized) Display Port 1.2 ports
- Cable to your laptop
- On the side…
- Kensington cable lock
Compatibility
Going by the Lenovo website (Super long Lenovo link) this dock will work with the ThinkPad X1 Tablet, ThinkPad P40 Yoga, ThinkPad Yoga 14, ThinkPad Yoga 260, ThinkPad Yoga 460, X1 Carbon (4th gen), X1 Yoga.
Some super awesome little features that have really helped
- Power on button for the laptop on the dock – even with the screen closed it’ll power on your laptop (just too bad with the screen closed I can’t get to the fingerprint reader!)
- With the Ethernet cable plugged into the docking station the laptop will turn off its WiFi
- The docking station comes with a power cable (thus you don’t have to sacrifice your laptops power cable or buy an additional one!)
- Even though only one of the front ports is ‘always on’ powered the second port has no issues in powering up and running a 500GB Freecom USB Hard Disk Drive.
Stress test
So as you will have seen from the photos this screen has no issue in running 3x screens; but what about 3x screens while running a video on each screen, hammering the USB 3.0 port on the front running Crystal Disk Mark to a USB HDD, with audio streaming and my phone on charge? I certainly couldn’t notice any issue and the CPU on the X1 stayed below 22% through the test.
Heat/fan noise?
In the past I’ve seen docks like these kick out a fair amount of heat (when under load in particular) and while you can feel some heat from the OneLink+ dock it really isn’t much at all (only a few more degrees Celsius above its ‘off state’). In addition some laptops seem to ramp up their internal fan when attached to a dock – in this case the X1 Carbon behaves and under ‘productivity tasks’ I couldn’t notice the fan noise at all.
Final Verdict
I would prefer to see the VGA port replaced with a further display port (on high resolution screens VGA really does not work well) the Lenovo ThinkPad OneLink+ Dock really is an excellent bit of kit; not once have I looked back on my desktop and having extra desk space is just an added bonus.
Its been a day or so since buying a Microsoft Band 2 (took a while to find a high street shop that had one to try on in the first place!) and its proving rather useful to me as a person who rarely has his phone turned on loud and really never notices the little vibrations from it. My most recent application of Band 2 has been using it to receive push notifications from PRTG via my Windows Phone.
In all truth if you already have push notifications setup then you are probably already getting the notifications however if you are not keep reading to find out where to check for the right settings…
On the Microsoft Health App/Band Tiles
On the PRTG App
On your PRTG Console
On your Notification Settings
After giving the Customer/Technical previews of Windows 10 a wide berth (just haven’t had the time to play with them) I’m now finding I quite like Windows 10 on my Surface Pro 3 (i5 128GB); an interesting issue though – whenever I launched the new Mail app I found I was presented with the error message-
Your Outlook account settings are out of date.
Clicking the Fix account button didn’t seem to do anything…
However I then realised since the upgrade to Windows 10 I had only been using the PIN I defined back on Windows 8.1 to login (and as such had not yet provided Windows 10 with my Microsoft account password).
So after logging out and then logging back in again this time clicking the Sign-in options and then the full password option (as seen below) I found that clicking the Fix account button did actually this time fix the account.
Has this page helped you? Was it worth the cost of a Coffee? If so click here to donate £4.00 to the myworldofit.net coffee fund via PayPal.