[Solved] If you have upgraded VirtualBox recently, please make sure you have terminated all VMs and upgraded any extension packs. If this error persists, try re-installing VirtualBox. (VERR_PDM_DEVHLPR3_VERSION_MISMATCH).

Failed to open a session for the virtual machine Win 7 32.

The device helper structure version has changed.

If you have upgraded VirtualBox recently, please make sure you have terminated all VMs and upgraded any extension packs. If this error persists, try re-installing VirtualBox. (VERR_PDM_DEVHLPR3_VERSION_MISMATCH).

Result Code: E_FAIL (0x80004005)
Component: ConsoleWrap
Interface: IConsole {872da645-4a9b-1727-bee2-5585105b9eed}

Reasons:

The version of VirtualBox and the version of the extension packs that VirtualBox has installed must be the same or lower version. It looks like you still have 5.0.10 extensions packs installed in VirtualBox 5.0.14.

Open Virtualbox, on the File menu select preferences. A new window will open. Select Extensions. Now mark all extensions and uninstall them using the button with the small red x.

If you want to install again the extension pack (if you need to use USB or RDP), please go to this page, and download ones that match your VirtualBox version.

Read More

How to Monitor User Logоns in a Domain

1.

Run gpedit.msc → Create a new GPO → Edit it: Go to "Computer Configuration" → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff:

• Audit Logon → Define → Success And Failures.

2.

Go to Event Log → Define:

• Maximum security log size to 4gb
• Retention method for security log to "Overwrite events as needed".

3.

Link the new GPO to OU with Computer Accounts: Go to "Group Policy Management" → right-click the defined OU → choose Link an Existing GPO → choose the GPO that you created.

4.

Force the group policy update: In "Group Policy Management" right click on the defined OU → click on "Group Policy Update".

5.

Open Event viewer and search Security log for event id’s 4648 (Audit Logon).

source: netwrix.com

Read More

[Solved] You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.

[Window Title]
Open Folder

[Content]
\\192.168.1.12 is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.

The referenced account is currently locked out and may not be logged on to.


[OK]

Solved:

Control Panel --> User Accounts --> Managed your credentials or Control Panel\Credential Manager\Windows Credentials

Select Windows credentials then remove account ==> DONE

Done!

Read More

Tìm kiếm mã độc trên server hosting linux

Những biểu hiện thường gặp server hosing đang chứa mã độc là thực hiện gửi spam mail, brute force ssh, DOS… tới server khác. Thông thường bạn sẽ nhận được cảnh báo này từ nhà cung câp dịch vụ server, vps… Sau đây là một số thủ thuật giúp bạn nhanh chóng phát hiện tài khoản nào đang bị hacker kiểm soát.

1 Kiểm tra bằng lệnh top

Trên server hosting sẽ có nhiều tài khoản chạy đồng thời. Tài khoản bị tấn công thường xuất hiện liên tục ở những hàng đầu khi gõ lệnh top. Ở cột command sẽ xuất hiện những lệnh thường gặp như perl, python, host, mail…
Hình bên trên cho biết tài khoản noithat đang chạy các tiến trình perl

2 Kiêm tra file log apache
Các tài khoản hosting chữa mã độc thường được hacker điều khiển bằng cách gửi POST request tới website.

Một tài khoản đang bị tấn công thông qua đường dẫn http://domain.com/wp-content/themes/saladmag/css/general19.php


3 Tìm kiếm các file nghi vấn khác trên tài khoản user. 
Tìm kiếm các file mới được up lên.

# cd /home/noithat/public_html
# find . -name “*.php” -mtime -14

Tìm kiếm các script có khả năng chữa mã độc.

# find . -type f -name ‘*.php’ | xargs egrep -i “(mail|fsockopen|pfsockopen|stream_socket_client|exec|system|passthru|base64_decode) *\(”

4 Tìm kiếm mã độc thông qua những email đang gửi spam
Các tài khoản bị tấn công đa phần sẽ thực hiện gửi spam mail. Do đó việc kiểm tra script đang gửi spam mail sẽ tìm ra được vị trí mã nguồn bị tấn công.

nguồn: http://hotrovps.info/linux/tim-kiem-ma-doc-tren-server-hosting-linux.html

Read More

How to Configure ‘Zabbix Monitoring’ to Send Email Alerts to Gmail Account – Part 4

use script below:

#!/usr/bin/python
	# -*- coding: utf-8 -*-
	"""
	Zabbix SMTP Alert script for gmail.
	"""
	import sys
	import smtplib
	from email.MIMEText import MIMEText
	from email.Header import Header
	from email.Utils import formatdate
	# Mail Account
	MAIL_ACCOUNT = 'your.account@gmail.com'
	MAIL_PASSWORD = 'your mail password'
	# Sender Name
	SENDER_NAME = u'Zabbix Alert'
	# Mail Server
	SMTP_SERVER = 'smtp.gmail.com'
	SMTP_PORT = 587
	# TLS
	SMTP_TLS = True
	def send_mail(recipient, subject, body, encoding='utf-8'):
	session = None
	msg = MIMEText(body, 'plain', encoding)
	msg['Subject'] = Header(subject, encoding)
	msg['From'] = Header(SENDER_NAME, encoding)
	msg['To'] = recipient
	msg['Date'] = formatdate()
	try:
	session = smtplib.SMTP(SMTP_SERVER, SMTP_PORT)
	if SMTP_TLS:
	session.ehlo()
	session.starttls()
	session.ehlo()
	session.login(MAIL_ACCOUNT, MAIL_PASSWORD)
	session.sendmail(MAIL_ACCOUNT, recipient, msg.as_string())
	except Exception as e:
	raise e
	finally:
	# close session
	if session:
	session.quit()
	if __name__ == '__main__':
	"""
	recipient = sys.argv[1]
	subject = sys.argv[2]
	body = sys.argv[3]
	"""
	if len(sys.argv) == 4:
	send_mail(
	recipient=sys.argv[1],
	subject=sys.argv[2],
	body=sys.argv[3])
	else:
	print u"""requires 3 parameters (recipient, subject, body)
	\t$ zabbix-gmail.sh recipient subject body
	"""

or download here 

Install guide:

• Put this script in /usr/lib/zabbix/alertscripts and modify the 14,15, 21th lines
• cd /usr/lib/zabbix/alertscripts
• chmod 755 zabbix-alert-smtp.sh
• chmod +x zabbix-alert-smtp.sh
• Go to Zabbix web UI, Administration > Media types > Create media type
• Enter Script name: zabbix-alert-smtp.sh
• Save
• Configuration->Action->Report problems... -> Tab Operation check values remember to enable and save
  THIS STEP IS VERY IMPORTANT!!!
• Administration->Users-> Into admin account (you can filter with listbox Users menu top right page) -> Tab Media ->Add -> Type -> listbox: zabbix-alert-smtp.py -> Send To -> your email -> Status -> Enable and save
  Hope to help someone...

source: https://gist.github.com/superdaigo/3754055#file-zabbix-alert-smtp-sh-L1

Read More

How to Install Zabbix Agent and Add Windows Host to Zabbix Monitoring – Part 3

Step 1: Download and Install Zabbix Agent on Windows

1. The pre-compiled zip agents for Windows environments can be obtained from official Zabbix download page and manually installed and started on the system using windows Command Prompt as in the following example:

C:\Users\caezsar><full system path to zabbix_agentd.exe> --config <full system path to zabbix_agentd.win.conf> --install

Example, suppose you’ve downloaded and extracted the Zabbix agent zip archive toD:\Downloads\zabbix_agents_2.4.4.win\, run the following command to install the service:

C:\Users\caezsar>D:\Downloads\zabbix_agents_2.4.4.win\bin\win32\zabbix_agentd.exe --config D:\Downloads\zabbix_agents_2.4.4.win\conf\zabbix_agentd.win.conf --install

2. After the service has been installed on your windows host, open zabbix_agentd.win.conf file and manually edit the following parameters:

zabbix_agentd.win.conf

Server=IP of Zabbix Server
ServerActive=IP of Zabbix Server
Hostname=use the FQDN of your windows host

3. To start the service just type:

C:\Users\caezsar>D:\Downloads\zabbix_agents_2.4.4.win\bin\win32\zabbix_agentd.exe --start

To stop the service run the same command as above with --stop argument and to uninstall the service use the --uninstall argument.

C:\Users\caezsar>D:\Downloads\zabbix_agents_2.4.4.win\bin\win32\zabbix_agentd.exe --stop
C:\Users\caezsar>D:\Downloads\zabbix_agents_2.4.4.win\bin\win32\zabbix_agentd.exe --uninstall

Configure Zabbix Windows Agent

4. A second and more convenient method to install and automatically configure Zabbix agent on Windows environments is by downloading Zabbix Agent installer msi package specific for your system architecture by visiting the link: http://www.suiviperf.com/zabbix/index.php.

5. Once the Zabbix agent msi file has been downloaded on your system, run it and supply the required information in order to configure and install the agent on the target monitored host as it follows:

Hostname: use the FQDN of your windows host (the hostname value should match the “Full Computer name” configured for your machine)
Zabbix server Name: use the IP of the Zabbix Server
Agent Port: 10050 
Remote Command: check this value
Active Server: IP of Zabbix Server

Zabbix Agent Installation on Windows

If you need to modify Zabbix configuration file with other custom values at a later date, the conf file can be found on %programfiles%\Zabbix Agent\ path.

6. After you’ve finished the setup, open a windows Command Prompt with Administratorprivileges, run services.msc command in order to open Windows Services utility and locateZabbix Agent service to check if the service is running and automatically started after reboot.

services.msc

From this console you can manage the service (start, stop, pause, resume, enable or disable).

Zabbix Agent Windows Service

Step 2: Configure Windows Firewall and Test Zabbix Agent

7. Almost all Windows based systems have Windows Firewall active and running, therefore zabbix agent port must be opened in firewall in order to communicate with zabbix server.

In order to open Zabbix agent port in windows firewall, open Control Panel -> System and Security– > Windows Firewall and hit on Allow an app through Windows Firewall.

Open Zabbix Port on Windows

8. Next, click on Allow another app button and a new window should open. Use the Browse button to navigate and add Zabbix agent executable file (usually found in %programfiles%\Zabbix Agent\if you installed it using msi program), then hit on Add button to add the service.

Add Zabbix Agent

Add Zabbix to Windows

9. Next, make sure you check and open the firewall rule on the network segment where zabbix server is located in your network and hit OK button to finish and apply configuration.

Allow Zabbix Agent on Windows Firewall

10. In order to test if Zabbix agent running on windows is reachable from Zabbix server side, usetelnet or netcat command on zabbix server against windows agent IP-Port and a Connected message should appear. Hit Enter key to generate an error message and automatically disconnect from agent:

telnet <Windows_agent IP Address> 10050

Check Zabbix Agent Port on Windows

Step 3: Add Zabbix Agent Monitored Windows Host to Zabbix Server

11. Once the windows agent has been tested from command line and everything looks fine, go toZabbix Server web interface, move to Configuration tab -> Hosts and hit on Create Host button in order to add the Windows monitored host.

Add Windows Host to Zabbix

12. On Host window add the FQDN of your windows agent machine in Host name filed, add an arbitrary name to Visible name filed in order to easily identify the monitored machine on Zabbix panel, make sure the host is included into a Group Servers and add the IP Address of your windows host in Agent interfaces filed. The Port value leave it unchanged.

Windows Host Configuration in Zabbix

13. Next, go to Template tab and hit on Select button. A new window with Zabbix Templatesshould appear. Navigate through this window, check Template OS Windows and hit on Selectbutton to add the template.

Zabbix Template OS Windows

Select Template OS Windows

14. Once the Template OS Windows appears on Link new templates filed, hit on Add button in order to link this template to the windows host configuration.

Finally, after the Template OS Windows is visible in Linked Templates filed hit on below Addbutton to complete the process and add the entire Windows host configuration.

Zabbix Linked Windows Templates

Add Linked Zabbix Windows Templates

15. After your monitored windows machine has been added return to Configuration -> Hosts and the windows Host should now be present in this window as illustrated on below screenshot.

Check Windows Host in Zabbix

That’s all! Just assure that your windows host Status is set to Enabled and wait a few minutes in order for Zabbix server to contact the windows agent side and process the received remote data.

As an example, to get a graphical inside of the CPU load on the monitored Windows machine go to Zabbix web console Monitoring tab -> Graphs, select the windows machine host name and CPU load Graph and all the collected data so far should be presented into a nice graphical chart.

Monitor Windows Host in Zabbix

Read More