From the partially RES related dept. It finally happened! Last year RES Software’s US-resident Cowboy Viking got the marching orders to head out west, to set up shop, in what happens to be my old stomping grounds around the Bay Area. While Philadelphia and the east coast have been an interesting and rewarding experience, as the song goes; my heart never really left San Francisco. Within the year I’ve been here on the east coast, a lot of good things have happened; we’ve trained and certified partners from Toronto down to Miami, from New York to Chicago. 2011 was inded a busy year in the RES US channel.

Here in 2012, it’s now time for yours truly to head “home” and focus on getting the western US territories stood up technically. As you may have noticed, we have significantly leveraged our relationship with Citrix this year, hence I really look forward to working more with the guys in Santa Clara in the near future. This article will kick off a series of mini photo-blog articles on a separate page (book mark this), started January 28th, 2012, covering the trip from Philly to San Francisco, expected to last 6-7 days.

Just on the off note: If you are wondering why I’m planning to document the trip, it’s because it’s just one of those things one rarely gets a chance to do. Besides that, I expect it’s going to be fun, at least in the eyes of a Scandinavian. My wife and and I are packing up our stuff in a bigass Uhaul trailer and taking the 3.000 mile drive (that’s about 4.800 km for you Europeans :) across the United States. Some of the folks around here ask me; Why not just have your stuff shipped and fly out yourselves? This is where I want to pause for a moment and remind my American friends that you and I live in of the most interesting geographical places on this 3rd rock from the Sun! There’s enough to see on the road to last you a lifetime. There are beautiful, wacky, tacky, terrible, awe-inspiring and jaw-dropping things to see all over this country and you have it all on your doorstep. Just get in your damn car and go! :)

With all that being said, here’s Mr. Rock from Detroit, who’ll explain what it’s all about (PS: if you’re stateside, click here for HD version.

The trip is now over! We made it safely to San Francisco. Read all about the trip on the pages here. (Currently being updated as I missed out writing in the last couple of days)

Today, Jan 3rd we celebrate the 3rd year of RESguru.com and a new staffmembers arrival. As you may recall there was a bit of controversy surrounding RESguru.com’s date of inception, but I’m glad this is behind us now and the usurper was silenced – at least for a while anyway :-) At this time, I wanted to take the opportunity to thank YOU, our regular readers and commentors for help in making the site what it is today. Your feedback and constructive critique has been essential to motivating myself and the other writers to continue what is essentially a labor of love.

I would also like to thank my current co-writers for providing quality content over the years. As all contributions to RESguru.com are on a completely voluntary basis, it’s with gratitude that I am able to publish the shared works of our regular staff, colleagues, friends and industry partners. To all of you: Thank you!

On that note, I would also like to welcome another RESguru onto the regular writer’s staff: Mr. Rob Aarts. Rob has a load of technical RES product experience which he’ll be sharing here on the ‘Guru site. His first article is about the new Global Variables in the RES Automation Manager. I’d suggest you give it a read! Rob’s bio can be found here.

From the More-is-Merrier Dept. Today April 18th, it is my pleasure to welcome 3 new guru’s as technical co-writers to RESguru.com. All three gentlemen are seasoned industry professionals who posses plenty of field experience with RES Software products. In no particular order, I am very pleased to introduce Patrick Kaak, Sascha Maier and Sander Wilmink. You can read their bio’s in the newly updated Writers section, which you can find in the black top menu. Each writer has in preperation for this announcement prepared an new technical article. Sander’s will be online shortly, but in the meantime have a look at these brand new technotes:

<<< RG034 – User driven app-install with WM & AM

<<< RG035 – Migrating to Win7 with Workspace Manager

You have reached the home of the RESguru Blog. This is a technical blog dedicated to the products of RES Software, namely Workspace Manager, Automation Manager, VDX and the Service Orchestration Module. Although this blog has been been around since early 2009,  I eventually figured out it would make  sense to write a short intro to our new visitors :-).  The old hands who have frequented the site over the years know where to go, so the following  intro is for you, our new prospective patrons.

PS: If you like what you find here, please consider giving the site a Google +1 here:

RES Software makes Desktops Dynamic. Right, so what does that really mean? In short, we make sure that all the configuration, security, performance, documentation and stuff is taken care of, without having to rely on scripting and policies. While other vendors focus their efforts on giving you the best operating system, virtualization or delivery systems, at RES Software we strive to manage the actual deliverable; the desktop as easily and effeciently as possible. There is a primer article here, which will give you a good introduction to what dynamic desktops are and how you set them up with the RES products.

If you are new to Workspace Management, Run Book Automation, Service Orchestration, or Reverse Seamless Windows – or you want to learn more, this site is definatly for you.

For those of you wondering; is this site an official RES resource? The answer is NO. This is just another fine site for mindsharing and experience exchange. I originally created it to avoid having to answer the same questions time and time again. Anything you find and use from here is your own responsibility. Please refer to the “Fine Print” section further down on the right side”.

With that aside, let me give you a quick tour around the block. At the top, you may already have noticed a menu of sorts, that look like this. Below it is a more detailed overview on what you will find in these areas.

• The Technote library, is the central repository for for reference articles, howto’s and all sorts of usefull bits of information I’ve collected from various sources. Each article is numbered and briefly outlined in the technote library.

• In the Video Vault you will find pretty much every RES related video ever made available. The videos are sorted into 4 categories: Technical Presentations (mostly from tradeshows and such), Tutorials (shows you how to do certain things),  Commercial videos (a bit more highlevel, not necessarily tech stuff) and finally the Legacy video section which may be obsolete in terms , although the capabilities may still be relevant.

• BB’s for WM is an abreviation for BuildingBlocks for Workspace Manager. Buildingblocks are prebuilt configuration pieces which you can import into Workspace Manager to make it do certain things. Examples are preconfigured settings and applications. The buildingblocks found in this section have been created by yours truely and other community guru’s.

• BB’s for AM is short for BuildingBlocks for Automation Manager. These buildingblocks will show you working examples on how to configure machine specific options, install software and do lot’s of other cool things. Note that these downloads may be somewhat larger than the Workspace Manager counterpart as they may contain binaries.

• I originally created the RESpedia as a one-stop reference to all the RES related buzzwords and jargon flying around, when you hang out with Workspace Geeks like yours truely :) In this crosslinked reference, you will find explainations of everything from Alligators to Zones. Note, where ever you see a link in italics, it is a link to the corresponding RESpedia entry.

• The Forums button is a direct link over to the RESug Forums. The RES UserGroup is a great place to ask questions, share ideas and experiences with your peers.

• Finally, in the Writers section, you will find introductions and bio’s on the contributing authors that provide content to this blog.

Below this article you will find other shorter postings. The aim of these postings is to follow current events in the RESverse, of a technical nature. These postings go back to early 2009, so there are plenty of them to read.  Just hit the << Older link at the bottom of each page.

I hope you will find this site as interesting as it is fun for me to write. Go dig around the site. I will soon improve RESguru with a new search plugin, so it should become more easy to find what you are looking for. In the interim, the site is now fully indexed by Google, so you can always use a site: search to find what you need.

Thanks for your interest,

Max Ranzau

From the and-now-to-something-completely-different dept. Yes, this article has got nothing to do with RES technology, as this is my account of how what can happen if you don’t take precautions to protect your WordPress blog, how it can ruin your day, what to do and how to prevent it from happening again.

I do recognize that there are varying degrees of attacks from the occasional comment spam, over the spamlink hacking that I’ve been dealing with, to a complete site takeover/takedown. Spending two sleepless nights learning the in’s and out’s of WordPress security, wasn’t my idea of fun, so in order to spare other fellow RES Community bloggers from having to learn from scratch, here’s my experiences, which you hopefully can benefit from before it’s too late:

Discovery

Now, it all started when one of my blogging mates drew my attention to the fact that Google had blacklisted one of the pages on my blog. If accessing this page through Chrome or Firefox, you would get this lovely number, as shown on the right. It was clear that something indeed was quite rotten in the state of Denmark.

Damage overview

To better understand the warning that Google was throwing, the first thing to do, if you haven’t already, is to sign up for the Google Webmaster tools. If I’d bothered to sign up for this service before, Google would have notified me immediatly as they look for spooky code and malware when their Bots are crawling all over your site anyways. If you haven’t worked with Webmaster tools before, it requires 2 things

• You need a google account (sign up for one, if you haven’t got one already)
• Once signed up and signed in to Webmaster tools, you will need to prove that you actually own/administer the site you.

The second item is done relatively easy, as Google offers several methods of proving your ownership. Personally, I find the easiest way is to upload a small file via FTP to the / root of the  website. Once that’s taken care of, the website is linked to your account and now you can see the messages which otherwise would have been sent to you when something happened. What we are really after is figure out what’s going on, why the Googlebot vomited dayglo over the page in question.

Cleaning up the mess

The Webmaster tool page offers a Labs section, where you can ask a GoogleBot to pull down the page as it sees it. This may reveal some particular nastyness which you otherwise might not have discovered: Hidden Spam Links. Besides all the html that generates your usual website, you’ll see a block of links that does not not belong there. These spam links serve the nefarious purpose of ranking up whatever lame sites so hopefully Google will bump them up in search results.

Here is an exerpt of some of the stuff that was injected into the site’s html code. The next thing is to figure out how it got there in the first place. One thing is for sure, it’s not static as searching through the site reveals nothing. Googeling around, it turns out that a popular method of infection is modifying Theme files.

There are several good WordPress plugins available to deal with this problem. The two plugins that really saved my behind was Exploit Scanner and Antivirus for WordPress. Both are written to scan .PHP files to look for infections. While AV4WP only scans theme files it notifies you via email if something spooky happens later. It is my understanding that theme files are prone to exploits especially. Exploit Scanner is more thorough and scans ALL files on your site.

Using Exploit Scanner, I found about 15 .php files which were infected. The telltale sign was was Base64 encrypted content in the top of the files. What this means in plain english is that hackers often obfuscate what they do so it becomes harder for the uninitiated to figure out what’s going on. Fortunatly when it comes to WordPress this is a red alert. Something that shouldn’t normaly be there. An exception to this is for example plugins with embedded graphics such as icons. You will however typically see code references to icon data around it if that’s the case.

What I found was the above block, embedded in the top of the infected files (don’t worry, it’s a JPEG, so it’s totally harmless here). I used the built-in wordpress  plugin editor to open the affected files and toss out the malicious code. Be carefull when you edit the php files that you leave a line with a <?php begin header at the top. If you don’t you can royally screw up your entire wordpresss site, especially if the file you’re editing is wp-config.php

What killed the cat…

Of course I later got curious, and wanted to figure out what the above did. The easiest thing is to run it through a Base64 decoder. There are plenty of these on the net. I used this one and found out what the code above contained. I’ve blanked out full the path to the file as I don’t want to invite any additional attempts to exploit that path, even though I’ve locked it down.

Obviously the style.css.php file was the culprit, and sure enough when opening it was chokefull of more Base64 code. Along side it in the same folders there were several files which contained all the spam URL’s + much more. I downloaded a copy to my local rig and promptly nuked the files from the webserver. For your amusement I’ve included an archive with the files so you can check them out yourself.  The style.css.php file seems to be the heart of this infection. In fact it was double Base64 encrypted and lo and behold, more encrypted code inside. This was however encoded differently so I started googling the first line ‘function FF97A1D7A5B771B21D423C3A9D78408C’. Following threads in other forums, here, and here it seems likely that this is a rather old exploit.

Validating the cleanup

After removing the Base64 entries from all affected files and the target folder they were all pointing at, it was time to tell Google to check the site again. This is an automated process and if things go well, the Malware warning in Firefox and Chrome go away by themselves. Depending on how busy that the Googlebots are, it can take up to 24 hours before this takes effect. What I did was the following:

• Logged into Google Webmaster Tools again and went to Labs | Fetch as Googlebot.
• Request a page which was known to be infected previously.
• Checked that no spamlinks were injected into the code
• If all of the above checks out, go to the Diagnostics | Malware section and use the link found there to Request a Review.

After a day or so at most, the safety blocks on your pages should be lifted, and you’re back in business.

Cause and prevention

Now, the important question remains. How the heck did this happen in the first place and how does one prevent it from happening in the future.  I believe the hacker in my case exploited a vunerability in SMF (Simple Machines Forums) which was still sitting dormant on my site. For a long time I’ve redirected to the RESug Forums, but the old SMF engine had just been sitting around forgotten, waiting to be tinkered with. Yup. My bad. SMF uninstalled. Second, I’ve done some preventive hardening to hopefully ensure that this doesn’t happen again. The last section belows covers some of the steps I’ve taken to tighten things up a bit:

Backing up your wordpress database. There are several nice plugins out there to help you create a full backup of the MySQL database that powers your WordPress engine. This is a really good step to take, both as a preventive measure, but also if you like me like to tinker with stuff. You really want to have a backup of your DB before you proceed further. Online Backup for WordPress is one such plugin, which I’ve used since day one. It can mail you a copy of the backup as well as store an encrypted copy at a remote storage facility, where they offer 50 megs for free. Mine’s only 23 megs after 2 years of operation, but it of course depends on what kind of blog and what other plugins you’re using.

Secure your Admin account: Rename the Admin account for your wordpress installation. This is target numero uno to secure. If somebody gets their hands on that one, it’s game over, man. So better deal with it now.

1. You need to access the MySQL database. To do this you need the equivalent of a SQLadmin tool. You may have an app called phpMyAdmin in your Cpanel from your hosting provider. If not you can just download one as a plugin for WordPress, called Adminer. I find this quite nifty to have around actually, as I discovered I had some old and gone plugins that left orphaned tables behind. But that’s another matter.
2. Using this tool (rtfm) open the table called wp_users.
3. Make sure that only Admin and any other users which you recognize are in here. If you discover bogus user names, make sure you kick them out immediatly.
4. When you change the admin name to something else, be sure you’ve noted it down and type it in correctly, as you will get kicked out of WordPress the moment the record is commited. Your password will remain the  same.
5. Login again with the new admin name and you’re good.

Find some security plugins that make sense. Again, this depends on what kind of blog you’re running but essentially you should protect yourself from commentspam, have something in place to scan your site for nasties and generally button things down. This is a list of some of the plugins I use to make sure things run more smooth

• Akismet – Great anti-spamcomment filter
• Exploit Scanner – Scans for possible exploits
• Login Lockdown – Protects against bruteforce attacks
• Secure WordPress – Does a lot of preventive security configuration for you
• SI Captcha Anti-Spam – Stop spambots dead in their slimy tracks
• TAC (Theme Authenticity Checker) – Checks for exploited theme files
• WP Security Scan – Perform security scan of WordPress installation

Note that you can search for the plugin names above from within your Plugin|Add New page. In addition, I’d suggest to read the article found here, where 20 good security plugins are reviewed in detail

Get some more advice: After seaching a bit, I came across several good sites offering recommendations on what to do to lock down your WordPress site. I suggest you read the articles found here and here. There are many more pages like these out there, but make sure you read through the advice and implement what is necessary for you.

From the will-you-quit-already dept. To the rest of the RES community, please ignore this posting as it’s got little to do with what we usually deal with around here. I just wanted to vent some steam at the clueless individuals who seem hellbent on peddeling their useless crap, be it knockoff watches, pet viagra, timeshares in New Jersey or whatever…

Guys, you’re wasting your time here – We have this thing in place called a “SPAMFILTER”. Yes, that’s right – we keep it on the far side of the moon, right next to the “Laser”. Net result:  Spam comments submitted: 3971. Number of spam comments that made it through: 0, zip, nada, zilch. Get the picture?

Update: And just to make life even more miserable for you – the purveyors of spam, I’ve added a Captcha filter today. I trust it won’t put off the regular patrons of this site too much.

From the revamed slidedeck division. If you are new to this blog, you may have missed a posting that I did almost two years ago, called Zen and the Art of PowerTrace. This article was about how to get the most out of the advanced tracking module (known back then as PowerTrace), built into the Enterprise version of the RES Workspace Manager.

With the help of my good friend Sascha Maier, I was back then able to create a slide-deck using real-world screenshots of a live customer environment with thousands of users, showing you the true power of Usage Tracking unleashed. Not an easy feat to replicate in a lab environment, I’m sure you’ll agree. As RES recently changed product names, logos etc. I thougth this would be a great time to re-introduce the revamped slide-deck with updated terminology and graphics.

If you are new to RES products: This slidedeck will teach you how to get the most out of Usage Tracking, which is an extensive logging apparatus, essentially linking all the user does in a session, what apps are being used for how long, on what devices, online/offline status, resource consumption, and much much more. Usage Tracking will answer the following and many other questions:

• What’s going on right now?
• What did a certain user do at a certain time?
• Who’s been doing things they’re not supposed to do?
• Who’s been editing a certain [type of] docment in a given department?
• Web activity of a user or department
• What’s the Top-10 usage of applications and websites?
• What’s the daily maximum users on my terminal servers?

If you are a Veteran Workspacer, throw out the old PowerTrace slide deck and click below to download the updated presentation. Note: The screenshots still say PowerTrace here and there. Eventually I’ll get around to grabbing new screenshots when the viewer changes someday.

In either case, be sure to read the speakernotes section of the Powerpoint presentation as it contains the entire talk track and a lot of useful information about the capabilities of this system. In addition to this presentation, be sure to read article RG007 on the sizing of the Usage Tracking Database and RG02D about splitting the Usage tracking log data away from the Workspace Manager 2011 configuration datastore.

Click on the slidedeck on the right to download:

From the link-here-and-win dept. The winner of the RESguru giftcard contest was drawn today. The winner has asked to remain anonymous, which I of course will respect, although I can reveal he is a big fan of RES technology in the United Kingdom.  To all who now links to the ‘Guru, thanks a bunch fellas! If I haven’t linked to your RES technology related site yet, please let me know about it.

Stay tuned for other competitions in the future.

From the enough-is-enough dept. Regular patrons of this site might have noticed that since yesterday night things went kablooey and RESguru was offline. Not entirely sure what happened, but the DNS entries were shot and the site was unresponsive. Fortunately I backup on a regular basis, so it didn’t take too long to move to a new host, as I wasn’t too thrilled anyway by the speed that the previous host provided. As of today the Guru’ lives at HostGator‘s datacenter in Dallas, TX. These guys are great btw. Fast, efficient and affordable. Nuff’ said.

I trust you will experience first hand the improved speed of the site – Enjoy!

From the toys-aren’t-quite-us dept. In an effort to spread awareness of the posibilities with RES PowerFuse and Wisdom, I’m kicking off a little prize drawing over the next month. The prize is a $75 giftcard for ThinkGeek.com. If you’re a techie like me, you’ll love the stuff they’ve got. All sorts of gadgets, duds and consumables that any geek worth their salt could ever crave.

The compo is quite simple;

• If you run a blog or a regular website and you like RES products (since you’re reading this blog, I presume that may be the case :) – consider adding a link to RESguru to your site*
• Email me the URL where you’ve linked to RESguru.com. Put ‘RESguru Link‘ in the subject.
• On October 1st 2010, submitted URLS will be reviewed (see below) and the winner will be drawn at random and I’ll contact you directly. If you want to have your name out or not, is completely up to you.

Review: While I don’t expect you to plaster a 8000px blinking banner on the front of your website, on the other hand – if you tuck in the link on some backwater page where only the spiders crawl, isn’t exactly what I’m aiming for either :) Stick a link to RESguru.com into your BlogRoll (see the Places that we like section further down on the right hand side on this blog), or you can put in a little banner like the ones here.

* Note: Although being more than welcome to link, Employees of RES Software are not eligible to enter prize drawing. Sorry guys, but we got to keep things fair.