Page 3 of 9

Teams Addon in Outlook for Mac “Authentication required” possible fix

March 11, 2021 / / 0 Comments

A few customers had an issue where their Teams Addon in Outlook for MacOS would stop functioning after MFA activation on exchange. When trying to make a calendar invite with MS Teams integration they would get an message saying “Authentication required”. To be more exact “Outlook needs to confirm your account permissions before adding a Teams Meeting. Please login..”. After clicking “OK” on that popup, it would still fail.

Went through a ton of different answers from Google like:

  • Log out of both Outlook and Teams & then log into Teams before opening Outlook
  • Delete Outlook user and then re-add it to Outlook (Helped in one instance)
  • Delete some key chain entries

Those didn’t help one bit in that case. What actually fixed the issue was removing the Office 365 license and re-activating Office.

To remove the MS Office license just close all MS Office applications and download the removal tool from Microsoft and follow their guide here: How to remove Office license files on a Mac – Office Support (microsoft.com)

After removing the license re-open Outlook , it should prompt You to insert Your O365 licensing related credentials again. After doing that retry making a calendar invite and use the Teams Addon. A familiar “Authentication required” window should pop up. Click OK on it again, but this time the authentication process should actually start and work. After that it should continue working with out a hitch.

There was actually one instance where the license removal trick didn’t help. There I retried the account removal and that fixed it for that user.

AMD Ryzen 5800X seems warm when compared to others in the same series

December 6, 2020 / / 0 Comments

After a few years it was time again to upgrade my computer. The “itch” started during the summer already. When I started looking at nearest release dates to see if it would be worth while to wait a bit. As Intel hadn’t made too much progress over the years over my current system, just added some cores and that’s it and AMD’s coming Zen3 was rumored to be really good. So I decided to wait and I’m so glad I did. After seeing AMD-s presentation I thought I might as well give it a try.

On the launch day I managed to grab myself a Ryzen 5800X. So that meant that after many more than a decade I was switching back to the Red Team from the Blue Team.

I paired the 5800X with the NZXT X63 AIO cooler and currently I think it was a good choice that I didn’t try and save on the cooler. Initially thought I botched the cooler installation somehow when I saw the full load temperatures go well over 87 degrees Celsius, under CineBench R23 multicore load . Even went as far as swapped the original paste that was pre-applied at the factory for Thermal Grizzly Hydronaut paste. Temp dropped only ~1-2 degrees.

Although while gaming or other lighter multicore loads the temperature is a bit more reasonable, the CineBench temperature still bothered me. So I started googling a bit about 5800X temperature. As it turns out some of the 5800X CPU-s seem to be running a bit warm, as other people had reported similar higher temperatures. Also it is interesting that the 5800X seems to be running on higher voltage out of the box when compared to other Ryzen 5000 series CPU’s.

To get the temperature to a more comfortable zone I finally turned to under volting. By lowering the voltage by 0,05 the temperature while gaming is ~63 degrees and running Cinebench R23 it is ~81 degrees Celsius. Still a bit high, but much better. Lowering the voltage didn’t luckily cost me any performance. At least when looking at the boost clock and benchmark numbers. I haven’t actually had time to find the lowest stable under volt yet, maybe I could get it lower and cooler.

Long story short. Although CineBench R23 load shouldn’t be the normal load for most of the people, but as I’m getting 67 degrees Celsius under normal gaming load and ~81 degrees Celsius on Cinebench with the NZXT X63. It makes me wonder if only a high end cooler is a must for these “warmer” CPU-s. Also I’m wondering what would the temperatures be with a regular cheaper (~30$ or so) AM4 air cooler. Even if the temperatures are higher than I’m used to, even compared to my old overclocked I7. I’m still pleased with my purchase and the performance boost was phenomenal.

What was interesting is, that even after under volting the CPU I was able to set boost clocks 200Mhz higher and its stable. So single core boost is over 5019Mhz, lighter multi core load 6 cores or so goes over 4900Mhz, yet all core full load is 4541 Mhz.

On the infinity fabric side, getting it to run on 1900Mhz didn’t require much messing about, just set it at that and that’s it. So 3800Mhz memory is easy to get working with 1:1 settings.

Tenable.SC license renewal headache – things to keep in mind when renewing

November 23, 2020 / / 0 Comments

First year of Tenable usage was coming to an end. Nessus scanners/Managers and Tenable.SC all notified me that their licenses are about to expire. Contacted the company selling tenable in the region, got the licenses extended.

New license expiry date popped into the tenable support site, was wondering if the different instances would auto update their licenses. Looked at the scanners and managers – all was fine and licenses were extended. So I was happy problem solved, at least so I thought.. But I had missed one place, the SC, as I assumed that all their software/licenses would work the same way and didn’t waste any more time looking at the licenses.

A few weeks pass and suddenly I cannot log into the SC any more “with invalid license” error popping up when I try and log in. As it turned out – never assume that a vendors products all work the same way. When going to the admin interface of the SC I discover that the license states that its expired. Logged into the tenable support website to check on the license status all is supposed to be fine.

After that had a little chat with support – as it turns out licenses for Tenable.SC can be renewed in multiple ways. In one case your license is extended and the other just superseded so you need to re-download the license key file and upload it to your SC for it to start working again..

During the period the license was expired the scan data was not imported (rejected with an error by the SC). Fortunately it could be re-processed in the scan results list, but all the data ended up having the discovery date set as the manual re-processing date.. A minor inconvenience/integrity issue, but at least all the info still exists.

Windows 10 WiFi ignoring DHCP DNS settings

June 2, 2020 / / 7 Comments

After a long period of home office it seemed that my computer did not want to work well in any other WiFi network any more. It showed “no internet connection” in every other network.

When looking into the connection settings, I saw that it was still showing my home DNS server in the settings. No matter what network I was connecting to, be it my phones hot spot, etc still the same.
Example output of the netsh command:

C:\WINDOWS\system32>netsh interface ipv4 show config name=”Wi-Fi”

Configuration for interface "Wi-Fi"
DHCP enabled: Yes
IP Address: 10.1.0.38
Subnet Prefix: 10.1.0.0/24 (mask 255.255.255.0)
Default Gateway: 10.1.0.1
Gateway Metric: 0
InterfaceMetric: 70
DNS servers configured through DHCP: 172.31.1.1
Register with which suffix: Primary only
WINS servers configured through DHCP: None

So I tried using the “netsh” command to reset it by entering a static DNS:
netsh interface ipv4 set dnsservers name="Wi-Fi" source=static address=8.8.8.8

Now I had working name resolution, but this is not a fix for me to have to set a correct DNS server for all the networks I go to, so I set it to DHCP settings again.
netsh interface ipv4 set dnsservers name="Wi-Fi" source=dhcp

Name resolution broke again, as the “show config” returned my home DNS again.. So I turned to the Windows registry to find where that IP address exists. Find yielded the following result. In Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{interface-uid} there was a registry key called ProfileNameServer. It had a value that matched my problematic DNS server entry. After deleting registry key and reconnecting to the WiFi I finally saw that the DHCP given DNS server list was being used and network connection was working normally again.

Check Point to Cisco ASA IKEv2 VPN with SHA-256 “no proposal chosen” – Timed out

February 17, 2020 / / 0 Comments

When creating a VPN tunnel between Cisco ASA 9.x and Check Point firewalls using IKE v2 and integrity checks better than SHA1 you might run into a small issue where Phase 1 comes up with no issue and on Phase 2 see time outs in the Check Point logs.

After seeing time out, you enable VPN debugging and you see in the ikev2.xmll log “No Proposal Chosen” message coming from the ASA side. Then you and compare the the crypto configurations on both sides and see that they are identical. If that is the case, there might be a pseudo-random function (“prf”) mismatch. To get around it you should try the following command on the Cisco side:

prf sha

It’s only doable on Cisco side, as Check Point doesn’t let you change this value. That was supposedly the only change made on the peer gateway by the Cisco admin after which the tunnel came up.

Check Point R77.30 new sub interface not forwarding traffic

February 12, 2020 / / 0 Comments

As it seems on Check Point R77.30 Take_351, it is possible that after adding a new VLAN interface a it may fail to route traffic. When looking at the cluster status, everything seems OK. But when you take a look at the routing table you notice that actually the newly added network is missing.

Doing the usual “cpstop & cpstart” does not fix the issue. What actually was needed to get it to forward traffic to the good old “have you tried turning it off and on again”. If it happens on your primary cluster node just fail over to the secondary node and reboot.

Windows search keeps crashing

February 6, 2020 / / 0 Comments

After updating Windows 10 to version 1903 I started having strange Issues where the search functionality stopped working. By search stopped working I mean you open start and start typing and nothing happens..

When it happened for the first time I just rebooted my PC and all worked fine for a few days. When it happened again I just killed the search process in task manager and all worked fine again for a few days.

As it started happening more often I ended up trying to fix it. For me rebuilding the Windows search indexes and the issue went away. So in order to rebuild the indexes you need to do the following.

Click on start and press on settings. From there navigate to “Search” -> Searching Windows. And in the open page click “Advanced Search Indexer Settings”. After that the following Window should pop up:

From there click on “Advanced” and in the following Window find the “Rebuild” button in the troubleshooting sector. Press that and agree to the warning that rebuilding might take some time.

Or if Your search is working a the moment just type “Indexing Options” into your search window and you arrive at the previously shown Window.

Well and if the steps above didn’t help might as well read Microsoft’s support article: https://support.microsoft.com/en-us/help/4520146/fix-problems-in-windows-search

Tenable.SC and Nessus Scanner updates activation

February 3, 2020 / / 0 Comments

When installing Tenable.SC it asks for a activation key and installation continues. Then you install your Nessus scanner and during the install point it to the SC and it shows that its license is managed by Tenable.SC. Now that you have everything installed and up and running right? Wrong..

Updates for the plugins are not working yet, as for that you need to enter a separate license key. You need to log in to your Tenable Community account go to Your products and find the Tenable.sc activation key.

You need to insert that key into your Tenable.SC when logged into it as and administrator (not the scanning account). You need to navigate in the menu to System > Configuration > License and click on “Nessus Scanner” and paste the activation key you found on the Support site into there and press Register. After that your Tenable.SC and Nessus will be able to update their plugins and feeds.

Getting Tenable.SC working with Nessus Agents

February 2, 2020 / / 5 Comments

What do Nessus Agents do

Nessus Agent is a lightweight piece of software that You can install on a host to do patch management and vulnerability/compliance checking with out having some central server with credentials logging into every machine you have. For example the Nessus Credentialed scans. Instead the agent software just reports back to the central server and keeps polling to see if any commands have been given.

Nessus Agent can run patch level/vulnerability scan/malware scan or configuration compliance checks.

Requirements

I assume that when thinking about Nessus Agent based scans with Tenable.sc You already have a Tenable.SC license and working installation.

Tenable.SC needs to have access to the TCP port 8834 on the Nessus Manager.

Nessus Manager preferrably has internet access to download updates and activate the license.

Nessus Agents need access to the TCP port 8834 on the Nessus Manager.

Licensing hassle

In order to get Nessus Agents info into Tenable.SC there are some extra steps You need to take besides the Tenable.SC and Nessus Scanner installation. You actually also need to install Nessus Manager to get Agents working. Regular Nessus scanners haven’t got the ability to work with Agents.

To actually get Nessus Manager, it turned out to be a bit of a hassle. As it turns out, although the software comes with the Tenable.SC license, You actually need to ask for it separately. After a short e-mail exchange with support and some signed documents later, You will actually get Nessus Manager license added to your Tenable account.

The installation

After You get the license key, download the regular “Tenable Core + Nessus” software from https://www.tenable.com/downloads/tenable-appliance and install the VM. The install will be the same as for regular Nessus Scanner.

After having set up the VM open Your web browser and go to the appliance web page https://nessus-manager-ip-here:8834/, then the wizard will open. From there select Nessus Manager instead of Nessus Scanner and insert the license key when prompted. The setup will also ask for you to create an account for you self.. It will take a while for the wizard to download and compile all the needed components. After it completes you have a ready working Nessus Manager.

After the wizard completes, login to the the Appliance with the account You created during the wizard. First thing You need to do is create a “group” for the agents. IE for your web servers call it “Web Servers” or for Client PC’s call it “Client PC’s”. After having created the groups you now can proceed to linking your Agents.

To install the agents first You need to download the proper Agent software from https://www.tenable.com/downloads/nessus-agents. Installation is quite straight forward. As an example on a 64bit Centos7 machine, it would go like this:

  • Copy the Agent to the machine
  • Elevate privileges to root or use sudo
  • Install the agent by issuing the “rpm -i NessusAgent-7.5.1-es7.x86_64.rpm” command. You should get the following output:
    warning: NessusAgent-7.5.1-es7.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID 1c0c4a5d: NOKEY
    You must first start Nessus Agent by typing /bin/systemctl start nessusagent.service
    To link this agent to the Nessus Manager, use the ‘/opt/nessus_agent/sbin/nessuscli agent’ command.
    Type ‘/opt/nessus_agent/sbin/nessuscli agent help’ for more info.

Next you need to link Your agent to the Nessus Manager. In order to do that copy the “Linking Key” from Nessus Manager, which can be found at the Agents page in the “Linked Agents” section. After having found the key you can create your linking command on your client. Which is looks something like this:
/opt/nessus_agent/sbin/nessuscli agent lin/opt/nessus_agent/sbin/nessuscli agent link –key=”your-linking-key” –host=”your-nessus-manager-address” –port=8834 –groups=”Web Servers”

After issuing the previous command on the client it should now show up in the linked agents list where You got the linking key from. After having linked the agent to the manager you also need to start the service as was mentioned in the output from the rpm.

It will take a bit of time for the agent to come online. I initially thought something was broken. But it actually took ~5min for the client to go into the “initializing state” for a bitand then again offline. But after being in the initializing state the list started showing some more inf about the client, not only IP address. After that it stay’s offline again for some time, for me it was something like 15-20min and then the host started showing up as online. During that period might as well link the Nessus Manager and Tenable.SC.

Linking Nessus Manager and Tenable.SC goes is the same as with regular Nessus Scanner.

Running your first Agent scan

After having linked Your agents to Nessus Manager and Nessus Manager to Tenable.SC You can now define and run Agent scans.

Unlike how scanning works with Tenable.SC and Nessus Scanner, the agent scan needs to be defined and run on Nessus Manager instead. Tenable.SC only imports the reports actually although the button says run scan.

So you need to log in to Nessus Manager and under scans you should create a new scan. For every scan you need to select a group that the scan gets run on and also the interval if you want it to be a recurring one.

A lot of companies leak internal DNS/information system info to 3rd parties

January 16, 2020 / / 0 Comments

One thing I have noticed while auditing different “internal use only” systems, that are not available online. Is that although they are offline, their existence is freely sent to Google with their URL’s/IP addresses.

Namely a lot of developers tend to integrate something provided by Google or by some other vendor, be it some java script or fonts. As an example when you include some css provided by Google – every time someone loads an internal application, Google gets a request from the clients web browser which also includes the referring URL.
Just example of outbound request headers from a web-page including some style sheet info provided by Google:

host: fonts.googleapis.com
 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
 Accept: text/css,/;q=0.1Accept-Language: en-US,en;q=0.5
 Accept-Encoding: gzip, deflate, br
 Connection: keep-alive
 Referer: https://someportal.corp.inernal/css/main.css

The “referer” header can be easily be harvested from logs. So next time including external resources think about it if you want a 3rd party to know about your internal things.