I have a program on my computer that runs as SYSTEM and it is trying to launch an exe(opc server) on a remote machine x.x.x.x. But I get a DCOM error in my machine's eventviewer.
DCOM got error "2147942405" from the computer x.x.x.x when attempting to activate the server: yyyyy
I followed almost all the suggestions on the internet about opening dcomcnfg and adding users limits.default for launch and activation and Everyone,system,interactive,network from link (ftp://ftp.softing.com/pub/outgoing/opc/DCOM/DCOM-Settings-en.pdf) but nothing works.
Would anybody have nay other ideas on how to make this work.
According to MS Technet:
https://social.technet.microsoft.com/Forums/Azure/en-US/8bb5807f-73ba-4092-abc8-283d8fced6c4/request-a-certificate-from-certificate-service-fails-dcom-error-2147942405?forum=winserversecurity
With my VERY limited understanding of Certificate servers you may have one of the scenarios:
Client PC's are trying to connect to a Certificate server that no longer exists
Client PC's have a certificate that is valid but the Certificate server no longer exists
A Certificate server is broken
Clients do not have the proper authority to request the Certificate
I say this is limited knowledge as I am currently trying to remove AD Certificate services from a Domain Controller and I can see that in the System event log the exact same messages are being logged as I have stopped the Certificate services to asses the impact. If I get further information I will post back.
Related
I'm trying to run AutoSSL to renew or issue a new SSL certificate on my domain. When I run it however I get the following issues on my domain.
I'm running cPanel 106.0.4 and i've tried re-installing both litespeed and cPanel itself. I'm also running CPhulk and ConfigServer Security & Firewall - csf v14.17
I try and delete the .well-known directory and AutoSSL recreates the pki=validation folders in the correct location /home/domain/public_html/.well-known/pki-validation/
I've tried rebuilding IP Address pools, pinging the domain locally to check the IP Address resolves correctly from the server to the server itself, rebuilding the Zone file for the domain.
1:04:07 PM Performing HTTP DCV (Domain Control Validation) on 31 domains …
1:04:07 PM WARN Local HTTP DCV error (mydomain.co.uk): The system queried for a temporary file at “http://mydomain.co.uk/.well-known/pki-validation/45DE0ED1146497E5E2019A467A25C8D6.txt”, but the web server responded with the following error: 404 (Not Found). A DNS (Domain Name System) or web server misconfiguration may exist.
What am i missing here?
Thanks
UPDATE 1
When I pull up http://mydomain.co.uk/.well-known/pki-validation/ I seem to get a different set of files than when I look up the https 443 version https://mydomain.co.uk/.well-known/pki-validation/ however this occurs on multiple devices and browsers implying its a server side caching issue perhaps?
I've been having a lot of problem to make my target setup work: hosting a headless server on GoogleCloudService, that webGL clients hosted on a platform like itch.io could connect to. I'm using Mirror and its SimpleWebTransport for connecting.
The server runs fine, and I can connect from my local server browser when SimpleWebTransport's "use WSS" and "use SSL" bools are off.
When uploading the build and running the client through itch.io tho, it's giving an error saying it needs to use WSS to connect.So I re-uploaded everything with the WSS and SSL options ticked on the SimpleWebTransport. I've also followed a guide to activate a load balancer and make an instance group so I could have a google-managed SSL certificate produced.
Now trying to connect this way gives me a new error (cf attachement).
What could I be missing setup wise? I see in the SimpleWebtransport there's a field for a path to the certificate, should I be using it and how? I do see the following error in my server's console:
FileNotFoundException: Could not find file "/home/saturn_slides_gmail_com/cert.json"
Also, is it ok that i'm using port 7778 in Mirrors' setup as well as in GCS's instance group settings? Or should i be using some other ports.
thank you !
We are in the process of turning off NTLM in our environment for both inbound and outbound traffic via GPO. In our lab testing we have encountered the following when blocking inbound NTLM on a remote host:
RDP'ing to the remote host with inbound NTLM blocked via cross-forest generated a CredSSP error message.
Setting Encryption Oracle Remediation to either Mitigated or Vulnerable as a workaround did not work.
Turning off NLA on the remote host as a workaround will allow cross-forest RDP
I have tried applying "Allow delegating fresh credentials" via policy on the remote host but it is still getting the CredSSP error
I have also tried setting the policy on the remote host to use SSL for "Require use of specific security layer for remote (RDP) connections", and I still got the same CredSSP error.
What did work is if I try to RDP from the same forest to the remote host, it will allow the connection and I can confirm it is using Kerberos for RDP instead of NTLM.
Another observation is once the same forest RDP worked on the remote host, cross-forest RDP connection on the remote host with the blocked inbound NTLM will now work.
Has anyone encountered something similar like this before?
If so, has anyone found a solution for cross-forest RDP to work on a remote host with blocked inbound NTLM without the need to pre-auth on the remote host in the same forest?
The Encryption Oracle Remediation error is a red herring because it uses the same error code as the NTLM is not available error. Unless you haven't patched in 3 years it'll likely never be the Encryption Oracle Remediation issue. It's really just that it tried to fallback to NTLM and policy said no.
In all likelihood the issue is that the client can't find or communicate with a domain controller to do NLA.
The client must find the user's domain first (domain A). From there it authenticates their password. It then asks to get a ticket to the machine. The machine isn't in the user's domain so it creates a referral ticket to where it thinks the machine is (domain B).
The referral is handed back to the client and the client tries to find a DC to where the referral is supposed to go (domain B). The client sends the referral to domain B and asks for a ticket to the machine. The domain controller either finds the machine and issues a ticket for it, or says it doesn't know and offers a referral to another domain (domain C) and you try again, or it just fails saying no machine can be found.
All of this occurs from the client's perspective, not the target machine's perspective. This happens before the client even pings the target machine (ish). This is why disabling NLA appears to resolve the issue.
So there are a handful of reasons why this happens:
You used an IP address -- this is a straight-to-NTLM scenario. Kerberos doens't do IP addresses by default. You can turn it on, but it won't scale.
Client can't communicate with a DC in user's domain (domain A). Networking issue, client needs line of sight to domain controller, plus DNS.
Client can't communicate a with DC in the target machine's domain (domain B). Still a networking issue, client needs line of sight to domain controller, plus DNS.
You're not providing a proper fully qualified name and the user's DC can't figure out what forest it should refer to. You can enable Forest Search Order and it'll maybe help, or you can type in the fully qualified machine name.
This isn't an exhaustive list but these are the most common causes.
References:
https://syfuhs.net/windows-and-domain-trusts
https://syfuhs.net/how-authentication-works-when-you-use-remote-desktop
I also had a similar issue when using the DOMAIN\username login ; using the UPN (username#domaine.com) worked for me.
My understanding is using the UPN allows the client to know the DNS domain name, which then allows it to discover the DC of the remote domain through DNS resolution.
NB : my setup was from a workgroup server so not exactly the same as yours; YMMV.
I am installing a program for a client which sends outgoing mail only using SMTP on port 25. Normally, the executable file runs as a service, but the initial mail test was failing, so I tried running the program manually (by double clicking the .exe file), which worked (outgoing mail sent successfully).
The service is running as the current user, who is a local admin (we have also tried running as local system account and computer administrator). We have tried with Windows Firewall turned off on the local computer, with the same results. We are coordinating with their tech support to see if they can find out why their mail server is behaving this way, but are not sure if they'll find anything as it seems like an obscure error.
Does anyone know why the port would allow a connection from the executable when run manually, but not when the executable is run as a service under the same user?
This is the error message the service is showing:
Error Descrip: Mail settings could not be validated.
Details:Connection to SMTP server: FAILEDTest failed (see details below).
-----------------------------Reason for failure: -> Socket read timeout-> Failed to get initial response-> The SMTP server may be denying access for this domain.-----------------------------
Error details: <?xml version="1.0" encoding="utf-8" standalone="yes" ?><ChilkatLog><VerifySmtpConnection>
<info>Checking connectivity to SMTP server mail.<server>.com:25</info> <smtp_host>mail.<server>.com</smtp_host>
<smtp_port>25</smtp_port>
<timeoutMS>10000</timeoutMS>
<error>Socket read timeout</error>
<error>Failed to get initial response</error>
<error>The SMTP server may be denying access for this domain.</error></VerifySmtpConnection></ChilkatLog>
This is not my area of expertise. What can I try next?
I've recently purchased a cloud server which has public IP and I am using it to host an xmpp server.
My first task was to ensure my users connected using my subdomain - as an example m.chat.com.
In my configuration I have the following:
%% Hostname
{hosts, ["m.chat.com"]}.
I then created an admin user with that domain.
In parrellel I have created the following DNS record with my host provider, hostgator for my subdomain m.chat.com
Name TTL Class Type Record
m.chat.com 14400 IN A [IP of the server]
One thing that puzzled me was my ability to access the ejabberd web admin console. This was achieved via: [IP of the server]:5280/admin however I could not access it via m.chat.com:5280/admin
That aside, inside the web console, under "Virtual Hosts" I could see the host "m.chat.com". I created a user "user#m.chat.com" and tried to connect via Adium.
Inside Adium, simply typing in user#m.chat.com with the password did not work. Instead I had to also specify the "Connect server" which in this case was the [IP of the server].
It has connected fine and I have registered other users to check everything is working and it is.
Then I thought I'd go back to the ejabberd configuration and start messing around. I changed the hostname to the following:
%% Hostname
{hosts, ["m.chat.com", "facebook.com"]}.
I registered a user with that domain and restarted ejabberd. Upon checking the web console, to my surprise, I could see the Virtual host "facebook.com". I tested this user in Adium with the [IP of the server] defined in the "Connect server" section and it connected fine. I asked other people with their own internet connections to use this account on their PCs and they were able to connect too.
Story over - my question to everyone is how is this possible? Am I missing something? Is there no domain authentication. After searching online, it seems you can even use fake domains.
If I am to operate my own service in the future (iOS chat app) I do not want anyone using my domain names with their own public servers.
Can someone shine some light.
Thanks!
Edit: A second question - Preferably I do not want to have to define the "Connect Server" upon using a client. I would like the client to recognise the #m.chat.com domain and establish a connection to the Servers IP automatically. Have I configured my DNS record correctly? For anyone else using Hostgator, is there an additional task I must do?
Edit: I can now access the web console via m.chat.com:5280/admin and I no longer have to specify the Connect server when using a client. I didnt do anything, I think it was a case of Hostgater updating the DNS or something, they say it usually takes 4 hours. However I am still slightly puzzled as to why I can create accounts with the facebook.com domain. I understand that because I can not access the DNS admin for this domain I can not create any records but that does not prevent me from using the domain and just specifying a Connect server.
Your initial problems (unable to access the server by using m.chat.com) were almost certainly DNS issues, and it seems you have isolated that down to the time taken to update the record.
Your second question - about the fact that you can name virtual hosts without restriction, is simple but interesting. What makes you think there should be any kind of restriction? It would be like you dictating that I can't save "m.chat.com" in a file on my disk, or that I can't send "m.chat.com" in a message across the internet.
This is why DNS exists and is structured the way it is. Although I can tell my server that it hosts facebook.com, nobody will connect to it because the DNS record for facebook.com does not point at my server (users generally don't set the "connect host" manually). Which begs the question... why would I want to tell my server it hosts facebook.com, and if I did, why should Facebook care?
An additional, but relevant, identity layer on top of DNS are certificates - which clients should validate for the virtual host name in spite of any "connect host" set. Since it's not possible to have a certificate for facebook.com, clients should generally pop up warnings or fail to connect at all. If they don't, they're probably not validating the certificate correctly.