404 Error Could Be Your DNS Cache

Overview

Your DNS cache stores the locations (IP addresses) of webservers that contain pages which you have recently viewed. If the location of the web server changes before the entry in your DNS cache updates, you will be unable to access the site. If you encounter a large number of HTML 404 error codes, you may need to clear your DNS cache. This will force your local computer to request new DNS information from its assigned nameservers rather than pull previously retrieved information from its local resolver cache.

How To Clear Your DNS Cache

The following methods allow you to remove old and inaccurate DNS information that may result in 404 errors.

Windows 8

1. Press Win+X to open the WinX Menu.
2. Right-click on Command Prompt and select Run as Administrator.
3. Type the following command and press Enter:

   ipconfig /flushdns

Windows 7

1. Click the Start button.
2. Enter cmd in the Start menu search field.
3. Right-click on Command Prompt and select Run as Administrator.
4. Type the following command and press Enter:

   ipconfig /flushdns

Windows XP, 2000, or Vista

1. Click the Start button.
2. On the Start menu, click Run....
3. If you do not see the Run command in Vista, enter run in the Search bar.
4. Type the following command in the Run text box:

   ipconfig /flushdns

MacOS 10.7 and 10.8

1. Click Applications.
2. Click Utilities.
3. Double-click the Terminal application.
4. Type the following command:

   sudo killall -HUP mDNSResponder

MacOS 10.5 and 10.6

1. Click Applications.
2. Click Utilities.
3. Double-click the Terminal application.
4. Type the following command:

   sudo dscacheutil -flushcache

Once you clear your DNS cache, your local computer will query its nameservers and begin using newly changed information.

How to Setup and Configure the SMTP Service for Windows Server 2012

Many applications depend on the internal Windows SMTP Service to relay email confirmations to visitors browsing their web site. When using Windows Server 2012 the SMTP feature must be installed and configured first. Below are the steps for installing the internal Windows SMTP Service.

Install the SMTP Service

1 Launch the Server Manager.

2 From the Dashboard, click on Add Roles and Features to begin the wizard. Click Next on the first screen.

3 Select 'Role-based or feature-based installation'.

4 Select the server.

5 Click Next to bypass the Roles selections.

6 Scroll down the list and tick the 'SMTP Server' feature.

7 A new window will pop up to inform you that some other services will also be installed. Click Add Features to confirm and continue.

8 Click Next to continue past the features selection screen.

9 Click Install to complete the installation.

10 Click Close when the installation has completed.

Configure the SMTP Service

1 Launch the Internet Information Services (IIS) 6.0 Manager.

2 Click Yes to the UAC Prompt.

3 Right-click on SMTP Virtual Server #1 and select Properties.

4 Select the General tab and change the IP Address to the server’s IP address.

5 Select the Access tab and click on the Connection button.

6 In the Connection window, select 'Only the list below' and click the Add button.

7Add the IP address, Group of computers or Domain of the devices permitted to use the internal SMTP, then click OK.

8 In the Access tab of the Connection window, click the Relay button. Add the same permitted devices to the Relay Restrictions list.

9 In the Delivery tab of the Connection window, set an external domain.

10 Launch the Windows Firewall with Advanced Security console.

11 Right-click on 'Inbound Rule' and select 'New Rule' to begin the wizard.

12 Select 'Port' and click Next.

13 Set the local port to 25 and click Next.

14 Choose 'Allow the connection' and click Next.

15 Uncheck 'Public' to prevent external access to the server. Click Next.

16 Give the rule a name, and click Finish.

17 You should now see a new rule enabled in the firewall management console.

18 In the Server Manager, click on Tools and select Services.

19 In the Services window, double-click on 'Simple Mail Transfer Protocol (SMTP)'.

20 Stop and then Start the service. Set the Startup type to Automatic.

20 Click OK to finish. The internal SMTP service is now ready and listening.

---

Remember to add this new SMTP server as a legitimate relay if your mail domain is using (SPF) Sender Policy Framework.

---

How to Prevent RDP Brute Force Attacks

Tech forums and publications are buzzing with news of a tool that enables hackers to attack servers via the Remote Desktop protocol (RDP), a commonly used protocol on remote servers that relies on enabling common ports to access them. These brute force attacks are nothing new, but the frequency of these attacks has sharply increased in recent months and are predicted to continue growing this year.

Understanding the Attacks

A brute force attack on the RDP server allows the attacker to connect. The attacks seem to follow a simple methodology:

• Scan a range of IP addresses.
• Scanner looks for open ports usually used by RDP (e.g. 3389).
• A RDP brute force attack is launched using dictionary terms.

Successful logins by the attacker will give them access to the drives of that server (via the shares \\tsclient\c and \\tsclient\d). This may give the attacker access to the server, potentially including areas usually hidden from the external connection, such as local backups and development areas.

There are no reports of successful breaches yet, so it's unknown what motives are behind the attacks. Similar attacks in the past suggest that infected servers could be used to launch stronger attacks and thus scatter and strengthen itself. However, it could also be used to install other malware or ransomware.

With this type of attack, Windows 2003 servers could also be affected by memory exhaustion which would cause them to reboot. It could also cause Window 2008+ servers to fill their log files. However, this type of attack is not only aimed at Windows servers — it is an IP based attack.

Preventing the Attacks

As with any emerging threat, there are precautions that those running RDP on their servers can take.

• Use strong passwords for your RDP sessions including:
  • One or more special characters such as !@#$%^&*()
  • At least one number, preferably two or more
  • A mix of upper and lower case
  • At least 7 characters in length
  • A non-dictionary word
• Do not use standard usernames (root, admin, owner, test).
• Implement account lockout policy for a set number of failed logins before locking out the account.
• Use an alternative port instead of leaving RDP port 3389 open for anyone to abuse. To change this automatically, use Microsoft Fix It.
• Consider locking the RDP port to a specific IP address.
• On Windows 2008 (and server 2012), enable Network Level Authentication which means the session can not established until the credentials are authorized.
• Ensure you have all the latest patches installed.
• Have a plan to be proactive and scan for potential attacks.
• Limit RDP access to only the accounts that require it.
• If external access is needed, configure a VPN tunnel.

RDP is a great tool used by administrators and users alike to establish multiple connections to a system, but there's a risk if the connections and software aren't secure. Knowing how RDP works, why it’s being used, and what can be done to secure it will help administrators to get a better grasp on server security.

Using the X-Forwarded-For HTTP Module For IIS7

Are you having problems with logging client IP addresses in server logs because your web servers are using proxies or load balancing? This is a common issue with proxies and fortunately there is a solution. The standard for forwarding client information is the HTTP X-Forwarded-For header, which is handled by most proxies.

What is X-Forwarded-For?

The "X-Forwarded-For" HTTP request header is used to allow a proxy server or load balancer to inject the true originating IP address of a client connection into the HTTP request allowing the application server to know the caller's true identity.

The Solution

The version 7.0 release of IIS (Windows Server 2008) introduced the ability to integrate HTTP modules. In comparison to classic ISAPI filters http modules are much more flexible and much easier to integrate with IIS. Joe Pruitt at F5 DevCentral developed a module for IIS7 that extracts the X-Forwarded-For header value and replaces the CIP value (client IP address) that is stored in the server logs.

How to Setup the Module

1. Download the X-Forwarded-For HTTP Module binaries at F5 DevCentral and unpack the archive into the local file system of the web server.
   
2. Create a new sub folder in the file system root (e.g. HttpModules) and add two additional sub folders for x86 and x64. Now copy the .DLL library and the ini.bak file from the unpacked folders into the appropriate folders. Remove the .bak file ending.
   
   *Implement both the x64 version and x86 version of the module. Otherwise, 32-bit applications may crash.
   
   
3. Edit the .ini file to configure the individual http header variable which will contain then IP address of the client and therefore serve as the source for the c-ip value in the IIS log file. In this example X-Cluster-Client-Ip.
   
4. Open the IIS MMC and select the web server node from the configuration tree. Open the Modules settings page.
   
5. Select Configure Native Modules in the Action Pane.
   
6. Click Register and select the file path to the x86 DLL and name the module configuration accordingly. Repeat this step for the x64 version of the DLL.
   
7. Click OK to apply the new module configuration. Sometimes a restart of W3SVC service is required.
   
8. After successful installation the IP address will be stored in the CIP column of the IIS log file.

Free Training for SmarterMail and SmarterTrack

SmarterTools offers FREE weekly training for new and existing customers that covers tasks such as installing products, first-time set up of products, complete walkthroughs of the concepts and ideas behind how a product works and more. SmarterTools offers separate training for both SmarterMail and SmarterTrack that benefit customers who install their own versions of these products or who use the hosted version of SmarterTrack.com.

SmarterMail Training

This training will cover the basic installation and configuration of your new mail server. Items covered include:

• General system requirements and installation
• Initial set-up and configuration
• Adding a domain, then users to that domain
• Sending and receiving an email
• Anti-spam and anti-virus options
• General feature discussion
• Overview of licensed add-ons

SmarterTrack Training

This training will help with how SmarterTrack can be installed, configured and how communication flows through it. Items covered include:

• General system requirements and installation
• Initial set-up and configuration
• General helpdesk concepts
• Setting up a Department, Group and Employee
• Adding Employees to Groups
• Following a Ticket through SmarterTrack
• General feature discussion

For training schedules and more information, visit the SmarterTraining web page (http://www.smartertools.com/support/smartertools-training.aspx).