TVersity/Websphere Security

Working on my basement & trying to get the XBOX 360 as a usable media viewing platform for my wife. My goal is to have it be the central point of her living room, as I'm moving my main HTPC downstairs with me. :D I have my 500 movie collection ripped to a couple TB drives and encoded in various different formats. Since I don't want to re-rip them all to supported 360 formats (UGH! http://blogs.msdn.com/xboxteam/default.aspx) I've been looking into TVersity. (www.tversity.com) I'm trying to get it up and running on my dedicated server. Here are a couple tech notes that pertain to getting this to work:

-As they state, disable SSDP and UPNP services inherent to Win2k8. The software has it's own UPNP code.
-If you have a multi homed box, make sure you use whatever interface your machine likes to dish out in ARP communications. This one is kinda odd.... I haven't figured out all the details yet, but my server makes ARP requests and dishes out the IP of it's secondary interface to communicate. I had to bind the TVersity server service to that IP specifically to get clients to connect reliably. Had to use wireshark to figure this one out.
-Your server needs a soundcard to build the graph to transcode videos. I believe this to be a OS limitation, as it uses the native windows codec priority to build graphs, and you can't build a transcoding graph without an audio out pin. This is disappointing, as the only sound card I have lying around is a creative card and I REALLY don't want to install a creative labs sound card on a server due to YEARS OLD DRIVER ISSUES CREATIVE IS HORRIBLE GAH WHY DO I STILL BUY THEIR PRODUCTS SOMETHING IS WRONG WITH MY BRAIN.... sorry that just spilled out.

Enough of that. From a more professional perspective, I've been trying to get real keystores working throughout an implementation of Websphere 6.0.2.x ND Application Server(s). After much trial and error, let me make the following recommendations as to how to pursue this:

1. Do Not: make a new repitoire. This is unfortunate, but IBM's implementation of repitoire management is lacking at best, horrible and unworkable at worst. Even if you go through the trouble to change all web container referance points to the new keys, you will still have to scour other config files manually (mainly server.xml files) to replace references. This is obviously prone to error. I reccomend instead replacing the default keystores and truststores (under websphere\appserver\profiles\\etc\dummy*.jks with your real keys.
2. Do: change the password on the default keystore after you update it. This won't cause issues with two exceptions... you will have to update the passwords in \websphere\appserver\profiles\\properties\sas.client.props and soap.client.props with the new passwords. Make sure to encrypt the files after you do so using IBM's encryption script.
3. Do: delete ALL "dummy" keys and expired certs from all stores. No reason to keep them, it's just a security risk.
4. Do: update the plugin keystore if you use a web server front-end. You just need to make sure that the keystore/truststore (this one should be shared) has your issuing CA chain. Note that this keystore is in CMS format and you'll need to use the GSK7 version of ikeyman to update it. If it doesn't launch properly make sure you have JAVA_HOME set to \websphere\appserver\java\ .

Anyhow, I'm going to try to update this more regularly (and my failure to do so will be for all to see...) to have a repository for "gotcha" info I haven't been able to find anywhere else on the internet. This will serve two purposes: 1. We go through so much I can't seem to remember this stuff later, so I'll have documentation of it... 2. Hopefully others will stumble across this info and find it useful since I haven't found it anywhere else.

On the music font, Coheed and Cambria is amazing. I can't stop listening to their 2k5 album release.

Ping!

pong.

This looks cool in concept but is coded very poorly and utterly unsupported. Damn. http://www.arfx.nl/ It would be great if the developer took it seriously.

See you in 3 months or so. :D

Using server Core as a domin controller

A couple quick notes:

1. Core obviously doesn't have a GUI, so your dcpromo wizard is gone. The easiest way to circumvent this is by using an unattended file. See: http://www.petri.co.il/creating-unattend-installation-file-dcpromo-windows-server-2008.htm

2. Set all interfaces to static addresses (IPv6 included! P.S. Stay tuned for a bunch of IPv6 setup info) using the netsh command. http://www.petri.co.il/configuring-windows-server-2008-networking-settings.htm and http://technet.microsoft.com/en-us/library/bb878102.aspx

Here's a big catch that really disappointed me: when creating an unattend.txt file for dcpromo purposes, you CANNOT use an already existing DC! What the hell?! It would stand to reason that the smartest approach Msft could take on this would be to allow you to create a file from a already installed and tweaked server, but as it stands that's not possible. The only chance you get to create an unattend.txt file is right at the end of the initial DCPromo. That being said, even if you aren't sure about your DCPromo setup on a non-core machine, utilize the "Export Settings" anyhow. At least then you'll have a baseline to start from and you won't have to do the whole thing from scratch like me. Yuck.

Hyper-V, HyperV, HyperADD, whatever

So, after the Microsoft "Heroes Happen Here" launch event, I'm playing around with my copies of software. I've got all new hardware for a dedicated HyperV machine as my main lab setup and I'm experimenting with setting up a new infrastructure with PKI, IPSec, AD Services, Exchange, etc.

Here are some Hyper-V specific notes:

- Emulated hosts are SLOW. Holy cow! I can't believe how slow hosts are on this platform before installing the Integration Services (VMware addons equiv.) It is BY FAR slower than VMWare ESX, VMWare Server, or Virtual Server 2005R2 without the addons. After installation the performance is great, but it took me hours to get a 2003 host setup and patched before that installation, since the minimum requirements are somewhat steep for the guest OS to support the IS software. This is disappointing.

- Can't boot from emulated SCSI, only emulated IDE. I have links about this, I'll post 'em later.

- Most annoying "quirk" sofar: When you create a fixed size disk, which is what I prefer to do for performance reasons, all related activity on that set of drives STOPS. Guests that rely on that drive set will nearly lock up until the completion of the disk is completed. This is byfar the most annoying thing I've seen sofar. It's not a low performance I/O setup I've got here; An adaptec 3405 SAS/SATA RAID card with 4x WD 5000KCS drives in a RAID 5EE array. I realize it's not enterprise class, but it should be well enough to do two things at once. The creation routine for the fixed disk is far to agressive with I/O in my opinion.

This whole post is a touch light on details. I'll add more later.

Edit: Add..

Another annoying quirk; Since the addons that shipped with Win2k8 were a beta, the RC0 addons are not fully compatible. Because of that, they don't work until you manually update them with this update: http://www.microsoft.com/downloads/details.aspx?FamilyId=DDD94DDA-9D31-4E6D-88A0-1939DE3E9898&displaylang=en

hello world

This is probably the 1 millionth blog opened with the title "hello world". I'm super creative like that.

I plan on using this space as a sounding board for technologies I'm working with, including notes and "gotchas" in the process. My sole purpose is to "give back" to the blogging "community" that has been so helpful in my pursuit of eventual free time through completed work. As you can see, as well, I am also here to glorify the "quote".

A small bit about me: I'm currently an Apps Engineer for one of the largest banks in the world, (Just a touch paranoid about giving out my employer details on a blog) and I work mainly with middle tier software solutions to facilitate relatively simple technical solutions for relatively complex business problems. If you like you can check out my LinkedIn profile for more details: http://www.linkedin.com/in/tobymeyer

I also help out at TopDogPC (www.topdogpc.com) in my spare time, a local St. Paul based network services company. They specialize in Managed Services and business solutions (voip, exchange, etc.) for small to medium size companies.

I have been a "Microsoft guy" the majority of my life, (Windows, IIS, SQL, Exchange, Biztalk) but I'm by no means an evangelist. I sway in that direction when I evaluate solutions simply because it's where I have the most experience, but I've also engineered end to end solutions using alternative solutions. ( Linux, Websphere, Apache, etc.) To entertain myself I maintain a mach network @ home, and most of the things I'll probably blog about will be my experience working with the technologies I experiment with there. To add some credibility to that statement by the way, substute "home" with "lab".

And yes, I have the "lab" to impress the ladies. Har har har.