Configure TLS on Exchange 2010 with own certificate

In this article, I try to describe how to use the certificate signed by own CA to configure TLS on Exchange server 2010. The OpenSSL setting on crlDistributionPoints is very important, without a reachable CRL Distribution Point the certificate will not work (properly) in Exchange. Please read the PDF version for the details.

Juniper SAML and ADFS 2.0

Juniper adds SAML to SSL VPN, however I can hardly find the technical document for how to make it work with MS ADFS 2.0. Luckily I worked it out by myself. Here is the details.

Yet another LDAP Benchmark

It seems this LDAP benchmark (from Novell Cool Solutions) doesn't support LDAPS, so I decided to write my own one.

You can download the project (source code). Please download and install WTL if you want to recompile it.

Note: I added a DDX DDX_COMBO_INDEX, you need to customize atlddx.h. For your convenience, I attached the modified atlddx.h in the project.

Thread Dump Beheaded

Tomcat(Windows version) Thread Dump adds some time info which makes it unloadable with Thread Dump Analyzer (like TDA). I can't figure out the settings(if any) to remove it, so I wrote a small utility - Thread Dump Beheaded, Horror? but it is true, remove the head.

The original thread dump has the following format.

[2012-01-06 11:48:57] [info] Procrun (2.0.6.0) started
[2012-01-06 11:48:57] [info] Running Service...
[2012-01-06 11:48:57] [info] Starting service...
[2012-01-06 11:49:04] [info] Service started in 6921 ms.
[2012-01-09 11:45:11] [info] Console CTRL+BREAK event signaled
[2012-01-09 11:45:11] [info] 2012-01-09 11:45:11
[2012-01-09 11:45:11] [info] Full thread dump Java HotSpot(TM) Server VM (11.2-b01 mixed mode):
[2012-01-09 11:45:11] [info] 
[2012-01-09 11:45:11] [info] "http-8074-44" 
[2012-01-09 11:45:11] [info] daemon 
[2012-01-09 11:45:11] [info] prio=6 tid=0x6c14c800 
[2012-01-09 11:45:11] [info] nid=0x1158 
[2012-01-09 11:45:11] [info] in Object.wait() 
[2012-01-09 11:45:11] [info] [0x715bf000..0x715bfbe8]
[2012-01-09 11:45:11] [info]    java.lang.Thread.State: WAITING (on object monitor)
[2012-01-09 11:45:11] [info]  at java.lang.Object.wait(Native Method)
[2012-01-09 11:45:11] [info]  - waiting on <0x6296a3b0> 
[2012-01-09 11:45:11] [info] (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
[2012-01-09 11:45:11] [info]  at java.lang.Object.wait(Object.java:485)
[2012-01-09 11:45:11] [info]  at org.apache.tomcat.util.net.JIoEndpoint$Worker.await(JIoEndpoint.java:458)
[2012-01-09 11:45:11] [info]  - locked <0x6296a3b0> 
[2012-01-09 11:45:11] [info] (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
[2012-01-09 11:45:11] [info]  at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:484)
[2012-01-09 11:45:12] [info]  at java.lang.Thread.run(Unknown Source)
[2012-01-09 11:45:12] [info] 

After removing head, and organizing the line.

Procrun (2.0.6.0) started
Running Service...
Starting service...
Service started in 6921 ms.
Console CTRL+BREAK event signaled
2012-01-09 11:45:11
Full thread dump Java HotSpot(TM) Server VM (11.2-b01 mixed mode):

"http-8074-44" daemon prio=6 tid=0x6c14c800 nid=0x1158 in Object.wait() [0x715bf000..0x715bfbe8]
   java.lang.Thread.State: WAITING (on object monitor)
 at java.lang.Object.wait(Native Method)
 - waiting on <0x6296a3b0> (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
 at java.lang.Object.wait(Object.java:485)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.await(JIoEndpoint.java:458)
 - locked <0x6296a3b0> (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:484)
 at java.lang.Thread.run(Unknown Source)

This is a Windows console application, so go to Windows Prompt, execute tdbehead tdorginal.log, it will produce a file called tdorginal.bhd which now can be loaded by TDA. You can download the whole project which contains source code, binary and the thread dump sample.

Tomcat CPU Hog Monitoring service

Have you ever been in this kind of trouble? You use Tomcat as the servlet container. In general your web service runs smoothly, however it has CPU hog issue randomly on the production server of your customer. You are told it is not a load issue (CPU is expected high when there is a huge demand for your service, it can only be solved by load balancing) which means your Java coding may have a bug or bad design. The problem is, you are unable to reproduce this issue in your environment, and even your customer can’t reproduce it on purpose.

Anyway, the issue does happen, but no pattern at all. You are under a big pressure to sort it out quickly, what can you do?

Struggled and frustrated? Don’t worry, NanoFish comes to rescue!

Please check this PDF version for the details. You can download the binary and source code, I wish they are helpful.

Test Radius Challenge Response in NTRadPing

If you lack of the Challenge-Response (CR) VPN device, instead you can use NTRadPing to check or show DualShield Radius Server CR feature.

Basically, you need to create a radius logon procedure with two logon steps in DualShield.

With NTRadPing, in the second step, add the State attribute returned from the first step login. Please check the PDF version for the details.

Reset DualShield sa Password

In some situations, you may need to reset sa password. For instance, you forget the sa password of DualShield and have no other administratative accounts to login.

You are stuck, aren't you? Luckily, DualShield recently provided a running mode called safe mode in which you can reset the sa password.

Windows Version

Add -Ddual.safe.mode=true in Java Options which can be shown by "tomcat6w.exe //ES//dualshield"

Linux Version

Edit the file "/etc/init.d/dualshield", add "-Ddual.safe.mode=true \" just below the line "-Djava.io.tmpdir=$TMP_DIR \"

Please check this PDF version for the details.