Juniper SAML and ADFS 2.0

Juniper adds SAML to SSL VPN, however I can hardly find the technical document for how to make it work with MS ADFS 2.0. Luckily I worked it out by myself. Here is the details.

Yet another LDAP Benchmark

It seems this LDAP benchmark (from Novell Cool Solutions) doesn't support LDAPS, so I decided to write my own one.

You can download the project (source code). Please download and install WTL if you want to recompile it.

Note: I added a DDX DDX_COMBO_INDEX, you need to customize atlddx.h. For your convenience, I attached the modified atlddx.h in the project.

Thread Dump Beheaded

Tomcat(Windows version) Thread Dump adds some time info which makes it unloadable with Thread Dump Analyzer (like TDA). I can't figure out the settings(if any) to remove it, so I wrote a small utility - Thread Dump Beheaded, Horror? but it is true, remove the head.

The original thread dump has the following format.

[2012-01-06 11:48:57] [info] Procrun (2.0.6.0) started
[2012-01-06 11:48:57] [info] Running Service...
[2012-01-06 11:48:57] [info] Starting service...
[2012-01-06 11:49:04] [info] Service started in 6921 ms.
[2012-01-09 11:45:11] [info] Console CTRL+BREAK event signaled
[2012-01-09 11:45:11] [info] 2012-01-09 11:45:11
[2012-01-09 11:45:11] [info] Full thread dump Java HotSpot(TM) Server VM (11.2-b01 mixed mode):
[2012-01-09 11:45:11] [info] 
[2012-01-09 11:45:11] [info] "http-8074-44" 
[2012-01-09 11:45:11] [info] daemon 
[2012-01-09 11:45:11] [info] prio=6 tid=0x6c14c800 
[2012-01-09 11:45:11] [info] nid=0x1158 
[2012-01-09 11:45:11] [info] in Object.wait() 
[2012-01-09 11:45:11] [info] [0x715bf000..0x715bfbe8]
[2012-01-09 11:45:11] [info]    java.lang.Thread.State: WAITING (on object monitor)
[2012-01-09 11:45:11] [info]  at java.lang.Object.wait(Native Method)
[2012-01-09 11:45:11] [info]  - waiting on <0x6296a3b0> 
[2012-01-09 11:45:11] [info] (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
[2012-01-09 11:45:11] [info]  at java.lang.Object.wait(Object.java:485)
[2012-01-09 11:45:11] [info]  at org.apache.tomcat.util.net.JIoEndpoint$Worker.await(JIoEndpoint.java:458)
[2012-01-09 11:45:11] [info]  - locked <0x6296a3b0> 
[2012-01-09 11:45:11] [info] (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
[2012-01-09 11:45:11] [info]  at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:484)
[2012-01-09 11:45:12] [info]  at java.lang.Thread.run(Unknown Source)
[2012-01-09 11:45:12] [info] 

After removing head, and organizing the line.

Procrun (2.0.6.0) started
Running Service...
Starting service...
Service started in 6921 ms.
Console CTRL+BREAK event signaled
2012-01-09 11:45:11
Full thread dump Java HotSpot(TM) Server VM (11.2-b01 mixed mode):

"http-8074-44" daemon prio=6 tid=0x6c14c800 nid=0x1158 in Object.wait() [0x715bf000..0x715bfbe8]
   java.lang.Thread.State: WAITING (on object monitor)
 at java.lang.Object.wait(Native Method)
 - waiting on <0x6296a3b0> (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
 at java.lang.Object.wait(Object.java:485)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.await(JIoEndpoint.java:458)
 - locked <0x6296a3b0> (a org.apache.tomcat.util.net.JIoEndpoint$Worker)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:484)
 at java.lang.Thread.run(Unknown Source)

This is a Windows console application, so go to Windows Prompt, execute tdbehead tdorginal.log, it will produce a file called tdorginal.bhd which now can be loaded by TDA. You can download the whole project which contains source code, binary and the thread dump sample.

Tomcat CPU Hog Monitoring service

Have you ever been in this kind of trouble? You use Tomcat as the servlet container. In general your web service runs smoothly, however it has CPU hog issue randomly on the production server of your customer. You are told it is not a load issue (CPU is expected high when there is a huge demand for your service, it can only be solved by load balancing) which means your Java coding may have a bug or bad design. The problem is, you are unable to reproduce this issue in your environment, and even your customer can’t reproduce it on purpose.

Anyway, the issue does happen, but no pattern at all. You are under a big pressure to sort it out quickly, what can you do?

Struggled and frustrated? Don’t worry, NanoFish comes to rescue!

Please check this PDF version for the details. You can download the binary and source code, I wish they are helpful.

Test Radius Challenge Response in NTRadPing

If you lack of the Challenge-Response (CR) VPN device, instead you can use NTRadPing to check or show DualShield Radius Server CR feature.

Basically, you need to create a radius logon procedure with two logon steps in DualShield.

With NTRadPing, in the second step, add the State attribute returned from the first step login. Please check the PDF version for the details.

Reset DualShield sa Password

In some situations, you may need to reset sa password. For instance, you forget the sa password of DualShield and have no other administratative accounts to login.

You are stuck, aren't you? Luckily, DualShield recently provided a running mode called safe mode in which you can reset the sa password.

Windows Version

Add -Ddual.safe.mode=true in Java Options which can be shown by "tomcat6w.exe //ES//dualshield"

Linux Version

Edit the file "/etc/init.d/dualshield", add "-Ddual.safe.mode=true \" just below the line "-Djava.io.tmpdir=$TMP_DIR \"

Please check this PDF version for the details.

WinDBG remote debugging with SSH port forwarding

When I tried to apply my “tunnel” onto Java remote debugging, I found someone got a better approach – SSH port forwarding.

It is very cool, so I’d like to try it on WinDBG.

If the machine with public IP has Linux OS installed, it is very easy to start a SSH daemon. However I got one machine which has windows 2003 installed, so I have to find a Windows version sshd (SSH deamon). I think that freeSSHd is the best one among the free editions.

As the port 22 (default SSH port) on my server is taken by another process, I use 9000 instead, and listen on “All interfaces”. Next, go to the tab “Tunnelling”, check on both “local port forwarding” option and “remote port forwarding”.

We are going to use WinDBG to do the remote debugging, certainly it is done on Windows system, so we need a windows version SSH client. I prefer a CLI version of SSH client, so I choose plink.exe (from the popular putty site).

Which parameters do we need in the SSH client? If you are new to SSH, please have a look of the hyperlinks in this document. However, I believe it is much easier to understand them with an example, so let’s give the instructions first.

On the client machine where the application you want to debug is running on, run debugger server (dbgsrv.exe), specify the port as 1012 (you can use any free one).

dbgsrv –t tcp:port=1012

Check the tab Processes in Task Manager to make sure the debug server is running. Also, open a notepad as the application we are going to debug.

Next, on the same client machine, run

plink –P 9000 -R 9001:localhost:1012 nanoart@sshserver -N

Or, you can run the following command on the relay machine instead.

plink –P 9000 -R 9001:[ip of client machine]:1012 nanoart@sshserver -N

This is very useful when you are debugging GINA or credential provider which prevent you running a user-mode application.

At this stage, we’d better to have some explanations on the plink command.

The parameter -R specifies a remote port forwarding. It asks SSH server to start a listener process on the remote machine (SSH server) with port 9001. Thus the remote machine can accept connections and forwarding them back over SSH back to the machine that started the SSH port forward session, and then from there onto the client machine. Because my SSH sever is not running on the default port 22, I have to specify it with the parameter –P. The last parameter –N means “don't start a shell/command”, this is optional. Of course, you need to provide a SSH login account (“nanoart” in this example).

On developer’s machine, run this command,

plink –P 9000 -L 1012:localhost:9001 nanoart@sshserver –N

The parameter -L means local port forwarding. It results in a process listening on a port (here 1012) on the developer’s machine . This process/port will accept connections and forward them via the remote authenticated SSH (sshd) process to another host:port combination (here it is localhost:9001).

Note: The localhost might appear at first sight a little confusing, but don't forget host:port pair is relative to SSH server in local port forwarding. If localhost is used, it is the SSH server itself. However it is relative to the initiating end of this SSH connection, i.e. the workstation in the case of remote port forwarding.

Now, the route is tunnelled between the developer’s machine and the client’s machine.

On the developer’s machine, we can run

windbg –premote tcp:port=1012, server=localhost

It is worth mentioning that you may need to switch the order of port forwarding (first local port forwarding, then remote port forwarding), otherwise it may not work if you are using the freeSSHd as the SSH server.

In WinDBG, we can see all the processes of the client’s machine at the remote site.

Also, we can attach to the sample process “notepad.exe”.

Bravo, the remote debugging with SSH port forwarding succeeded! Finally I can forget the dbengprx.exe issue.

Please read the full version which has some figures to help you understand it easily.