Hot answers tagged

15

You need to provide the entire certificate chain in order for it to show up as trusted. Here's the link I got for comodo's instructions on installing the cert chain in apache: https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/637/37/certificate-installation-apache--mod_ssl I got this from ...


9

UPDATED (again) The short answer to your question is NO. Outlook/Exchange clients either are capable or aren't capable of Remote-wipe. The Exchange policy simply expects that they support that feature.. If the phone supports Remote-wipe and you've accepted the policy (by being a so-called "Provisional Device"), then Exchange may send a request to wipe ...


9

Per RFC952, hostnames are: A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.). Note that periods are only allowed when they serve to delimit components of "domain style names". Microsoft in the usual "Embrace, Extend and ...


8

Encryption will never be "seamless" - particularly in a mixed environment. Similarly the idea that you'll be able to get outside agencies to adhere to your encryption policy is a noble goal, but may be difficult in practice (My company has been trying to get this to happen since before I came here. Some outside personnel are simply not going to be able to ...


5

This is pretty similar to how to disable remote wipe for Exchange 2010 ActiveSync? The short answer is - No. Android will prompt for those permissions regardless of whether Exchange's ActiveSync policies specifically allow or deny Exchange's ability to do those actions. As far as I can tell, Android's ActiveSync apps have to require that you approve all ...


5

Take a look at your DHCP server, are you supplying the option for a search suffix to your scopes?


5

Here's a fairly straight forward L2TP/IPSEC tutorial, but I don't think iphone can use certs, so you will have to go PSK. It also gets into domain authentication, so your users only have to remember one set of credentials. That is, if you have a domain... ...


4

The aforementioned NitroDesk TouchDown should do the job, but HTC and possibly other Android phones have the ability to sync onboard already. Setting up can be a little tricky, but here is a massive tip that will almost certainly help you get it working: use https://www.testexchangeconnectivity.com/ to test for ActiveSync connectivity, if it fails it often ...


4

AWS will work for what you intend without any problem, things to be aware though of an EC2 implementation You'll lose CPU cycles when the underlying node is under high load, be ready for your machines to sometimes not deliver enough CPU juice Disk I/O will be a bit slower than a regular machine Apart from that Openfire does have a clustering solution, ...


4

man tcp - look for tcp_retries[1,2] for Linux machines. I have no idea what to do for Android and given Apples attitude to system-level tweaking there is probably absolutely no way to do this on iOS except when you jailbreak. TCP socket timeouts put aside, most applications will implement their own timeouts which are probably considerably shorter than the ...


4

It's not possible. The way to solve this problem is with a layer on top of the TCP layer that provides the semantics you need. This layer would have to add an identifier to each message, implement message acknowledgements, re-establish the TCP connection if it broken, and re-send all unacknowledged messages.


4

AirWatch has an MS Exchange client for iOS and Android. They support encryption and have a number of other security features as well. http://www.air-watch.com/solutions/apple-ios


4

Well it has to be 1 of 3 things. Something changed in the AD account, something changed in the Exchange account or something changed on the phone itself. Can you enable debugging on the phone to ascertain why exactly the phone is throwing an error. Follow these steps to enable debugging: 1. On the android phone go to menu -> email. You will need to have ...


4

Erik Fair has answered this extensively over at Quora: The keyboard of the Teletype (TTY) ASR-33 (a very common terminal interface of the period from whence this standard hails) doesn't have underscore on it: http://www.pdp8.net/asr33/pics/k... which gives one a nasty problem: how do you type (input) a hostname if the hostname in question ...


4

To configure XAuth PSK with strongSwan 5.0.x (as responder) you have to use: leftauth=psk rightauth=psk rightauth2=xauth While deprecated authby=xauthpsk would actually still work as an alias for the above (with xauth=server also added). can not load config '/etc/ipsec.conf': /etc/ipsec.conf:25: syntax error, unexpected STRING [leftauth] ...


4

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted. ...


3

You have a number of options: Run the SSH server on port 80 or 443. Run a tunnel on the SSH server to listen on port 443 or 80 and forward it to 22. Run a VPN on port 80/443. Essentially, something on the server you're trying to connect to needs to be listening on port 443/80 in order for you to connect to it. The other solution is to talk to the ...


3

You should configure your web server to not only use the certificate you were issued but to also provide the CA's intermediate certificates. I suspect that you have not properly configured it to serve the intermediate certificates provided by your CA. Failure to do so will lead to inconsistent behavior. For modern Apache httpd versions (>=2.4.8) you would ...


3

It's not abnormal. I had this discussion before with someone building custom Android distros. You will need a lot more memory than 8 GB. IIRC they used a 32 GB ram machine.


3

You'll need to take a few steps here. First may well be user education. Explain to your users that email is like writing on a postcard, anyone along the way can see the message. You'll want to find a PGP (GPG) client that integrates with each mail client in use on your network. Start with the most widely used client. I'd guess that is Outlook so take a ...


3

Microsoft Windows does not prohibit the underscore in the name of a computer. Some system administrators, either not knowing or not caring about RFC952, use underscores in the name of a computer that is connected to the internet, and either put this name in the DNS explicitly or allow it to be published via dynamic DNS. There's nothing particularly strange ...


3

No-one's voted to close, so I'll make my comment into an answer: Why not run the check-out on the devices? Since you write apps, write one that locks the device until a user logs in. I wouldn't think it needs to be very secure, since it's being used in-house. To check a device out, the user simply takes it, logs in, and the app can transmit the fact that ...


3

I've got an HTC Touch Pro (Windows Mobile OS), and it will pass the MicroSD through as a USB disk. I can boot off it, though I haven't tried Linux I don't see why it would be that much different.


2

I have a Motorola droid that I use as a bootable AV disk. Mine acted just fine as a usb stick, however I have seen it not work on other phones. I know that the samsung galaxy S was having problems acting as a mass storage device on windows 7 64 bit, I needed to find a driver for it. However I have not tried booting to the samsung.


2

Local copies of emails are NOT encrypted, however it does use ssl to send and receive from the exchange server. Also as PMGoldstein said it allows you to wipe devices remotely. Here is a link to the current issue on the android request board for this feature, it states that it is currently not available in Froyo 2.2. I have also personally tested if data on ...


2

You can create any number of ActiveSync policies (with different settings) and apply those policies to different sets of users. My opinion is that if these devices are personal devices then you probably shouldn't force a password policy on them, but you need to determine the risk/response regarding company email on the devices if they're lost or stolen. If ...


2

This is my list of must have android apps for sysadmins: connectbot SSH client beem XMPP (Jabber) client PocketCloud RDP/VNC Client Linux & Unix Commands Zabbix on the go (Client for Zabbix Monitoring Solution) nagroid (Nagios Client) FBReaderJ (e-book reader) Net Tools (handle ping, check port 80, dns / IP lookup, HTTP header download, netstat)


2

This is my list: http://frederikkonietzny.de/wp/2010/12/10/android-applications-for-sysadmins/


2

Since Android v2.0 you can log into multiple Google accounts on your Android phone. So, if your friend's phone uses Android 2.0+ he can simply add a new account (his Google Apps one) to the calendar application (assuming he currently uses his personal account for the phone). I myself have my personal and Google Apps calendars synced to my phone and ...


2

I believe this is actually forced from the Droid side, not from your Exchange server and is a part of the mobile OS by design. The good news is that it's a terrific security practice and should be used by most people. I'm sure however that doesn't satisfy your needs. One alternative is to not use the embedded exchange client, but an alternative such as ...



Only top voted, non community-wiki answers of a minimum length are eligible