Tag Info

Hot answers tagged

11

You need to provide the entire certificate chain in order for it to show up as trusted. Here's the link I got for comodo's instructions on installing the cert chain in apache: https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/637/37/certificate-installation-apache--mod_ssl I got this from ...


9

Per RFC952, hostnames are: A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.). Note that periods are only allowed when they serve to delimit components of "domain style names". Microsoft in the usual "Embrace, Extend and ...


8

Encryption will never be "seamless" - particularly in a mixed environment. Similarly the idea that you'll be able to get outside agencies to adhere to your encryption policy is a noble goal, but may be difficult in practice (My company has been trying to get this to happen since before I came here. Some outside personnel are simply not going to be able to ...


8

UPDATED (again) The short answer to your question is NO. Outlook/Exchange clients either are capable or aren't capable of Remote-wipe. The Exchange policy simply expects that they support that feature.. If the phone supports Remote-wipe and you've accepted the policy (by being a so-called "Provisional Device"), then Exchange may send a request to wipe ...


5

This is pretty similar to how to disable remote wipe for Exchange 2010 ActiveSync? The short answer is - No. Android will prompt for those permissions regardless of whether Exchange's ActiveSync policies specifically allow or deny Exchange's ability to do those actions. As far as I can tell, Android's ActiveSync apps have to require that you approve all ...


5

Take a look at your DHCP server, are you supplying the option for a search suffix to your scopes?


5

Here's a fairly straight forward L2TP/IPSEC tutorial, but I don't think iphone can use certs, so you will have to go PSK. It also gets into domain authentication, so your users only have to remember one set of credentials. That is, if you have a domain... ...


4

The aforementioned NitroDesk TouchDown should do the job, but HTC and possibly other Android phones have the ability to sync onboard already. Setting up can be a little tricky, but here is a massive tip that will almost certainly help you get it working: use https://www.testexchangeconnectivity.com/ to test for ActiveSync connectivity, if it fails it often ...


4

AWS will work for what you intend without any problem, things to be aware though of an EC2 implementation You'll lose CPU cycles when the underlying node is under high load, be ready for your machines to sometimes not deliver enough CPU juice Disk I/O will be a bit slower than a regular machine Apart from that Openfire does have a clustering solution, ...


4

man tcp - look for tcp_retries[1,2] for Linux machines. I have no idea what to do for Android and given Apples attitude to system-level tweaking there is probably absolutely no way to do this on iOS except when you jailbreak. TCP socket timeouts put aside, most applications will implement their own timeouts which are probably considerably shorter than the ...


4

It's not possible. The way to solve this problem is with a layer on top of the TCP layer that provides the semantics you need. This layer would have to add an identifier to each message, implement message acknowledgements, re-establish the TCP connection if it broken, and re-send all unacknowledged messages.


4

Well it has to be 1 of 3 things. Something changed in the AD account, something changed in the Exchange account or something changed on the phone itself. Can you enable debugging on the phone to ascertain why exactly the phone is throwing an error. Follow these steps to enable debugging: 1. On the android phone go to menu -> email. You will need to have ...


4

AirWatch has an MS Exchange client for iOS and Android. They support encryption and have a number of other security features as well. http://www.air-watch.com/solutions/apple-ios


4

Erik Fair has answered this extensively over at Quora: The keyboard of the Teletype (TTY) ASR-33 (a very common terminal interface of the period from whence this standard hails) doesn't have underscore on it: http://www.pdp8.net/asr33/pics/k... which gives one a nasty problem: how do you type (input) a hostname if the hostname in question ...


3

Microsoft Windows does not prohibit the underscore in the name of a computer. Some system administrators, either not knowing or not caring about RFC952, use underscores in the name of a computer that is connected to the internet, and either put this name in the DNS explicitly or allow it to be published via dynamic DNS. There's nothing particularly strange ...


3

To configure XAuth PSK with strongSwan 5.0.x (as responder) you have to use: leftauth=psk rightauth=psk rightauth2=xauth While deprecated authby=xauthpsk would actually still work as an alias for the above (with xauth=server also added). can not load config '/etc/ipsec.conf': /etc/ipsec.conf:25: syntax error, unexpected STRING [leftauth] ...


3

It's not abnormal. I had this discussion before with someone building custom Android distros. You will need a lot more memory than 8 GB. IIRC they used a 32 GB ram machine.


3

You'll need to take a few steps here. First may well be user education. Explain to your users that email is like writing on a postcard, anyone along the way can see the message. You'll want to find a PGP (GPG) client that integrates with each mail client in use on your network. Start with the most widely used client. I'd guess that is Outlook so take a ...


3

No-one's voted to close, so I'll make my comment into an answer: Why not run the check-out on the devices? Since you write apps, write one that locks the device until a user logs in. I wouldn't think it needs to be very secure, since it's being used in-house. To check a device out, the user simply takes it, logs in, and the app can transmit the fact that ...


3

I've got an HTC Touch Pro (Windows Mobile OS), and it will pass the MicroSD through as a USB disk. I can boot off it, though I haven't tried Linux I don't see why it would be that much different.


3

You have a number of options: Run the SSH server on port 80 or 443. Run a tunnel on the SSH server to listen on port 443 or 80 and forward it to 22. Run a VPN on port 80/443. Essentially, something on the server you're trying to connect to needs to be listening on port 443/80 in order for you to connect to it. The other solution is to talk to the ...


2

That is a traffic shaping (also known a throttling) script. It appears to take 3 arguments. The interface, the receive limits and the transmit limits. This first part just deletes everything: tc qdisc del dev $1 root tc qdisc del dev $1 ingress tc qdisc del dev ifb0 root As you can see the first parameter ($1) is the device interface, for example it ...


2

You appear to have hit a long-standing issue in Android. In particular Android will only load the autodiscover XML over HTTPS. If you serve it over HTTP then Android will refuse to even attempt to use it. As described in the bug, Android does not use DNS SRV records to locate mail services.


2

One of the certs in the chain ending with AddTrust External CA Root (02faf3e291435468607857694df5e45b68851868) is missing from what your server provides. Specifically the intermediate cert COMODO RSA Certification Authority (f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0) is not included in what you serve. What can also be seen is that the actual anchor is ...


2

A certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. But some clients (mobile browsers, OpenSSL) don't support this extension, so they report such certificate as untrusted. ...


2

Android has had issues downloading files from password protected sites. You can browse just fine but downloads fail and don't give any indication as to why. For a long time I had to use firefox on android to download them. Recently that broke for sites using NTLM. The latest google chrome on my Samsung Note 2 (android 4.1.2) does work with password ...


2

Its a bit of a shopping question, but I'll answer anyway since its a useful sysadmin tool: Decaf Monitor does exactly what you are asking. There are plenty of hosted services which do this, and if monitoring a single server its often free. I've found Montastic good enough for casual monitoring. For one server where you aren't willing to invest much money, ...


2

According to this report https://code.google.com/p/android/issues/detail?id=35050 your problem could also arise from a bug in Androids implementation of the libcore/luni/src/main/java/libcore/net/http/HttpConnection.java. Due to this bug the SNI at the TLS layer is the hostname of the proxy instead of the hostname provided in the HTTP request URL it should ...


2

Security inheritance is not set by selecting a specific permission. It's a global setting per user object. The step about "select exchange servers" is pointless, you're doing this for all ACL's. Every AD user should have security inheritance enabled. A ton of software that utilizes these security attributes (especially Exchange and Lync) rely on them. The ...


2

Concatenate the files provided manually, in the following order: site.com.crt intermediate.crt (one or more, the order of these doesn't matter) ROOT.crt you can do this from a shell with the cat command cat site.com intermediate.crt ROOT.crt > site.chain.pem or copy/paste them, no whitespace between, make sure certificates are on different lines ...



Only top voted, non community-wiki answers of a minimum length are eligible