There are a number of threads in the Microsoft Windows Update Newsgroup and around other well known sites regarding the infamous SVCHOST Issue!

The main issue that people are reporting is the high CPU usage from the process SVCHOST.exe, generally fluctuating between 20 and 85 percent CPU usage, in some cases using all of the CPU cycles and leaving the computer un-usable.

The cause of this is the Automatic Update service during its detection process; this is where the client PC either checks in to the local WSUS server or accesses the Windows Update site and determines which MS updates are required from the update catalogue.

All of this information is very good… I hear you say, however where is the fix!

Ok, after much web crawling and some testing, below is the method I have used for my clients which has proved sucessfull:

1. Firstly stop the Automatic Update service either through services.msc or with the command line net stop “Automatic Updates”. This will ensure the update process is as quick as possible.
2. Next apply the first of two patches; an update to the Windows Update Agent, the current version is 2.0, this patch updates it to version 3.0 which is pushed out via WSUS v3.0:
   • Windows Update Agent 3.0 – x86
   • Windows Update Agent 3.0 – x64
   • Windows Update Agent 3.0 – ia64
3. Apply the hotfix for this issue, originally stated in KB916089 and then superseded by KB927891 which provides an update for the Msi31.dll (exact name depends on operating version) with basically a more efficient detection algorithm in place:
   • Hotfix KB927891 – x86
   • Hotfix KB927891 – x64
4. Finally reboot the client PC and start the Automatic Update service if it is not set to start automatically.

This article describes how to create a service on either Windows NT, 2000 or XP (untested on Vista). The service can run any application required and can be configured as any other service on the system can.

This information has been extracted from the Microsoft article KB137890, and requires two programs that can be found in the Windows NT resource kit (or here)

• SRVANY.EXE – Allows any application to run as a service
• INSTSRV.EXE – Creates the system service

Create the service

Use the INSTSRV.EXE application to create the system service, it requires two parameters; the first is the name of the service you want to create, the second is always the path to the SRVANY.EXE application.

INSTSRV.EXE Notepad c:\SRVANY.EXE

Set the application as a service

Next edit the registry and enter the path to the application that is required to run as a service. The location is the registry depends on the name of the service that was defined above; in this case Notepad

Run regedit.exe

Navigate to HKLM\SYSTEM\CurrentControlSet\Services\Notepad

Create a new key called Parameters

Under the new key create a new string value called Application and set its value to the path of the application c:\WINDOWS\NOTEPAD.EXE

Once created this service can be managed through the services mmc to set its startup type, recovery response etc.

To make this process easier, the following code can be placed into a batch file and run (with the correct parameters) to create the service and congfiure the registry. It assumes that INSTSRV.EXE is already in a search path and that SRVANY.EXE is located in the root of the C drive.

@echo off

rem #################################
rem ## This batch file created a new system service ##
rem ## ensure the correct parameters are used       ##
rem #################################

rem Parameter 1 should be the name of the service
rem Parameter 2 should be the path to the executable

echo Creating Service
INSTSRV.EXE %1 c:\SRVANY.EXE

echo Creating Registry Keys
reg add “HKLM\SYSTEM\CurrentControlSet\Services\%1\Parameters”
reg add “HKLM\SYSTEM\CurrentControlSet\Services\%1\Parameters” /v Application /d %2

Now all of this isn’t really worth writing about you might say, however one switch that I found useful was the command tasklist /svc ; this will display a list of all running processes along with any related services attached to that process.

For a simple introduction to the mail() function see the PHP_Advanced article. This article describes some of the more advanced features that can be achieved through the mail function.

Assign Names to email addresses

When receiving an email you will notice that the To field often contains a name rather than the email address it was send to.

<HTML>
<BODY>
<?PHP
mail(‘bob@email.com’, ‘Test email’,
‘This is a test email’,
“To: Bob Jones <bob@email.com>\n” .
“From: Jane Jones <jane@email.com>\n” .
“cc: Another Person <another@email.com>\n” .
“Bcc: Yet Another <more@email.com\n>”);
?>
</BODY>
</HTML>

HTML Emails

The next stage is sending HTML email messages, this allows for standard HTML tags to be used when composing the message content. When sending a message in HTML it must be declared that is it HTML in the header of the email, this is done through both the Content-type: and MIME-Version headers’:

<HTML>
<BODY>
<?PHP
mail(‘bob@email.com’, ‘Test email’,
‘<html><body><b>Hello! World</b> \n <i>this is a test email</i></body></html>’,
“MIME-Version: 1.0\n” .
“Content-type: text/html; charset=iso-8859-1″);
?>
</BODY>
</HTML>

The MIME-Version (Mulitpurpose Internet Mail Extensions) header indicates that the email follows the internet standards, following that the Content-type header can declare the format being used; text/html; followed by the character set being used charset=iso-8859-1

Mixed Format Emails

Although the majority of email clients support HTML email messages, there are some that don’t. The mixed format ensures that the email clients that do support it see the HTML formatted message, where as the ones that don’t see a plain text version.

The technique involved is to actually send two versions of the message and rely on the email client to read and understand Content-Type: multipart/alternative; header which will make the client only display the supported version.

*** PHP code not fully completed yet ***

Emailing Attachments

Emailing file Attachments work in the same way that mixed format email messages do. The header Content-Type: multipart/mixed; is used and the message split into two parts; one the message and the other the file attachment(s).

This is more complicated than previous email examples, all the steps required are explained below. The examples assume that the email details including the file to be emailed have been submitted to the PHP page from another page.

$to = $_POST['to'];
$from = $_POST['from'];
$subject = $_POST['subject'];
$message = $_POST['message'];

Attributes of the file attachment

The first stage is to extract the required attributed from the file that has been passed. The file details in PHP are stored in an array named $_FILES which are extracted to variables.

// example: /tmp/phpfile12345 – tmp file name and loc where uploaded
$file_loc = $_FILES['fileatt']['tmp_name'];
// example: text/text – will vary depending on file type
$file_type = $_FILES['fileatt']['type'];
// example: mywork.txt – always the name of the file
$file_name = $_FILES['fileatt']['name'];

Extract data from file attachment

The data within the file is required to be placed into a variable then used Base64 encoding to convert (possible) binary data into text. The is_uploaded_file function is used to ensure that the file was in fact uploaded by an http get command, this helps to ensure no malicious activity.

if (is_uploaded_file($file_loc)) {
// Read the file in ‘rb’ read binary
$file = fopen($file_loc,’rb’);
$filedata = fread( $file (comma) filesize ($file_loc));
// Base64 encode the file data
$filedata = chunk_split(base64_encode($filedata));

The data is now in a format that is ready to be emailed, the next stage is producing the standard mail parameters.

Producing mail function

The basic mail parameters are set in the same manor, the diffrences come in the header and message parameters

The header parameter contains the MIME version, the Content-Type: multipart/mixed; declares that there will be an attachment, finally the boundary string (containing random text) is used as a marker to split the message into the two sections.

“\nMIME-Version: 1.0\n” .
“Content-Type: multipart/mixed;\n” .
” boundary=\”==Multipart_Boundary_x45985365x\”";

The message section starts with a declaration which MIME compatible email clients will not show, next is the Multipart Boundary string denoting the beginning of the first section. Following this the usual header information is declared, following by the desired message text.

“This is a multi-part message in MIME format. you should not see this\n\n” .
“–==Multipart_Boundary_x45985365x\n” .
“Content-Type: text/plain; charset=\”iso-8859-1\”\n” .
“Content-Transfer-Encoding: 7bit\n\n” .
“This is the message contents, there should be a file attached to this message”

After the text of the message, the next part is the message attachment which follows the same format as above.

“–==Multipart_Boundary_x45985365x\n” .
“Content-Type: {$file_type};\n” .
” name=\”{$file_} \n” .
“Content-Disposition: attachment;\n” .
” filename=\”{$file_name}\”\n” .
“Content-Transfer-Encoding: base64\n\n” .
$filedata . “\n\n” .
“–==Multipart_Boundary_x45985365x–\n”;

Then message should always have the message boundary string followed by – to signify the end.

To see the fully working source code, please see here

For more information on different MIME types see here
Many thanks to the tutorials where this information came from, W3Schools & PHP & sitepoint Tags: Email, PHP, Web
]]> http://www.yeltuor.com/articles/how-to/php-email-advanced/feed/ 0 http://www.yeltuor.com/articles/how-to/dropbear-ssh-server-client/ http://www.yeltuor.com/articles/how-to/dropbear-ssh-server-client/#comments Sun, 08 Feb 2009 22:11:39 +0000 shane http://www.yeltuor.com/?p=38

The Dropbear SSH server and client supports industry standard SSH1 and SSH2 protocols and is available for various Linux distributions. Version 0.45 compiled for Debian PPC can be found here, this is what I have used as the SSH server for my Buffalo TeraStation.

The first step is to copy the files to the TeraStation, then extract them using the tar command

root@HD-HTGL113:/# cd /

root@HD-HTGL113:/# tar -xzf /mnt/array1/share/dropbear.tgz

The next step is optional, however in the interest of security recommended! This is to generate a new SSL public and private key for the server to use. Before we can do this the old keys need to be deleted

root@HD-HTGL113:/# rm /etc/dropbear/dropbear_rsa_host_key

root@HD-HTGL113:/# rm /etc/dropbear/dropbear_dss_host_key

root@HD-HTGL113:/# dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key

root@HD-HTGL113:/# dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key

The final step is to reboot the TeraStation, during startup the Dropbear SSH daemon will start. A recommended free SSH client to use is PuTTy Tags: Linux, SSH
]]> http://www.yeltuor.com/articles/how-to/dropbear-ssh-server-client/feed/ 0 http://www.yeltuor.com/articles/how-to/cygwin/ http://www.yeltuor.com/articles/how-to/cygwin/#comments Sun, 08 Feb 2009 22:08:09 +0000 shane http://www.yeltuor.com/?p=35

Cygwin is a Windows program that emulates a Linux like environment for your Windows PC, it is easy to install and provides modular approach to adding tools to the environment. The key to Cygwin working is the cygwin1.dll that gets installed, it provides a Linux API emulation layer for the applications that are specifically compiled for the Cygwin environment.

For more in-depth information into how the Cygwin application works see Cygwin

This article some key setup tips and how to configure what I find one the the most useful aspects; the SSH server with Cygwin.

Cygwin Tools in Windows Command Prompt

All of the default tools provided with Cygwin are very useful, however I did find my self trying to use Windows tools whilst in Cygwin and Linux tools whilst in Windows!

To solve this simply add the Cygwin bin folder (C:\cygwin\bin) into your Windows Path environment variable and there you go. From a command prompt you can use both the dir or ls commands depending on your mood.

Right Click on My Computer then select Properties

Choose Advanced then Environment Variables

Under System variables edit the variable Path and add the Cygwin bin folder,
i.e. ;c:\cygwin\bin

Setting-up SSH Access

When accessing you Windows PC remotely, it only supports full GUI access or unencrypted Telnet traffic. With Cygwin you can install the OpenSSH server which is an open source SSH connectivity tool supporting various well known featured including both SSH1 and SSH2 protocols.

The implementation below explains how to setup OpenSSH through Cygwin which will run a service on your Windows PC called CYGWIN sshd

Re-requisites required

When authenticating to your PC via SSH it will use the existing Windows user accounts to authenticate, the user account that you want to use must have a password set.
Ensure that Cygwin is installed along with the package called openssh

Add Environment Variables

Right Click on My Computer then select Properties

Choose Advanced then Environment Variables

Under System variables click New with the name of CYGWIN and a value of ntsec

Under System variables edit the variable Path and add the Cygwin bin folder, i.e. ;c:\cygwin\bin NB do not do this part again if you have already in the previous post.

SSH Host config

Open a Cgywin console and run command

ssh-host-config

When prompted, answer the following:

Privilege Separation answer yes

Create local user sshd answer yes

Install SSHD as a service answer yes

CYGWIN= answer ntsec

NB: The ntesc answer tells Cygwin to authenticate using the local Windows accounts

Start the SSH service to allow connections

The Windows service will default to start automatically every-time Windows starts, to start the service manually run one of the two commands

net start sshd
or
cygrunsrv –start sshd

Synchronise local Windows user information with Cygwin

Run the two commands from within Cygwin

mkpasswd –local > /etc/passwd

mkpasswd –group > /etc/group

Testing SSH Works

Use a SSH client such as PuTTy and then connect to localhost on port 22 (SSH Port)
Alternatively use the Cygwin SSH client:

cygwin# SSH user@localhost

NB: The port used by OpenSSH can be changed in the file c:\cygwin\ssh-host-config under port_number. After changing the port number you must re-start the CYGWIN sshd serivce for changes to come into effect. Tags: SSH, Windows
]]> http://www.yeltuor.com/articles/how-to/cygwin/feed/ 0 http://www.yeltuor.com/articles/how-to/dynamic-dns-dydns-dme_update/ http://www.yeltuor.com/articles/how-to/dynamic-dns-dydns-dme_update/#comments Sun, 08 Feb 2009 22:04:45 +0000 shane http://www.yeltuor.com/?p=31

Dynamic DNS is a system that allows for a DNS entry, commonly internet facing to be updated in real-time. This enables a connection to be established to a Dynamic IP Address (generally issued by an ISP) via a DNS name.

One implementation of this is DME Update which uses a simple Perl script to get the current external IP address and forms a URL which is used to update the DNS provider DNS Made Easy

My use for this has been through my Buffalo TeraStation which runs a cut down version of Linux and has the DME Update script running as a cron job. This allows me to always be able reach it without remembering an IP address.

The implementation for this is relatively simply, the requirements are:

• wget – A well known command line HTTP retrieval program
• Perl installed (exact version and pm files are unknown)
• The dme_update script and config files which are here

First of all edit the config.pl file and set the $nic variable to the name of the network interface that should be doing the lookup, also set the $getip_ext variable to either 0 to use the IP address of the NIC, or 1 to use the external webpage quoted.

The next stage is to provide the DNS record details that need to be updated on DNS Made Easy, this should be placed in the records folder in a file with the following information

username
password
DNS Made Easy record ID
current record IP address

An example is:

myUsername
myPassword
1234567
22.22.22.1

To update the DNS record run the following:

perl /etc/cron.d/dyDNS/dme_update -r myRecordFile

I’m sure there are many more implementations avaliable and for many different DNS providers, however this appealed to me due to the simplicity. The end result from the Perl scirpt is a formatted URL which either updates the DNS entry if required, or does nothing. Example URL is:

http://www.dnsmadeeasy.com/servlet/updateip?username=myUsername&password=myPassword&id=1234567&ip=22.22.22.2

With the Active Directory Users and Computers MMC installed, and by using part of Microsoft’s Account Lockout and Management Tool, extra user account information can be made accessible, this includes:

• Password last set time
• Password expiry time
• SID and GUID
• Last Logon \ Logoff \ Bad Password time
• Logon \ Bad Password count

NB: The last logon and logoff attributes within a Windows 2000 domain are not replicated between domain controllers… therefore not accurate. However this has been fixed with AD 2003 by adding another attribute into the schema called lastLogonTimestamp which is replicated.

The first step is to get the acctinfo.dll available from the above tool or here.

Next, copy the file to C:\WINDOWS\SYSTEM32 then run the command

regsvr32 C:\WINDOWS\SYSTEM32\acctinfo.dll

This will register the dll, when opening the Users and Computers console you will notice another tab called Additional Account Info. This is where the extra information is displayed.