@Jose-Ortiz great question, we have yet to record those episodes and as soon as we record them we will post them to the site (usually 24-48 hours after recording)

@thomas-pondant said in Lending admin password to someone: can anyone who has temporary admin access to the command line start another process with admin privileges from the command line?:

But what if he starts Internet Explorer from the command line (to which he has admin access thanks to Ronnie) instead of via the GUI, could he run IE as administrator?

The UAC should take control again if I've closed out of IE previously. The same procedure will be required. If I'm the admin, it should ask if I want to allow it and I just choose yes. If Wes, were to try it, it should present him with a dialog box to provide admin credentials.

Hey Thomas,

I didn't forget about you! I have been out of the office for a bit. The last one we have to talk about is VPNs and TLS. When we think about HTTPS remember that this protocol encrypts the communication between a web browser and a server.

So take for instances a quick little diagram:

0_1533910780200_Screen Shot 2018-08-10 at 10.14.06 AM.png

In this diagram we have User01 needs to access a public website, so how to we make it to where a user traversing a public network can connect to our company's website in a secure manner that protects the confidentiality, integrity and availability of the communication, we implement HTTPS which uses the security layer today of TLS.

0_1533911732920_Screen Shot 2018-08-10 at 10.35.00 AM.png

Note the DMZ here, the first (external) firewall allows for public access to our company's internal resources which in this case is the company website. So what does this do for us?

What does this do?

1 - Allows access to our internal resources
2 - Does not expose our internal network to the outside world when accessing the company website
3 - Allows the customer confidentiality of the communication - via HTTPS-based encryption
4 - Allows for integrity of the communication as there is a certificate exchange/validation of the web server.
5 - Encrypts ```web-based`` communication or HTML-based communications.

What doesn't this do?

1 - Allow for access from a public network (Internet) to the internal network for authorized users
2 - Provide authentication, authorization or auditing of those external to internal connections for authorized users

So what can we do to allow authorized users or employees access to internal company resources. For example Remote User 01 works from home 3 days out of the week. This user also needs access to her work files stored in a centralized file server located on the internal company network.0_1533913795231_Screen Shot 2018-08-10 at 11.09.35 AM.png

We could (please do not....lol) do this

1 - Place the web application server in the DMZ
2 - Place the file server in the DMZ

0_1533914034897_Screen Shot 2018-08-10 at 11.13.39 AM.png

As I am sure you are aware this presents a major security risk:

The web application and file server are now exposed to the public (and all the bad actors)
Authentication and authorization has to be performed, which in this case will expose the user database to the public (and all the bad actors)
Sensitive information is now exposed to the public
....and more

This is not a solution. So we need to:
1 - Keep these resources protected inside the company's internal network
2 - Implement a remote access technology that will allow for public access to internal resources that are not limited to web-based technologies such as HTTPS.
3 - Allow for the implementation of authentication, authorization and auditing.

This is where HTTPS is not a viable option because while it does allow for an encrypted communication between a web browser and a web server but lacks the other attributes we need. So insert ```VPN`` technologies.

VPNs allow us to:

1 - Connect to internal resources over existing public networks
2 - Connections appear as though the remote user is connected to the physical network
3 - Do not expose internal resources to those public networks
4 - Authentication can be performed by implementing technologies like RADIUS, TACACS+, Diameter
5 - Protect the user database from exposure to the public and bad actors
6 - Provide confidentiality to sensitive internal data through application of strong encryption.
7 - Allows for connections to and utilization of resources that do not use HTTPS (such as FTP, SSH, LDAP, SMB, NFS to name a few)

When we implement the VPN technologies we get these and more benefits. To the end user it looks like they are connected to the LAN and can access resources (not just HTTPS or web-based technologies)

0_1533916466588_Screen Shot 2018-08-10 at 11.51.11 AM.png

And VPNs security layer can be TLS!

I hope this helps @Thomas-Pondant

Thomas,

I hope all is well. Great questions !! let's see what we can do to shed some light on answers that make sense for you.

I'll go in the order that you asked the questions in:

"If I want to connect to a website and I have a VPN client installed on my computer, when I enter the website's name in my browser, what's exactly the route that my connection is going to take?"

Short answer is: The route will depend on where you are in relation to where you want to go & You ALWAYS have to use DNS to resolve and find a path to get to a website, the only question will be whose DNS and where is it located?

Longer answer involves us having to distinguish here between two possible scenarios to answer your question as noted below:

First Scenario: You DO NOT HAVE the VPN engaged and are using your machine to get to the Internet OUTSIDE OF THE VPN TUNNEL.

Second Scenario: You DO HAVE the VPN engaged and are using your machine to get to the Internet INSIDE OF THE VPN TUNNEL.

The reason to distinguish between these two scenarios is twofold: First, it is a question of your location PRIOR to making the request to resolve the website & Second, it is a question of what DNS infrastructure comes into play when, and as a result, whether you can get to the internet or not, and if so, how?

In the FIRST SCENARIO, you are connecting WITHOUT the VPN being engaged, so if you are at home, using your machine via your Internet Service Provider's (ISPs) network, you simply open a browser, type in a URL or IP address for the website you want to reach, and using the IP configuration provided by your ISP you use their DNS infrastructure to resolve the website, and then are routed to it via whatever path is most expedient over the public network(s) beyond your home access device provided by the ISP (cable modem, DSL device, etc...)

This would be the same by the way if you were at work, and connecting over the corporate network to an external website such as ITPRO.TV and did not use a VPN. The only difference would be that your company would most likely be providing the IP configuration and DNS information for you to use on the corporate network PRIOR to you connecting to the Default Gateway (the router for your subnet) that would allow you to gain access to the outside world. From there, the process would be the same.

In the SECOND SCENARIO, since you are using the VPN to establish a tunnel PRIOR to attempting to access the internet, things change a bit.

First, the VPN creates a dedicated pathway via an encrypted tunnel to allow you to securely connect to and use resources at the other end of that tunnel, wherever that is. As a result, when you establish the VPN, and successfully authenticate and connect, your machine will now NO LONGER be operating from the original connection point PRIOR to establishing the VPN, but rater is now operating from WITHIN the VPN tunnel and more specifically, from the other network that you have connected the VPN to. As a result, your machines IP configuration is changed and now matches whatever the IP configuration is for the endpoint network you are connected to via the VPN.

This is the critical difference between the two scenarios, as it means that your pathway to connect to the internet is now specified by the network that you are connected to, the VPN endpoint network. Whatever that path is, however it is designed, and whatever DNS and IP configuration it requires will be what is used if you attempt to access the internet while the VPN is active.

The above assumes of course that there is a pathway defined to get to the internet from the VPN endpoint network. If there is no path defined, then you WOULD NOT be able to connect to the internet while the VPN is active on you system.

"if you want to connect anywhere on the internet, you first have to use your ISP's infrastructure to do it, right? Is the first step out to the routers of the ISP's and then to whatever DNS server that will give me the IP of my VPN server? Or is my computer smart enough to directly send its packet to the VPN server?"

Lets break these down one question at a time:

"if you want to connect anywhere on the internet, you first have to use your ISP's infrastructure to do it, right?"

Based on the two scenarios we discussed above, the short answer is that you would use the ISP's infrastructure of the network that you are connecting through,

"Is the first step out to the routers of the ISP's and then to whatever DNS server that will give me the IP of my VPN server? Or is my computer smart enough to directly send its packet to the VPN server?"

Short answer is actually a combination of the two, assuming that you have a static IP configured as part of the configuration parameters for the VPN client's target.

Longer Answer: So, because we are using an IP ADDRESS to create the connection to the VPN endpoint, the target of the VPN client, that is provided EITHER ahead of time as part of the static configuration of the VPN client, or is prompted for or entered when you initialize the VPN client. DNS does not come into play for the resolution, UNLESS you are providing a Fully Qualified Domain Name (FQDN) as the endpoint for the VPN, in which case then DNS would be used to resolve and find the IP address to actually use for the connection.

As a result, your VPN client initializes its connection and goes straight to the router / default gateway that is local to where you are, and then from there the VPN tunnel is connected over the pathway that the ISP provides based on a variety of factors such as routing protocols being used, QoS on the connection, etc...

"if the first step has to be one of my ISP's routers, can the ISP see your unencrypted data before it reaches out to the VPN server? Or does my computer encrypt automatically its packets even before reaching the ISP? I guess that the ISP would still see the destination IP address in order to be able to forward my packets, am I correct?"

Short answer is that if there is no encryption being used / provided on a connection, then the data is available to anyone who is able to connect and see it.

Longer answer: It comes down to when the encryption protection(s) are applied to the data stream. If you are not using an application that provides encryption, then the data is being sent in the clear and can be seen. This why you use secure transmission protocols to send data over public networks such as the Internet/ World Wide Web.

Computers DO NOT automatically encrypt anything unless told to do so. For that matter, they do not do anything automatically unless told to do so.

It is not really that the ISP is able to see the destination IP address in the header of the request to set up the VPN, but rather that whatever mechanism(s) are used to transmit that request between routers until it gets to where it needs to go is able to understand the destination IP address.

I hope that this helps to clarify all your questions. Please let me know if we need to discuss anything further.

Good Luck !!!

Cheers,

Adam

@thomas-pondant,
This is a limitation of the original partition table. In the 1980s, hard drive and storage were not as ubiquitous as today. This is when the MBR was developed and it was to be stored on the 1st sector of a HDD.

This partition table is stored in this first sector before any partition and exist before any partitions are created. So without wasting any more space than the 1st sector of a drive and only allowed for 4 entries.

I wanted to add a little on the SMB protocol for clarification, while I am not sure that this will help on the exam, it might help for understanding the SMB protocol packet exchange:

Keep in mind that SMB allows you to print to share printers as well

Step 1

The client and server establish a NetBIOS session. (This is the NetBIOS part see the packet capture below)

Step 2

The client and server negotiate the Microsoft SMB Protocol dialect.

Step 3

The client logs on to the server.

Step 4

The client connects to a share on the server.

Step 5

The client opens a file on the share.

Step 6

The client reads from the file.

Here is a Windows 10 Workstation below using NETBIOS:
0_1532115414415_Screen Shot 2018-07-20 at 3.19.58 PM.png

@thomas-pondant,

Textbook answer. Using both of those means are the correct way to do so.

Having used both, I can say that in my experience, it works...once and only once.

The second time...not so much.

Manually, you can take isopropyl alcohol with a cotton swab and gently rub away the dried up ink until you see a clean surface. Then take the cartridge and tap it against a a surface (covered with a paper towel) to get the ink to prime the pin holes.

put it back in and try and print.

@thomas-pondant,

The whole purpose of classless IP addressing was to become more efficient with addressing. If, your ISP were to have to assign you an address in classful it would be a block of addresses. So lets say, 192.168.99.0 255.255.255.0. This would allow you to use 192.168.99.1 - 192.168.99.254 as possible addresses. What if you only used 60 of those addresses? Then there would be waste of 194 addresses that couldn't be re-assigned to potential customer. Here is the need for classless, it allows me to take the unused portion of that address block and subdivide it to smaller address space.

The other way is also possible, where we might be combining multiple address blocks together that are contiguous... Let's say I wanted to create a larger block than what the class C space I was assigned. I could get re-assigned a class B address but what if my ISP only has class C addresses. I could in theory lease, if my ISP would let me, 255 networks, 192.168.0.0, - 192.168.255.0. If I do so it's still 255 networks with 254 hosts per network. But what if I wanted one address block instead. It's here I can used classless to break the rules to use a class B subnet mask to create 1 network 192.168.0.0 255.255.0.0.

The network ID 192.168.0.0 The subnet mask 255.255.0.0 The range 192.168.0.1 - 192.168.255.254 (65,534 hosts) The broadcast 192.168.255.255

@thomas-pondant,

The provider wouldn't be accessing your equipment. But for you to configure it to allow for access to the DSL network. You may or not may not need to configure your wireless router to access the DSL network. The modem is normally their demarc, separating the customer's edge from the provider network. But for you to have access and now allow everyone to just jack into your RJ-11 outlet and get access to DSL, you may have to provide this PPPoE (or you may see PPPoDSL) password or id, etc.) for access.

Any troubleshooting they would do is only up to the Demarc on their end and the rest is your responsibility.

@thomas-pondant,

I'm not sure then I was clear then in the recording. The Wireless router is actually a combo device (Router, Switch and a Wireless Access Point). The only part of the Wireless Router that acts as a Layer 1 device is the Wireless Access Point. It operates using CSMA/CA and is half-duplex device.

All wireless access points act as a hub. If you device has one antenna, then only a single device accesses that antenna at any one time. Even if your device has antennae, only one connection per antenna at any one time, regardless of SOHO or production level devices.

Thomas,

Great questions !!

Let's start with DLNA and what it is used for. Ronnie already gave you an idea of what DLNA does, here is a little bit more detail:

DLNA separates multimedia devices into 10 certified classes subdivided into three broad categories: Home Network Devices (PCs, TVs, AV receivers, game consoles), Mobile Handheld Devices (smartphones, tablets, digital cameras), and Home Infrastructure Devices (routers and hubs).

A device’s class is determined by its functional capabilities—whether it stores, controls, or plays media—rather than the type of product it is. So it’s possible (even common) for a device to fall into more than one class. Some DLNA-certified TVs, for example, can be classified as both a Digital Media Player—meaning it can locate and play media from other devices—and a Digital Media Renderer—because media can be pushed to it by an external controlling device.

The DLNA specification defines only a handful of audio and video formats it supports. Common formats like MP3 audio, MP4 video, Windows Media Audio, and Windows Media Video 9 are all included. However, DLNA devices don’t support Windows Media Video 10, the MKV or AVI containers, or FLAC lossless audio. DLNA also defines certain types of “profiles,” so some MP4 files might not be supported depending on their resolution, bitrate, and other details. Device creators can’t add support for these because that would violate the DLNA specification. Not all local media files will work. Some DLNA server software will transcode media on the fly from an unsupported format to a DLNA-compliant one — they have to do this because that’s the only way you could stream such files with DLNA.

DLNA also must involve files. You can’t use DLNA to stream the contents of your screen from one device to another, as you can do with Apple’s AirPlay, Google’s Chromecast, or the Miracast wireless display standard. You can’t play a game on a device and stream the output of your display to another device, give a presentation, or mirror your display for any other reason.

So, in terms of what DLNA is and what it does, it serves up local media and makes it available. The security issue(s) associated with allowing it are really centered around the concerns that the broadcasted metadata about the information DLNA is serving up, and where it resides pose. In general terms, turning off ALL services that are not actively used / required is a security best practice to help harden a system / device and to reduce the available attack surface for someone looking to do harm. It would make sense for you to remove support for any of those protocols or services that will not be used for this reason, but also because they pose ongoing risks due to the potential for unknown vulnerabilities that may be exploited at some point.

I hope that helps... :)

Cheers,

Adam

I would start with upgrading the BIOS, Video Drivers, Chipset drivers for your OS. Check the refresh rate and display size is fine. When you first turn on the laptop do you see any dead pixels on the black screen? Could be a power supply issue causing it or a bad motherboard with onboard video.

Make an Ubuntu Live Boot CD or USB drive and boot it. Let it find the hardware. See if the green line still appears.

Some chipsets don't work with SSDs very well. So check bing for your laptop + SSD. I would also upgrade RAM when you have it open. If you can max it out, it would help more than an SSD drive.

@jason-konikow said:

@Ronnie-Wong

Ronnie i had purchased and have been using the complete review guide edition that is also published by sybex. Do you think that is good enough of a supplement or am i truly missing out in comparison to the complete study guide edition?

Jason, I passed the A+ 801/802 using the Sybex Complete Review Guide and it covered everything in depth! Just as Ronnie mentioned above, I would read the Review Guide and watch the A+ videos for full coverage!

And for any questions on which one is better, there is no better/best they are both equally great for studying. You can never have too many resources :D

Good luck in your studies!