Astaro Security Gateway V8.300 Released

admin · 发表于 2013-4-21 11:49:08

1.大家最关注的，翻墙，防止DNS被劫持。
资深不资深的玩家肯定都知道某墙的事情。用了OpenDNS之类后，真的能防止被某墙劫持域名吗？恐怕太小看某墙了吧。只要是DNS的UDP包经过旁路设备，直接就会被篡改。不信？看看结果
正常请求一个被劫持的域名，当然是劫持没商量了

Sam@Bra:~$ dig hen.bao.li
; <<>> DiG 9.6.0-APPLE-P2 <<>> hen.bao.li
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50859
;; flags: qr rd ra
; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;hen.bao.li. IN A
;; ANSWER SECTION: hen.bao.li. 85697 IN A 78.16.49.15
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Dec  7 23:18:48 2009
;; MSG SIZE  rcvd: 44

Sam@Bra:~$ dig hen.bao.li
; <<>> DiG 9.6.0-APPLE-P2 <<>> hen.bao.li
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50859
;; flags: qr rd ra
; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;hen.bao.li. IN A
;; ANSWER SECTION:
hen.bao.li. 85697 IN A 78.16.49.15
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Dec  7 23:18:48 2009
;; MSG SIZE  rcvd: 44

然后再看用了Google Public DNS后，照样劫持你没商量

Sam@Bra:~$ dig @8.8.8.8 hen.bao.li
; <<>> DiG 9.6.0-APPLE-P2 <<>> @8.8.8.8 hen.bao.li
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15485
;; flags: qr aa rd ra
; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;hen.bao.li. IN A
;; ANSWER SECTION: hen.bao.li. 86400 IN A 78.16.49.15
;; Query time: 75 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Dec  7 23:20:58 2009
;; MSG SIZE  rcvd: 54

我们看看国外机器得出的真实结果

[root@WS-10267 ~]# dig @8.8.8.8 hen.bao.li
; <<>> DiG 9.3.4-P1 <<>> @8.8.8.8 hen.bao.li
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20845
;; flags: qr rd ra
; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;hen.bao.li. IN A
;; ANSWER SECTION: hen.bao.li. 14400 IN A 69.163.142.44
;; Query time: 252 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Dec  7 23:25:12 2009
;; MSG SIZE  rcvd: 44

可以看到，此路不通。想靠换国外DNS来翻墙的可以醒醒了。

2.解析速度快

Google Public DNS解析速度是挺快的，但OpenDNS就未必了

Sam@Bra:~$ dig @208.67.222.222 http://www.dnspod.com
; <<>> DiG 9.6.0-APPLE-P2 <<>> @208.67.222.222 http://www.dnspod.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17404
;; flags: qr rd ra
; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;www.dnspod.com. IN A
;; ANSWER SECTION: http://www.dnspod.com. 600 IN CNAME http://www.dnspod.com.cdnudns.com. http://www.dnspod.com.cdnudns.com. 300 IN A 61.172.249.96 http://www.dnspod.com.cdnudns.com. 300 IN A 218.244.147.137
;; Query time: 608 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Mon Dec  7 23:29:01 2009
;; MSG SIZE  rcvd: 101

3.最重要的问题，访问网站真的快吗？

相信不少人一定记得之前QQ用户出现过一次“免费出国”，当然，现在这个情况也会出现在用了OpenDNS和Google Public DNS用户的身上。

大家都知道中国特色的互联网，南北分家，互访速度巨慢无比，网站的维护人员绞尽脑汁的想办法解决互联互通的问题，加速大家的网站访问速度。

网站加速访问有好几种办法，有钱的大公司就用BGP AnyCast，但并不是人人都做得起（有自己的IP段，做一次BGP广播X-XX万，要达到最佳访问效果必须要做N次BGP广播，最后费用有可能达到 XXX万）。没钱的公司就只能用智能DNS了，包括自建的DNS，或者直接用DNSPod这样的现成方案，其实原理都一样。

智能DNS其实并不是太智能，它靠的预先分配好几个区域，然后根据用户请求的IP来判断用户属于哪个区域，之后返回对应区域的服务器IP。正常情况下，用户在国内上网，用的是ISP自动分配的DNS，用户域名解析请求发给ISP的DNS，ISP的DNS又发给DNSPod这样的域名授权DNS。 DNSPod这时候拿到的IP地址基本是ISP的DNS地址，所以很方便的就能判断出用户所在的区域，并把结果返回给用户。

但如果这个时候，用户用的是OpenDNS或者Google Public DNS，因为这些服务器的IP地址是在国外，并且N多老外都在用，智能DNS就不好判断该怎么返回了。返回国外的IP，影响国内用户的访问速度。

如果返回国内的IP，影响到其他老外的访问速度。并且如果返回国内的IP，那么该到底返回电信还是网通的IP呢？用户属于哪个省份？无从判断。那么最后只能人多决定人少，返回国外的服务器IP。

返回国外IP的结果是，用户被指向网站在国外的服务器，访问网站巨慢。

本来想找几个典型例子的，但找了一圈回来，发现国内的大公司在这上面烧钱可是一点都不心痛，全部是BGP。要么就是不搭理国外用户，没针对国外用户单独进行解析，一概解析到电信的服务器去。

拿Google来当例子吧。我是网通用户，使用网通自带的DNS，解析www.google.com得到以下结果

Sam@Bra:~$ dig http://www.google.com
......
;; ANSWER SECTION:
http://www.google.com. 48102 IN CNAME http://www.l.google.com.
http://www.l.google.com. 300 IN A 216.239.61.104

如果我用了OpenDNS的话，那么我得到下面的结果

Sam@Bra:~$ dig @208.67.222.222 http://www.google.com
......
;; ANSWER SECTION:
http://www.google.com.       30 IN CNAME google.navigation.opendns.com.
google.navigation.opendns.com. 30 IN A 208.67.219.230
google.navigation.opendns.com. 30 IN A 208.67.219.231

ping一下得出的IP地址，看看速度，其实并不快

Sam@Bra:~$ ping 208.67.219.230 PING 208.67.219.230 (208.67.219.230): 56 data bytes
64 bytes from 208.67.219.230: icmp_seq=0 ttl=51 time=213.828 ms
64 bytes from 208.67.219.230: icmp_seq=1 ttl=51 time=213.779 ms
64 bytes from 208.67.219.230: icmp_seq=2 ttl=51 time=214.716 ms
^C
--- 208.67.219.230 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 213.779/214.108/214.716/0.431 ms

我们可以再看看kaixin001.com的，如果我是网通用户，用了OpenDNS或者Google Public DNS，那么我会被解析到kaixin001的电信IP去。当然，kaixin001的电信机房线路很好，网通用户访问其实影响不大。

我网通DNS直接解析

Sam@Bra:~$ dig kaixin001.com
......
;; ANSWER SECTION:
kaixin001.com.       120 IN A 220.181.100.31
kaixin001.com.       120 IN A 220.181.100.32
kaixin001.com.       120 IN A 220.181.100.33
kaixin001.com.       120 IN A 220.181.100.34
kaixin001.com.       120 IN A 220.181.100.35
kaixin001.com.       120 IN A 220.181.100.30

如果我换用了OpenDNS，我得到的是kaixin001在电信服务器的IP

Sam@Bra:~$ dig @208.67.222.222 kaixin001.com ......
;; ANSWER SECTION:
kaixin001.com. 60 IN A 123.125.58.247
kaixin001.com. 60 IN A 123.125.56.246
kaixin001.com. 60 IN A 123.125.56.247
kaixin001.com. 60 IN A 123.125.56.245
kaixin001.com. 60 IN A 123.125.56.248
kaixin001.com. 60 IN A 123.125.59.20
kaixin001.com. 60 IN A 123.125.59.16
kaixin001.com. 60 IN A 123.125.58.248
kaixin001.com. 60 IN A 123.125.58.246
kaixin001.com. 60 IN A 123.125.58.245

中小网站就没这么幸运了。中小网站没有太多的钱去买昂贵的BGP线路，只能用很低廉的智能DNS方案，比如我们经常去找字幕的射手网

网通直接查询，可以得到网通服务器的IP

Sam@Bra:~$ dig shooter.cn ......
;; ANSWER SECTION:
shooter.cn. 800 IN A 218.21.130.42

网通套用OpenDNS进行查询，得到的是射手在国外服务器的IP

Sam@Bra:~$ dig @208.67.222.222 shooter.cn ......
;; ANSWER SECTION:
shooter.cn. 750 IN A 74.207.252.170

这样，你就“被出国”了。用了OpenDNS或者Google Public DNS后，你访问的将是一个速度并不快的射手网。

国内类似射手网这样的中小网站有几十万甚至上百万，不少游戏运营商也采用这样的方案。虽然他们不一定有国外的服务器，但如果你被解析到并不属于自己网络的服务器上，访问速度或多或少都会受到影响。所以，如果你最近访问网站速度有所下降，或者玩游戏的时候经常掉线，那么你就该把DNS给换回来了。

admin · 发表于 2013-4-24 23:34:05

How to uninstall Sophos Endpoint Security & Control from the command line or with a batch file
Article ID: 109668
Rating:
58 customers rated this article 4.4 out of 6
Updated: 10 Apr 2013
This article explains how to uninstall Sophos endpoint security software via a batch script or command line.

The instructions explain what to do on one computer however once the batch file has been created you can run it on any number of computers and if the same components are found they will be removed.

Note:

This article does not troubleshoot errors or problems when uninstalling and is intended for guidance on correctly removing endpoint software with a Windows batch script.  Other articles document how to resolve corrupt or broken installations (e.g., Troubleshooting and resolving problematic Sophos endpoint upgrade and uninstall issues).
The instructions below have limited testing and are therefore provided 'as is' and without full support.  You must fully test the batch file created on a test system before using in your production environment.
Read this article fully before attempting the instructions.
Do not run batch file uninstalls on the Sophos management server, message relay servers, or computers running server-side components such as Sophos Update Manager (SUM), Sophos PureMessage, etc.
Before using the Windows registry editor read article 10388.
If you encounter a problem when running your script we recommend you test uninstalling the components manually with Add/Remove Programs to ensure the normal method works correctly before troubleshooting further or contacting technical support.
Note: Different product version may have different uninstall strings and hence this can mean the script does not uninstall components as expected.

We do not accept responsibility for any loss of data resulting from following these instructions.
Known to apply to the following Sophos product(s) and version(s)

Sophos Endpoint Security and Control
Sophos Endpoint Security

What To Do
You need to collect all the required uninstall strings from a typical endpoint computer (so you get the correct commands), copy them into a new text file (one per line), save the file as a .bat extension (batch file) and fully test it works as desired.

Note: If enabled, the Sophos Tamper Protection policy must be disabled on the endpoints involved before attempting to uninstall any component of Sophos Endpoint Security and Control.  See article 119175 for more information.

Gather the uninstall commands

On an endpoint computer open the registry editor (Start | Run | Type: regedit.exe | Press return).
Expand the left hand tree to the following key:
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\
Note: On a 64-bit computer you will need to check both the key above and the following key:
HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall
Click through the list and locate the first Sophos component you need to uninstall.
In the list of values find the 'UninstallString', right-click it and select 'Modify'.
Copy the string into a text editor.
Repeat steps three to five for all other component you need to remove.
Windows installer parameters

The uninstall strings copied from the registry may contain MSIEXEC.exe parameters or you may want to add your own parameters to control what the end user sees on screen and how the computer behaves.  For example the uninstall string for Sophos Anti-Virus v10 is:

MsiExec.exe /X {9ACB414D-9347-40B6-A453-5EFB2DB59DFA}

But can be modified so that the uninstall is silent:

MsiExec.exe /X {9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn

Or to suppress a reboot (A restart is normally required for Sophos Client Firewall and Sophos Anti-Virus) so that you may perform it at a later time:

MsiExec.exe /X{9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn REBOOT=SUPPRESS

It is advisable to create a log file (a separate file is needed for each component) as part of this process for each component being removed to help facilitate troubleshooting should an issue arise:

MsiExec.exe /X{9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn REBOOT=SUPPRESS /L*v %windir%\\Temp\\Uninstall_SAV9-10_Log.txt

If you need further information on Windows Installer (MSIEXEC.exe) and associated parameters we recommend you consult up to date Microsoft documentation.

Create a batch file

Prior to uninstalling the endpoint components, you should stop the Sophos AutoUpdate Service to prevent a potential update of the endpoint software during the removal.  A command line such as the following can be used.

net stop "Sophos AutoUpdate Service"

The order in which the endpoint components are removed is important.  Therefore reorder your uninstall strings (that you extracted from the registry editor) as shown below.

Sophos Patch Agent
Sophos Compliance Agent
Sophos Remote Management System
Sophos Client Firewall
Sophos Anti-Virus
Sophos AutoUpdate
Then save the file and change the file extension from .txt to .bat

admin · 发表于 2013-4-24 23:40:12

卸载WINDOWS 客户端Endpoint Security & Control 得先将数个SOPHOS服务全部停止掉才可以删除掉，集大成的安全客户端，包括数个组件，非ISA客户端可比拟的

		自动登录	找回密码
密码			立即注册

Astaro Security Gateway V8.300 Released

浏览过的版块