Hey, it's Citr!xguy. WTF?

Jack Bauer Time

2009-06-18T10:32:00.005-04:00

Listen up.

Here's a great way for all you script kiddies to do a good deed and still feel all
l33t about it and everything. Short story.. the Iranian government is clamping down on free speech protesters by shutting down connectivity to social networking sites.

What can you do? Set up a fuckin proxy is what you can do. At least when these people are being shot down in the street like dogs for exercising a basic human right, they will be able to Tweet about it. That sounds trite, but it's true. The worst death is a death without reason. That said...

Step 1 - Pick a box you don't care about trashing.
Step 2 - Install squid or your proxy of choice
Step 3 - set up the following allow rule:

These directions pertain to Squid only.

Inside the text editor search (Control-W) for the line “http_access deny all” and change it to “http_access allow all”. This will make your proxy open and accessible to the world. If you would like to limit your proxy to Iranian IP blocks, you want to change “http_access deny all” to read “http_access allow TRUSTED” add a line (BEFORE the http_access line to setup an access control list [ACL]). This ACL line that defines TRUSTED should read:

I would highly recommend doing this.

acl TRUSTED src 62.60.128.0/17 62.193.0.0/19 62.220.96.0/19 77.36.128.0/17 77.77.64.0/18 77.104.64.0/18 77.237.64.0/19 77.237.160.0/19 77.245.224.0/20 78.38.0.0/15 78.109.192.0/20 78.110.112.0/20 78.111.0.0/20 78.154.32.0/19 78.157.32.0/19 78.158.160.0/19 79.127.0.0/17 79.132.192.0/19 79.170.144.0/21 79.175.128.0/18 80.66.176.0/20 80.69.240.0/20 80.71.112.0/20 80.75.0.0/20 80.191.0.0/16 80.242.0.0/20 80.253.128.0/20 80.253.144.0/20 81.12.0.0/17 81.28.32.0/20 81.28.48.0/20 81.31.160.0/20 81.31.176.0/20 81.90.144.0/20 81.91.128.0/20 81.91.144.0/20 82.99.192.0/18 82.115.0.0/19 83.147.192.0/18 84.47.192.0/18 84.241.0.0/18 85.9.64.0/18 85.15.0.0/18 85.133.128.0/17 85.185.0.0/16 85.198.0.0/18 86.109.32.0/19 87.107.0.0/16 87.247.160.0/19 87.248.128.0/19 89.144.128.0/18 89.165.0.0/17 89.221.80.0/20 89.235.64.0/18 91.98.0.0/15 91.184.64.0/19 91.186.192.0/19 91.206.122.0/23 91.208.165.0/24 91.209.242.0/24 91.212.16.0/24 91.212.19.0/24 91.212.252.0/24 92.42.48.0/21 92.50.0.0/18 92.61.176.0/20 92.62.176.0/20 92.242.192.0/19 93.110.0.0/16 93.190.24.0/21 94.74.128.0/18 94.101.128.0/20 94.101.176.0/20 94.101.240.0/20 94.139.160.0/19 94.182.0.0/15 94.184.0.0/17 94.232.168.0/21 94.241.128.0/18 95.38.0.0/16 95.80.128.0/18 95.81.64.0/18 95.82.0.0/18 95.82.64.0/18 95.130.56.0/21 95.130.240.0/21 188.34.0.0/16 188.93.64.0/21 188.121.96.0/19 188.121.128.0/19 188.136.128.0/17 188.158.0.0/15 193.189.122.0/23 194.225.0.0/16 195.146.32.0/19 212.16.64.0/19 212.33.192.0/19 212.50.224.0/19 212.80.0.0/19 212.95.128.0/19 212.120.192.0/19 213.176.0.0/19 213.176.32.0/19 213.176.64.0/18 213.195.0.0/18 213.207.192.0/18 213.217.32.0/19 213.233.160.0/19 217.11.16.0/20 217.24.144.0/20 217.25.48.0/20 217.64.144.0/20 217.66.192.0/20 217.66.208.0/20 217.146.208.0/20 217.172.96.0/19 217.174.16.0/20 217.218.0.0/15

Those are the Iranian IP blocks in case you're curious.

You should expect this server to be attacked and compromised as the Iranian government realizes it's out there. (Does that sounds bad ass or what?) So implement reasonable counter measures.

My basic approach would be to do this with a knoppix machine on a separate vlan from the rest of my network. Knoppix is a live CD so if the box is trashed you just bounce it and reinstall the proxy. The network stuff is easy enough to do with dd-wrt.

Once your server is up and running please email me@austinheap.com and let him know! He will distribute the proxy address to the Iranian underground.

Now quit scrwing around, grab your Mountain Dew, and get your Jack Bauer on!
-CG

2009-05-20T10:41:00.003-04:00

Microsoft is now advertising for anti-psychotic medications. Now that's what I call a strategic marketing alliance.

When a Speech Impediment is a Viable Alterative for GoToMeeting

2009-05-19T11:23:00.003-04:00

In my usual fashion of being behind the times I recently came across a nifty service that is a workable alternative to the WebEx or GoToMeeting type products. Welcome to DimDim. In spite of the fact that the name is reminescent of a Tourette's convenion drunken brawl, they actually have what appears to be a decent offering - and at a killer price point. $19 a month at the time of this writing. Got your attention yet? Thought so.

Now I haven't taken the time to conduct a point by point comparison between DimDim and GTM, but to be honest I don't use either one much so I don't give two shits whether one performs better or how the licensing stacks up between the two, yada yada.

I'm not in the business of free hand jobs so you get to go do your own homework on this one. All the same, this type of service is becomming a commodity so if DimDim can beat out the big players, then you're only dryhumpng yourself if you don't try them out.

-CG

The "I Can't Access" Client

2009-05-15T09:32:00.003-04:00

It's become apparent to me that Microsoft and organized religion have much in common. A few examples:

1. a Cult-like following for no apparent reason

2. They are convinced that they have the absolute *and only* truth despite any claims or evidence to the contrary - effectively lumping Linux and Wicca into the same category (which is not as far fetched as it may sound)

3. They both need all your money and will do almost anything to get it.

Point three apparently includes kicking your bedpartner off onto the floor in the morning after a great night of high caliber ugly bumping.

"CG, what in the mickey mouse fuck are you talking about," you may ask?

A fair critique.

I give you http://support.microsoft.com/kb/949914

The jist of it is that Microsoft's money grab is causing issues with older versions of the ICA client. You see they updated the encryption of the TSCal from 512 bytes to 2048 bytes.

This plays havoc with older versions of the ICA client because they choke on the new key and consequently take a dump - or actually they write a dump assuming you've got some kind of debugging going on. None the less...

You can't tell me that there's a line of people trying to crack the TS license encryption. Defeating the terminal server license model is trivial. I've never met anyone that honestly cared that much about it. That is of course unless you're using Citrix and in that case you're screwed because upgrading your terminal server build gives your user base the middle finger.

This is where I would normally make some cheeky remark about how maybe Citrix should write some function in their XenApp Server code that causes the server to blue screen, but upon reflection I realize that it's hardly necessary. Microsoft seems to be doing quite well in that regard.

Just in case you were wondering what a 182 billion dollar douche bag looks like.

-CG

License and Proof of Registration Please.

2009-04-17T10:36:00.005-04:00

Ya know, Sometimes it's important to know what the original license key for your version of Windows or MSOffice is. For example, you may find yourself needing to conduct an audit to make sure your company is compliant with their Microsoft EULA. You may find yourself needing to identify invalid installations of Windows in your environment. Conversely, you may endeavor to bolster the economy by starting a pirated software clearinghouse. Our economy rests on the shoulders of the small business man, after all.

And if I can provide you with a tool to help make your job easier, then I'm humbled to be of service. The following bit of code will enumerate, decrypt, and provide to you the raw license key for the version of windows or office that you have installed on your server.

'------------------------------
'Begin license auditing code to be used for only legal and ethical purposes-
'Never for nefarious or naughty endeavors. You cheeky monkey.
'-----------------------------

Dim objFS, objShell
Dim strXPKey

Set objShell = CreateObject("WScript.Shell")

strXPKey = objShell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName")
If Len(strXPKey) > 0 Then

InputBox vbcrlf & "Your Windows Product Key is " & vbcrlf & vbcrlf & vbcrlf & vbcrlf & vbcrlf & "(Use Ctrl + C to copy IP Address to Clipboard)", "Get XP Product Key", GetKey(objShell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DigitalProductId"))

'// Begin MSOffice Code
'// NOTE: Replace the above code block with this one to enumerate MSOffice Keys.
'// The script has not been tested with both options enabled.
'//

InputBox vbcrlf & "Your Office Product Key is " & vbcrlf & vbcrlf & vbcrlf & vbcrlf & vbcrlf & "(Use Ctrl + C to copy IP Address to Clipboard)", "Get XP Product Key", GetKey(objShell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}\DigitalProductId"))

'//
'// End MS Office Code

End If

'// Here's the money shot.

Function GetKey(rpk)
Const rpkOffset=52:i=28
szPossibleChars="BCDFGHJKMPQRTVWXY2346789"
Do
dwAccumulator=0 : j=14
Do
dwAccumulator=dwAccumulator*256
dwAccumulator=rpk(j+rpkOffset)+dwAccumulator
rpk(j+rpkOffset)=(dwAccumulator\24) and 255
dwAccumulator=dwAccumulator Mod 24
j=j-1
Loop While j>=0
i=i-1 : szProductKey=mid(szPossibleChars,dwAccumulator+1,1)&szProductKey
if (((29-i) Mod 6)=0) and (i<>-1) then
i=i-1 : szProductKey="-"&szProductKey
End If
Loop While i>=0
GetKey=szProductKey
End Function

Destroy Your Printer

2009-03-27T13:03:00.002-04:00

Sorry folks it's been a while since I posted, but in all honesty I haven't had much of anything to talk about so I figure why blither on at the expense of your time right?

In any case, this has nothing to do with Citrix, Terminal Services, or SBC, but it it very profound.

Talk about this. Call your printer manufacturer and tell them that you don't appreciate the gleeful fashion with which they sold you down the river. This, my friends is no bullshit. Just goes to show that there is something to be said for the old Knight Rider approach of writing out your ransom notes with random magazine clippings.

-CG

Are you your printer's bitch?

Citrix Missed Laying off 500 people by "That Much"

2009-02-04T10:07:00.004-05:00

So it seems that not even the "Big C" is immune to the faltering economy. In various news sources a few days ago, the mothership announced that it will be shit-canning 500 people. Everyone is trimming the fat these days, but I have to say that I'm a little surprised that Citrix is hurting as badly as it seems to be.

With the economy resembling a steaming pile of llama squat these days, many shops are trying to downsize and consolidate their access infrastructure. EMC has seized on this and has happily been spoonfeeding VMWare deployments to companies that are suddenly finding it difficult to buy corporate jets. There is a very simple reason for that. The vast majority of CPU cycles in any data center are spent waiting around for some kind of user input. Virtualizing idle hardware saves money. Plain and simple. And it saves it immediately. That's important.

So why the woes at Citrix? Could it be that because the up front costs to implement their solutions are so ridiculously high, that they have become prohibitive in a down market? Could it be that the financial pressure is forcing would-be Citrix customers to go to companies like Quest, Ericom, or even (excuse me while I throw up a little in my mouth) plain terminal server?

I don't know. And things are happening so fast that no one really does know or know enough to get their head around it - not even that mad money jackass guy.

So kids, the employment outlook just got a whole lot shittier for you and me. Citrix has effectively taken an upper-decker on the thin market by flooding it with 500 or so (supposedly) qualified engineers. So we just have to sit back and watch them quickly gobble up any market demand that might be floating about.

With a down economy, niche skills get ass-slammed. You need to be able to offer a holistic solution and show a payback on the front end right away in big powerpoint motion-tweened letters. No one wants to hear about ROI when they're just trying to keep the lights on. My advice to any Citrix engineer out there - employed or not - learn VMWare (fuck that Xen stuff), get a development skill (VBScript or preferably powershell and .NET), set yourself up for an alternate source of income with side projects or consulting, update your certs, and downsize your lifestyle.

We'll get through this, but grab your altoids cause it's gonna taste shitty for a while.

-CG

Bad ass needs a job

2009-01-13T16:04:00.002-05:00

So I have this friend.. I mean seriously, not like when someone says I have a friend and they're really talking about themselves. Because let's be honest.. no one falls for that shit. Not really.

Anyways - so I have a friend that I used to work with that is looking for a job. He's done Citrix for about 5 years and is sharp as a tack. He's also got a hefty package of development skills swinging from his belt to boot. You know what they say about that... once you go .NET you never go back.

So I know that for some reason this blog gets alot of traffic despite the fact that I've completely neglected it. I know times are shitty, but if anyone is looking for a solid engineer I can put you in touch with this person.

I'm not going to get all sentimental about it. You can go ask for reach-arounds on your own time, but I'll leave it at this. I'm not one to put up with dumb people or shitty work. This guy is probably the best engineer I've worked with. If you have an open position you would be a toothless sister-humping fuckwit not to hire him.

-CG

2X or not 2X?

2008-11-07T11:29:00.003-05:00

So I guess I've had my head up my ass more than usual lately, cause I completely missed these guys. I give you 2X Software.

Aside from being the largest company I know of to name their company after an enviable domain name - albeit a lame one, 2X put it's stake in the world of SBC as yet another Citrix wannabe.

Look I love competition, but I have to say that all these companies try to sell you their stuff under the tagline, "Hey we do most / all of what Citrix does, but for less money." It's pedestrian. Innovate already, Dammit!! Is it just me?

There's something to being able to say, "Hey yeah, Citrix is swell and all, but they have a funny logo, give you strange cravings for orange juice, and oh by the way our shit does a bunch more stuff that actually pushes the envelope of this industry than their stuff does! We're actually making waves not just riding them!"

Case in point - (and I probably owe these guys a plug anyways) - Provision Networks (now Quest software).
Provision networks is like a whirlpool that's sucking all these seemingly distant technologies from all over the landscape and homogenizing them. For example - you can publish a virtual machine instance from the same console as you can publish an application. You can even publish an application on a virtual machine and have the software spin up the vm as needed to host said application. I don't care who you are, that's fukin sweet people. That's pushing the envelope. That's putting something out there that Citrix will have to play catch up on for a change.

Don't get me wrong, I'm sure 2X has some great stuff at a much better price point than Citrix. But who doesn't? I've looked at their stuff, and it's a strong offering, but with the exception of their Linux stuff it's just not that fresh.

So X2 fans, am I wrong?

Happy Douche Bag Day!

2008-10-21T12:29:00.007-04:00

Holy shit it's been a long time since I posted.

Sorry folks, I was sitting around the other day with that feeling like I had left the iron on, and then I was like, "hey, don't I have a blog or something"

Anyways..

Update: My job is making me a racist. More on that some other time.

For now I'm writing in celebration of Global Anti Piracy Day! Hooray!! What's that you say? You've never heard of it? Ahh.. well friend, that's because it's bullshit.

It's nothing more than a corporate mind fuck dreamed up by the lawyers and other suits at Microsoft. Yes kids, suddenly the company that has been at odds with the US Department of Justice for years over anti-trust violations, that has all but monopolized (and shit-ified) the software realm, that has gone to great lengths to stamp out open source software, this same company now wants to become your moral compass and guardian angel. The amount of ironic hypocracy that oozes out of this effort is staggering to the degree that even Alanis Morissette wouldn't be able to handle it.

But don't take my word for it. Remember, I'm full of shit and a liar. Have a heaping pile of corporate propaganda and see for yourself. My favorite part is how they try to spin it as a stimulus to the US economy. You gotta admit, to do that with a straight face takes brass balls.

This really is pathetic. You know what? You may be Microsoft, but just like the RIAA, the cat is out of the bag, and technology will always stay one step ahead of you. As fast as you can come up with anti-pirate measures, countermeasures will enter the scene. You're going to have to come to terms with the fact that you can't ass-slam every person on earth for 400 bucks just to have their machine grind to a crawl by your bloated memory-whore of an operating system. Oops, was that my out-loud voice?

Talk amongst yourselves while I swear and throw things.

Damn, I'm angry.

-CG

Sepa-go-go gadget profiles!

2008-06-17T08:34:00.005-04:00

Profiles have long been the high maintenance girlfriend of Terminal Server / Citrix deployments. There's no way around it. If you run Citrix, you have at some point included user profiles as a bullet point on a suicide note.

Citrix has finally decided to listen to the million or so odd people that have been bitching for years on all manner of lists and forums about user profile management. To date, I think Citrix has turned a deaf ear to the whiners because technically that falls into the terminal server realm, and stepping on Microsoft's toes has generally not been regarded as a strategic business direction. And if Microsoft can't come up with a better way to do it then why should it be Citrix's problem? Can't argue with that, besides who the hell would want to take on profile management and all its baggage as a supported product? Fuck that noise.

So what has happened is the same thing that happened with the "Wow, printing really sucks in Citrix" movement. A bunch of third-party solutions popped up to fill the void. One of these is Sepago. Admittedly, I haven't played with it much, but Sepago has a pretty cool product for managing profiles. And surprise surprise, Citrix recently bought them.

So now Citrix has a native profile solution, or at least one that their sales people can pimp out. But why Sepago? I have a speculation. The disclaimer is that this is just me talking. This is probably going to be a half-truth at best - but here goes.

Convergence.

You see, thin computing is on the brink of a singularity. In the coming years you're going to see application and OS virtualization merge with VDI, workstations, and mobile devices. It's all going to be a huge blob that facilitates access to all the virtualized resources across platforms from a single technology or (as some have speculated) an appliance (although I doubt that). Here's where Sepago fits in. You see, it's not limited to just terminal server. It will manage profiles across the board - including your desktops and VDI instances. And... And.. it is largely managed through native GPO's! How's that for elegant scalability? Bam! What we're we're seeing is Citrix positioning itself for the coming homogeneous landscape.

Strategery.

One thing for sure, I can poke and jab at the company and have a good time doing it, but that Marky T is a sharp guy. Forward thinking and all. You tell Mark Templeton to think outside the box and he would answer that the box isn't really there to begin with. "It's running on a server somewhere else, but I get all the functionality of the box and I'm able to seamlessly think outside of it from wherever I am using any number of hardware and software platforms. We call it XenBox"

Again, that's not an actual quote. I'm just making all that up to make a point. It will certainly be interesting to watch and see what happens.

-CG

Sorry peeps. It's gone.

2008-05-13T09:37:00.011-04:00

Sorry everyone. I've deleted this post because it's ruffled some big feathers and gotten a friend very pissed off at me. This friend (I'll call him B) confided some frustrations in me over a beer a few weeks ago and I posted it without permission. When the vendor recognized the scenario and brought this to B's attention he contacted me and told me to remove it immediately. And in typical CG fashion, for whatever reason, I decided not to. If I had done so, this situation would probably still be salvageable.

I just received an email from someone who I believe is the vendor implicating B because he apparently had a link to this blog on a networking site. So in short, for his showing me some support, I've potentially delivered a whole load of shit to his doorstep. I haven't told B of this little development yet, but it will probably be the final straw in this whole thing.

I'm considering taking down this blog permanently, but whether or not that comes to pass I want to convey my most sincere apologies to B and to the vendor that was involved.

-CG

CDRom Scripting Fun

2008-04-16T08:59:00.008-04:00

Here's a nifty bit of shop talk. Although no one really uses them, the Windows Media Player API exposes the CDRom controls. The following code snippit uses vbscript to eject the cdrom. It's only a few lines, so you could easily put it in .. oh I dunno.. a login script or something. Just imagine the little snaps of cdroms ejecting all over the office at 9am. Now that is some capital whimsy, folks.

Set objMPlay = CreateObject("WMPlayer.OCX.7" )
Set colCDROM = objMPlay.cdromCollection
if colCDROM.Count >= 1 then
For i = 0 to colCDROM.Count - 1
colCDROM.Item(i).Eject
Next
End If

If you would like to learn more about scripting with Media Player, then you are a dork and I pity you. All that aside, the SDK is available here.

-CG

Do I like Citrix?

2008-03-20T09:15:00.003-04:00

I saw a forum post the other day referring to this site (which is way fucking uber cool in itself. Major thanks for the plug!). But it troubled me that it made the assertion that I don't at all like Citrix. Certainly I can understand how one would get this impression from the posts. But it's not true.

I've been doing Citrix for a long time. I've had lunches with Mark Templeton, gone to solution summits, had lunches with the developers (great guys), attended iForum (got completely hammered), and did it all on Citrix's dime. Citrix has treated me very well, and I've made a successful career out of working with their products. Indeed, some of the quirks of their products have served to make the Citrix skill set more exclusive. Long ago Citrix made a decision to foster community around their products. Sure it's taken them a while to get it right, but it's a good thing. They're not perfect, but there are far worse software companies out there.

The point is that I'm all about giving credit where credit is due, and Citrix deserves alot of credit for a great many thing.

So what's with all the zings?

I can't begin to count the number of blogs out there that deal with thin computing. While many of these are technically interesting, they also tend to be butt-kissy and flacid in content. My goal is to keep it interesting here by speaking from the real side of IT with a healthy dose of the cynicism that proliferates most enterprise shops.

Real IT isn't sitting around sipping lattes while talking about great new feature sets in products. Real IT is plowing through all the bugs and unexpected behavior those new products add as 'features'. IT is getting called in the middle of the night because some fucktard can't log in. Our day to day is decidedly less fluffy than many vendors, Citrix included, would have us believe about their products.

So there ya go. I'm not against Citrix, Microsoft, or most other companies out there.. except Scientology of course, and then all bets are off. I'm just trying to expose the underbelly of the IT and thin computing landscape and have a little fun doing it.

Who knows, Someday some dude/dudette at Citrix may be reading this blog (they do quite frequently, btw) and maybe find something useful that they can use to improve their products. I wouldn't count on it, but it's possible. Innovation is good for everyone, even assholes like me.

-CG

Happy Power Holidays!!

2008-03-18T11:10:00.008-04:00

And in outsourcing critical operations to third world countries with faltering infrastructure news:

Through one of my esteemed coworkers, I caught a copy of an email that was sent from our Chennai operations to one of our VPs. Apparently, there's a bit of a power crunch over in India.

There's so much of a crunch in fact that the government is mandating blackouts. The spin is that they're actually 'power holidays', but lets face it - how much of a break does one need from electricity? Is having electrical service something that is so stressful that we need a holiday from it? That's right pal! Fuck President's Day, but if someone doesn't kill the lights, I'm taking a hostage.

Okie dokie.

I've never worked at a company that offered paid holidays from electricity, running water, telephone service, clothing (though that could be kinda fun), or the like. No, indeed going without these things is generally regarded by most as a huge fu#king inconvenience.

So what does this mean?

Before we get into that, it's important to take a moment to give a big middle finger salute to all these companies that gleefully tossed skilled IT workers to the curb in favor of cheap overseas (and often unqualified) labor to save a buck or two on the front end. Long have I suffered at the inept hands of overseas workers which have been tasked with jobs that they are unqualified to do. So a heartfelt congratulations to all of you corner-office-power-lunching big wigs. You're getting exactly what you paid for.

And believe me, if some whelk supervisor over there is sending an email to an EVP of a multi-billion dollar company telling him that golly gee sorry, we're just not going to work on Mondays because the building is dark..this is just the tip of the iceberg.

Hell, it's not even summer yet. Just wait until they crank up all those air conditioners over there and then talk to me about power holidays.

Polish up the resume and keep a close eye on this one kids. My guess is that it may turn out to be a sizable fecal matter & fan situation before it's all done.

-CG

Ericom to Citrix: Chew on This!

2008-03-13T07:37:00.002-04:00

This is big news.

In a very interesting and fuckyouCitrix-esque turn of events Ericom has stepped up and is offering a free version of Windows Power Term to be released with Windows Server 2008.

Now I haven't personally used Powerterm, but I hear it's not too bad. And hell, if it's free, then it's a no-brainer. This is a real sucker punch to Citrix in the small to medium office arena. In the present economic landscape, you can bet that a free and workable alternative to Citrix will be embraced by companies. This is especially true in the medium size sector where the company or app is just too big or important to only use terminal server, but they hate seeing that damn Citrix line item every year.

Hats off to Ericom for a very bold and I must add cunning move! But now what?

The problem is that very few decision makers are tuned into the virtualization world like us. Let's face it; they have lives and have probably never been addressed by anyone as "Dungeon Master". It's up to us as engineers to sell this thing and give it visibility. Ericom is putting itself out there and if this does well, it's going to introduce competition. That's going to force innovation on Citrix's part. That is unless of course Citrix just buys Ericom, which would be in line with their recent product launches.

See original info here.

-CG

Managing Local Admin Passwords

2008-03-12T10:46:00.009-04:00

The company I work for often seeks out the worst and most vexing solution to any given situation. That probably stems from the fact that although the corporate line is that we hire 'quality people', most of the people in my building have an IQ approximating that of a canteloupe.

In fact, I would wager that many of the IT staff here would be quite content to sit and drool on their keyboards for much of the day. Sad, but there ya go. The plus side of that is that it's not terribly difficult for a slightly below average bloke such as myself to look like a shining star.

"Hey CG, I really like the way you tied your shoes. You keep that up and the sky is the limit for you here."

Seriously.

So anyways, one of the most short-bus-esque practices that goes on here is that all of the servers in the environment have the same admin password. Yeah.. not only that, but nearly everyone in the building knows about since it hasn't changed in two years. It even showed up in a Google search the other day. I wish I was kidding.

So it's been a constant pain in the ass for me that when odd stuff happens on the server the trail stops at the admin account. So I decided to take the law in my own hands and change it.

Here's the quandry. I don't want to have to manage several hundred admin ids and passwords. I wanted a password that I could get to quickly, that was unique for each server, and that did not require some kind of database to manage. Here's what I came up with. I set the password to a combination of the servername, a special character, and the last octet of the server IP address. It's easy to figure out the password if you know the formula and the formula can be quickly updated by tweaking the script.

Here's the script I used to do it. (Special thanks to E, who helped me fix a bug in the error handling) This pulls a list of servers from MFCOM and loops through them. Enjoy.

'//Resets the local password using the formula:
'// servername + @ + last octet of IP
'// Run this using cscript. If you use wscript you will be innundated with popups

'-------------------------------------------------------------------------------------
'// Compensate for crappy coding and diminutive manhood.
On Error Resume Next

'//Set the Username
'------------------------------------------------------------------------------------------
LocalAdmin = "Admin"
'------------------------------------------------------------------------------------------

'// Get the farm 411
Set theFarm = CreateObject("MetaFrameCOM.MetaFrameFarm")
theFarm.Initialize 1

'// If this doesn't work we're screwed so exit
if Err.Number <> 0 Then
WScript.Echo "Can't create MetaFrameFarm object"
WScript.Echo "(" & Err.Number & ") " & Err.Description
WScript.Echo ""
WScript.Quit Err.Number
End if

'// Loop through the name o' server
For each Server in thefarm.servers

'// set the hostname based on where we are in the loop
strComputer = ""
strComputer = Server.servername

'invoke the dnslookup because the datastore IP could be for some other nic if we pulled it from MFCOM.
strIP = DNSLookup(strComputer)
strOctet = Right(strIP,3)
StrOctet = Replace(strOctet,".","")
strPassword = strComputer & "@" & strOctet
strPassword = LCase(strPassword)

'//now that we have the password, let evil ensue

On error resume next
IF not strComputer = "" then

'//Clear any error condition that may have existed from the last loop
Err.Clear

' //Connect to the computer\administrator account
Set objUser = GetObject("WinNT://" & strComputer & "/" & LocalAdmin, user)
if Err.Number <> 0 Then
wscript.echo "Error on " & strComputer
if WScript.Echo "(" & Err.Number & ") " & Err.Description
WScript.Echo ""

End If

'//Set the password for the account
wscript.echo
wscript.echo "Setting password on " & strComputer
objUser.SetPassword strPassword
objUser.SetInfo
if Err.Number <> 0 Then
wscript.echo "Error on " & strComputer & "!!!"
WScript.Echo "(" & Err.Number & ") " & Err.Description
Else
wscript.echo strComputer & " - " & localadin & " password has been set to: " & strPassword
End If
End if

' //senseless destruction of objects
Set objWMIService = nothing
Set objuser = nothing

Next

'-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
'Functions
'-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Function DNSLookup(sAlias)

If len(sAlias) = 0 Then
DNSLookup = "Failed."
End If

Const OpenAsDefault = -2
Const FailIfNotExist = 0
Const ForReading = 1

Set oShell = CreateObject("WScript.Shell")
Set oFSO = CreateObject("Scripting.FileSystemObject")
sTemp = oShell.ExpandEnvironmentStrings("%TEMP%")
sTempFile = sTemp & "\" & oFSO.GetTempName

oShell.Run "%comspec% /c nslookup " & sAlias & ">" & sTempFile, 0, True

Set fFile = oFSO.OpenTextFile(sTempFile, ForReading, FailIfNotExist, OpenAsDefault)
sResults = fFile.ReadAll
fFile.Close
oFSO.DeleteFile (sTempFile)

aIP = Split(sResults, "Address:")

If UBound(aIP) < 2 Then
DNSLookup = "Failed."
Else
aIPTemp = Split(aIP(2), Chr(13))
DNSLookup = trim(aIPTemp(0))
End If

Set oShell = Nothing
Set oFSO = Nothing
End Function

----------------------------------------------------

Happy Clicking!

Paging Dr. Xen to Delivery

2008-02-14T22:04:00.008-05:00

In one guy's humble opinion, the person that is responsible for coming up with marketing slogans at Citrix really needs to consider hitting a second cup of coffee in the morning. No doubt you've noticed the new splash when you visit the Citrix.com site. It takes up half the page to deliver the following message:

The Game has Changed.

Transform your Datacenter into a Delivery Center.

Introducing Citrix Delivery Center.

Now is it just me or does that sound like some kind of superbowl ad for a maternity ward? I mean seriously..the Citrix Delivery Center? That's all you guys could come up with? You need to hire someone with a pulse to do your marketing.

Oh but let not your heart be troubled, kids. I've come up with a few alternate suggestions. I know..I know. I'm a giver. It's just how I am.

How about:

The game has changed. We're combining all our suites into a new super-enterprise-platinum-mega-super-uber-suite that all runs on NetScaler.

The game has changed. Resource manager is another story. Say, have you checked out Edgesight?

The game hasn't actually changed...just the name of our products.

The game is up. Too bad your servers aren't.

The game has changed. We're actually considering writing our next software product instead of just buying it up.

Any other suggestions?

-CG

Free Edgesight Courseware - CTX-1800

2008-02-12T20:12:00.000-05:00

Knowledge should be free. Share it. Here's the full courseware for Citrix / Xenapp, or whatever the hell their name is today course CTX-1800.

Note that I am not personally providing this download, just pointing you to it. I don't know who put it out there, but get while it's hot.

-CG

Endpoint Agent Hack

2008-02-01T07:17:00.001-05:00

Hey folks,

I know.. I know.. the Edgesight hacking stuff is becoming a little tiresome. I'll try to sweeten the mix with some other topicality this month but for now.. here's yet another Edgesight hack.

This time we're talking about the agent.

Citrix has two main versions of the Edgesight agent. The one you and I are probably mostly concerned with is the Presentation Server agent (I guess that will soon be named the Xenapp agent or some crap like that in keeping with Citrix's curious habit of renaming their products every 7.5 minutes). Anyways, you have the PS agent, which is designed to monitor Presentation Servers, and you have the Endpoint Agent - which is designed to run on non-presentation servers. This includes standard server builds and workstations.

Now the irksome thing is that Citrix licenses these agents separately. Consequently, we get to keep track of how many PS agents versus EP agents are deployed, what they're running on, and whether or not we have enough licenses to support what's out there. What a pain in the ass.

In our environment we don't monitor our workstations through the EP agent using Edgsight, but we do have many servers that are non Presentation servers that we want to monitor. i.e. Web Interface, Secure Gateway, File / Profile Servers, etc.
I don't want to have to mess with the additional administrative burden of running two agents to essentially get me the same functionality. Wouldn't it be cool if you could run the PS agent on non-Presentation Servers?

You can.

How? Well it goes back to the way that the agent works and why there are two agents in the first place.

Both agents position themselves very close to the kernel and essentially function like a piece of zombie code.

The reason is that there are two agents is because the terminal server kernel is vastly different from that of a standard server, being that it has to accomodate multiple users and all that other cool stuff that allows people like me to keep a job.

So the endpoint agent just won't work with a terminal server, and vice versa - you can't install the PS agent on a non-terminal server. So it has nothing to do with licensing; it's a matter of compatibility. That's why there's two agents.

So if you want to only run the PS agent, it's a simple matter of making it so that it works with your non terminal servers. To do that it's as easy as making them application servers. You just install terminal server on them. That's it. Badda bing! They'll run perfectly fine in terminal server mode and you only have to manage one agent. Cake.

Of course there are some security aspects to address, but if you're messing around with this stuff I'm going to assume you're not a complete tool and can handle that stuff on your own.

Peace
-CG

Citrixguy.net Featured on Citrix.com!

2008-01-03T13:54:00.000-05:00

So I was browsing my stats the other day and noticed several visitors coming in from citrix.com! Yes, Citrix linked to this blog.

TWICE!!!

Specifically from http://web.citrix.com/blogosphere/index.php?id=88

Look for the "Edgesight for Load Testing Semi-Free" and "Edgesight Licensing Hole" links.

So WTF?

No doubt this is an automated spider that just searches a bunch of blogs for relevent content and posts links to the page. I seriously doubt that Citrix Systems would endorse anything on this site. All that said, I got quite a chuckle at the irony of Citrix linking to articles about hacking their products.

I'm thinking that maybe someone at Citrix should take a glance at that page once in a while.

-CG

Edgesight for Loadtesting Semi-Free!

2007-12-13T09:48:00.001-05:00

Here's some news. Load testing on Citrix is still a pain in the ass.

Citrix is attempting to round out that chasm of product functionality with a new product called "Edgesight for Load Testing". Actually to say that it's a new product is a fat lie. Like many other products (Edgesight included) Citrix just bought up a company and slapped their logo on their product. So in addition to the name being completely lame, it's also incorrect. This product is in no way related to Edgesight. No doubt future integration is planned, but for now it has about as much to do with Edgesight as notepad does.

According to the press release found here:
"Citrix EdgeSight for Loading Testing 2.5 will be available on June 25, 2007, and suggested retail pricing starts at $7,500. Citrix EdgeSight for NetScaler is available as part of the Citrix NetScaler 8.0 Platinum Edition."

In other words, this shit ain't cheap.

Unless of course you found some way to get a license for some kind of discount.

Recently I took a class on Edgesight 4.5, specifically CTX-1800AI. It's a moderately interesting course, but the cool part is that you get a demo license for Edgesight for Load Testing. So what? Well.. the "demo" license you get is good for 2 years! 2 friggin years! What the hell were these guys thinking?

So why pay 7500 for a product when you can get the same product for around 1200 and some change? Just take the course and conduct a very extensive demo of the product. I think most people would agree that two years is adequate to make a determination as to whether or not you actually want to go forward and pay the full licensing cost.

-CG

Edgesight Licensing Hole

2007-10-31T13:52:00.000-04:00

Edgesight is a cool product. There's no doubt about it. But why pay for it if you don't have to?

A little history is probably in order..

Edgesight was actually developed by another company called Reflectant. Citrix bought Reflectant as a means to round out their suite of products. Let's face it, Resource Manager is about as useful as loose bowels. Oh sure, it was probably grand back in the days, but it's a dinosaur by modern standards. Hence the need for Citrix to find something to monitor their stuff.

A little known fact is that shortly after acquiring Reflectant, Citrix promptly told most of the other competing vendors (EG Innovations, etc) to go fuck themselves. Citrix is no longer including these vendors in the development process of the Metaframe product suite. Downright bastardly if you ask me, but many of us have seen the big red dot toss its weight around before for no other apparent reason than just to be catty. They refunded their iForum exhibition fees and did a tremendous job in showing their ass.

So anyways, after Citrix purchased reflectant they were in a rush to re-brand the product and get it out there. As is often the case, certain compromises were made with the product conversion for the sake of some deadline. Long story short is that the licensing in 4.0 and 4.2 is not perfect.

It's so imperfect in fact that it is not enforced by the product. Edgesight is licensed by concurrent connection in the same fashion that MPS is. What is supposed to happen is that the product gathers data on the number of users that you are licensed for and then stops once it hits the ceiling. With version 4.0 and 4.2 this doesn't happen. You could be licensed for 10 users and collect data on 10,000. Pretty sweet.

This little bug is fixed in 4.5, which may explain why Citrix is pushing folks so hard to upgrade even though the improvements are somewhat minor in the newer version.

Sometimes the latest and greatest turns out not to be.

-CG

Free TS CALs Forever!

2007-10-17T09:40:00.000-04:00

I've given you a way to get around the Citrix licensing. It's only fair that I illustrate how to give the finger to Microsoft as well.

You'll note from my last entry, that I'm a little pissed at old Billy Gates. So I got to thinking.. As a Citrix engineer, how can I screw Microsoft? Of course the answer is licensing - the same way MS screws us. It's kinda poetic when you think about it.

There's potentially two ways to do this. Both of them are illegal, so you're on your own if you get caught.

User Mode licensing - TS User licensing with Win2003 is something that most Citrix Engineers don't mess with much. The idea is that you set up user level licensing and then you pay for each user who would be accessing a terminal server in your environment. In reality, it works much differently.

You see user level TS licensing is a new feature with Win2k3 server. Unfortunately, it's half baked. If you log on to a terminal server that's running in user licensing mode, it checks to see if there is a TS Licensing server on the network. That's it. If it finds a license server you're in. Money in the bank. So you can have a TS License server set up with only 1 CAL installed, and thousands of users would still be able to connect as long as your Terminal Servers are using user licensing. Nice huh?

Now if you opt to stay with device cals (the older win2k model that most of us are probably familiar with) the solution is a bit more extensive, but is still within reach.

The device CAL is stored on each workstation in the following registry location
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing\Store\

If the device tries to connect and doesn't have an entry there, a CAL is issued.. or if no CALs are available - a *temporary* CAL is issued. The temporary CALs expire in 120 days, which is plenty of time to get your users working. The problem of course is that after 120 days they get an error if there are no legitimate device CALs available.

So the way to get around that is to have a TS Licensing server that has a few device CALs installed, but all of them being in use. In this scenario, workstations that connect without a CAL are issued a temporary one. If the temporary CAL is deleted before it expires, it will get another temporary CAL, and so on.

It's the "and so on.." part that we're most concerned with. If you keep deleting the temporary CAL at login, they get a new one the next time they connect. This can be done over and over.

So a simple line or two in the login script to delete the license store (the registry key above) when users logon is enough to keep your entire enterprise running on temporary CALs.

Now go get busy,
-CG

TS License Server and the Chamber of Secrets

2007-10-17T08:34:00.001-04:00

So here's the scoop. We're retiring our main TS Licensing server and replacing it with a new box. Sounds simple yes? Yeah not so much.

The basic process is this you get on the phone with the MS Licensing Clearinghouse, which is a boiler room operation somewhere overseas, give them a bunch of numbers, and if the stars line up just right, then they give you a bunch of licenses to install.

So after the myriad of mindless voice prompts:
"Please say the operating system you're caling about"

"Windows 2003"

"It sounded like you said Windows XP. Is this correct?"

"No."
"I'm sorry, please say the name of the operating .."

"Windows 2003"

"It sounded like you said Windows 2003. Is that correct?"

"Yes. Damn this is a pain"

"Are you calling about licensing for terminal server, licensing for.."

"Yes. Terminal Server"

"I'm sorry. Please say your selection again.."

"Terminal server. Terminal Server! Terminal-fucking-server. What the mickey mouse fuck is your problem? None of your other products even sound remotely like the words 'terminal server'. You blind horse fucking toaster.."

"Transferring you to an operator"

"Mother Fucker!"

---Operator picks up---

[in a very thick indian accent] "Halo and tank you fah callind microsoft lichsing. My name is Bill. How can I assist you today?"

"Your name isn't Bill is it?"

"My name is Bill, yes"

"Seriously, what's your name"

[quietly] "It is.. uh.. Prasheid"

"Uh huh.. you guys in Redmond?"

"Redmond?"

"Nevermind."

"Look I need 90 thousand TS device CALs."

"What?" [Noises of the guy shitting a golden and curry scented brick can be faintly heard in the background]

"TS CALs - 90 thousand of em"

"90?"

"Ninety .. Nine.. zero.. thousand. Nine.. Zero.. Zero..Zero.. Zero."

"Hold on"

[Shitty hold music ensues]

"Sir I can't give you that many licenses."

"Our SA agreement should cover that amount.. what's the problem?"

"I'm not allowed to give you 90 thousand licenses"

"But we paid for that many. How am I supposed to get them?"

"You need to call back."

"What?"

"I can only grant 9999 per call"

"So I have to call back 9 more times to get the licenses that we paid for?"

"Yes sir"

"That's bullshit."

"I'm sorry?"

"Nevermind.. alright then.. so let go ahead with it.

"Okay sir.."

"Buttfucker"
----------------------

F-ing rediculous.

Make Your Own Citrix CALs!

2007-05-11T14:58:00.000-04:00

It's all about design.

The licensing model has been vastly improved since the days of XP. It's easier and more secure to manage your Citrix licenses. In fact, there used to be a cool utility called TFLKey.exe that would puke up Citrix licenses all day long, including licenses for unlimited servers and connections. You could even activate your existing cals with it.

Of course, using such a utility violates the license agreement (which I guess you wouldn't really need if you had the tool) and may get you thrown in Jail - which is bad because being Bubba's bitch is never fun.

But if it's an architectural design flaw that is a security hole - and you happen to build your environment in such a way that exposes it.. is it still illegal? You're not exploiting or in violation of licensing - and all your servers are working normally. Or are you just leveraging an aspect of the product's design in an unconventional way? Hmm.

Consider the following:

Let's say your environment consists of:
-10 MPS4 servers
-1 Citrix License Server with 100 CALs installed
-1000 users

In this scenario, we're going to potentially consume 100 Citrix CALs, but we're going to get our 1000 concurrent users up and running.

How the hell do we do that? We're simply going to leverage the 30 day Citrix Licensing grace period. You see, each of those 10 MPS servers keeps its own running tally of how many CALs are available. So with the license server up and running you have a max concurrency of 100 users.

Here's where it gets fun.

Kick off all your users and wait a few minutes. At some point, each server will recognize that there are 100 CALs available.

Shut down your license server.

Now you have entered the 30 day grace period where each server thinks that there are 100 licenses available. And since there's no license server to update as users logon and logoff, each server now has the capability to issue 100 cals.

As long as that license server stays offline (for up to 30 days), you can host all of those 1000 users using only 100 CALs.

Obviously the way around this is to bring it back up every 29 days when no users are online for a little while. Once you verify in the event logs on each server that the grace period has been reset you can take it down again, and drive on for another 29 days.

You've just saved your company 315,000 dollars (assuming 350 bucks per CAL).

Is this legal? I honestly don't know.. I think it might be a gray area that could be argued either way. Chances are that Citrix can pay for better lawyers than you or I, so I don't suggest doing something like this.

Is it ethical? No, but all that aside, from a technical perspective it is a pretty cool hack.

-CG

So Does this Mean I'm Famous?

2007-05-10T21:02:00.000-04:00

USB Gets Silly

2007-05-08T09:10:00.000-04:00

It was bound to happen sooner or later.

Someone has written a worm that leverages USB drives as a means of propagation. I'm surprised that it took this long.

Think about it. What are thumbdrives used for? I plug it into my computer, copy a file or two, and then you take it and copy the file to your machine. You might as well be having unprotected sex, except with a bunch of little ones and zeros.

Here's the skinny from Sophos. Ha get it? Worm.. skinny? Ha! Nevermind.

------------------------------------------

Security researchers at Sophos are warning of a new Trojan worm virus that is being spread via infected USB device.

According to the security software maker, the W32/SillyFD-AA program, or Silly worm, automatically spreads itself to any USB storage device connected to a PC it has infected, and then passes itself along to any subsequent machines to which the removable thumb drive is inserted.

Once loaded onto a computer, the worm creates a hidden file labeled as "autorun.inf" from which it continues to propagate itself. Among the only discernable affects of the attack is that it changes the title of users' Internet Explorer browsers to read: Hacked by 1BYTE.

The same type of attack could be used to spread far more malicious programs such as spyware or rootkits.
Such attempts to infect via physical interface could become increasingly popular. According to a recent report published by Centennial Software, removable storage drives have actually become the leading cause of security concern for IT administrators, based on a survey the company conducted at a European conference.

------------------------------------------

Personally, if I were a l33t hax0r filled with all that post pubescent angst trying to stick it to the man, fuck the system, and all that - I would be kinda pissed that my worm got named Silly.

-CG

Code Monkey

2007-05-07T08:16:00.000-04:00

For all you dev heads out there. This bud's for you.

Citrix Cutting Edge Update Notifications

2007-05-01T13:04:00.000-04:00

One of the great features about the Citrix support website is the ability to subscribe to sections so that you get email notifications when things are added or updated. Of course I subscribe to several sections in the interest of keeping myself in the know and having something to blab about on this site.

I received the following email from this system today which demonstrates the effectiveness of this tool.

---------------------------------------------
You asked to be notified if there were any updates to the document type "Tool " in the Citrix Knowledge Base. The following entry was added or updated on Oct 26, 2006 3:17:38 PM:
ProcessHistory v1.1 for 32-bit and 64-bit platforms
To view this entry, please visit:
http://support.citrix.com/kb/entry.jspa?entryID=11487&categoryID=686

If you wish to remove this watch, visit:
http://support.citrix.com/kb/accountEditWatches!default.jspa
Citrix Technical Support

----------------------------------------------

See what I mean? Cutting edge.. give or take 6 months or so. I expect my updated Winframe 1.7 admin guide any day now.

-CG

Edgesight ADM

2007-05-01T10:06:00.001-04:00

Yes, it's been a while since the last post. Sorry. Have you looked outside lately? The sun is out. I have a life. That means the give-a-shit quotent regarding things in the office takes a sharp decline. Since I pilfer work hours to update this blog, citrixguy.net falls within the scope of that phenominon.

Anyways, I came up with a basic ADM Template that I thought might be useful for some of you wokies that play with Edgesight. It allows you to set some fundamental settings that make managing your deployment a little less painful. Like most of these things, it's not as pretty as it could be (see also: give-a-shit quotent above), but it gets the job done and gives you something to play with.

There's five parameters I'm setting with this:
- the edgesight app server name
- the app server path
- the app server port
- The Department Name
- The Company Name

If you don't know how to make this work as a GPO, take your hands off the keyboard immediately and go fling yourself in front of the nearest bus. I hate to be the one to break it to you, but you are a pus-filled boil on the ass of the IT industry.

All you not so dumb people, please enjoy with my compliments.

-CG

--------------------------------------------------

CLASS MACHINE

CATEGORY "Edgesight Server Configuration"

POLICY "Server Port"

#if VERSION >= 3 EXPLAIN "This policy defines the port on which the Edgesight web server is running. The default is 80" #endif

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess\"

PART "Server Port" EDITTEXT VALUENAME "ServerPort" DEFAULT "80" #if VERSION >= 2 EXPANDABLETEXT #endif END PART

END POLICY ; Server Port

POLICY "Server Path"

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess\"

PART "ServerPath" EDITTEXT KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess\" VALUENAME "ServerPath" END PART

END POLICY ; Server Path

POLICY "ServerName"

#if VERSION >= 3 EXPLAIN "This defines the name of the Edgesight server. The default is EATABAGOFDICKS" #endif

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess"

PART "ServerName" EDITTEXT VALUENAME "ServerName" DEFAULT "ENTER YOUR STUPID SERVER NAME HERE" END PART

END POLICY ; ServerName

POLICY "Department"

#if VERSION >= 3 EXPLAIN "This defines the Department name which usually corresponds to the partinular Farm." #endif

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\"

PART "Department" EDITTEXT VALUENAME "Department" DEFAULT "ENTER YOUR DEPARTMENT" END PART

END POLICY ; Department

POLICY "Company"

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\"

PART "Company" EDITTEXT KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\" VALUENAME "Company" DEFAULT "ENTER YOUR COMPANY NAME" #if VERSION >= 2 EXPANDABLETEXT #endif END PART

END POLICY ; Company

END CATEGORY ; Edgesight Server Configuration

[STRINGS]

The PDF From Hell!!

2007-03-09T20:10:00.000-05:00

We've all had those days. We've all reached that point. Something is broken.

Everyone, their brother, and some dude name Cletis is on a conference call. It's chaos. Citrix is Down! People are eating each other alive and flinging small children out of windows. And one more MBA-sucking assclown manager wanting a status decides to ask you for an update on the crisis de jour .

"Well Frank, It's just about the same as it was 2 minutes ago the last time you asked me."

But this time the blackberry toting walrus has done it. That's it. You can't take it anymore. It's done. You f-ing quit!

.....

But wouldn't it be icing on the cake if you could really show them all just how far down the crapper they're going to be without your able hands on deck? Of course, I'm not talking about corporate espionage or anything of the sort, rather just illustrating the cumulative impact of very inefficient computing.

Enter the PDF from Hell.

Consider the following stats: (from loginconsultants.com)

Memory a couple of seconds after opening the doc: 80MB
Memory after browsing extensively: 150MB
Memory after printing : 216 MB
CPU 100% for a couple of seconds while browsing to the next page.
Starting a Printjob: 100% CPU for about 2 minutes
Printjob spoolfile size: a whopping 741MB!

Chances are that if your company is using thin computing one of the apps they're delivering is email. Get it? Imagine sending this little puppy to several thousand email users at once. If you figure about oh I dunno ~50 or so users per server the impact is immediate and ugly. In other words..tell those servers to bend over and kiss their dual core asses goodbye.

Of course, this type of thing is very useful when load testing and capacity planning too.

Play nice kiddies.

-CG

Deliver this.

2007-03-06T10:53:00.000-05:00

Is it me, or this just disturbing?

Look, I get the whole podcast thing. I have a number of audio books that I follow via podcast. Really, I'm one pod-happy dude.

But please, we buy your stuff already. We spend thousands on licensing, training, and getting hammered at iForum. We've built our careers on your technology. Leave it at that and save the propaganda for the sales ferrets.

We're engineers, not corporate sluts.

-CG

New ICA Client Connection Tool

2007-03-06T07:52:00.000-05:00

Released from Citrix today is the new version of the Client Connection Tool. You old school peeps no doubt remember the CSTK, which was a pretty decent hack for down and dirty load testing. Well this is like that, but with a little crystal meth thrown for good measure.

In our environment, it's only slightly more pleasant than rectal surgery to get users and business units to actually perform valid load testing. They're like little three year olds - slobbering all over their power ties with thick spittle that smells slightly of the lunchable that they just polished off.

They want it now and don't care whether or not it works. That is, they don't care whether or not it works as long as it works. As soon as it breaks or starts to run slow, they're the quickest to start screaming like that guy in Deliverance.

While admittedly this little tool won't help you slash you users' tires or send them threatening emails from their manager's mailbox, it will make simple load testing a little easier. The main bells and whistles include: A well constructed PDF that explains how to use the tool, an account creation utility, the actual connection tool itself, and a couple runtime files.

I'd like to give Citrix props for having the foresight to bundle all this stuff together. It's refreshing to not have to ferret out all the various dependencies that are needed to get the thing going.

So anyways, there's three basic features you can leverage with this thing:

Custom Application Creator - this is the equivalent of your standard Loadrunner load generator, but with down syndrome. It does all the fundamentals, but nothing terribly intelligent. Of course for me, this is perfect because I couldn't give two shits about how to write Loadrunner scripts.
Customer Application Duplicator - this is cool because it lets you basically define a template ICA session and then spawn several inbred step children from it. It automatically plugs in different user names and such to streamline the process. Kudos.
Application Test Set - If you're the die hard application set kinda person, this setting can run published apps from the app set. I don't know how useful this really is since everyone I know uses Web Interface or PNAgent, but there ya go.

It's not terribly robust, but it gets the job done.. oh and hey it's free. Definitely worth checking out.

-CG

ICA v10.0

2007-02-27T10:05:00.000-05:00

As the dawn breaks anew over the thin computing landscape, Citrix admins awake with a tingle in their arms and legs. They know. Somehow they know. It's what sets them apart from your average server wonkie. They feel it.

A new ICA client has been released.

There's actually a couple new releases. There's one specifically for Vista, and then there's the one that most of us refer to as the Win32 client which should also work on Vista. There's also a new "streaming client" which is consistent with the new desktop application streaming product offering. Pretty cool stuff.

I'd love to give you more info on them, but as of this writing the admin guides have yet to be updated to reference the new version. Helloooo? Citrix?? Can you hear me?

So don't take my word for it. Be the envy of all your friends and neighbors; download the new ICA client today! You won't be sorry. (But if you are, that's too damn bad because there's no docs to help you in troubleshooting)

Happy clicking!

Customers to Dell: "Give us Linux, Dammit!"

2007-02-26T09:29:00.000-05:00

Here's a fun story that my brother sent me this morning.

Apparently Dell opened a customer feedback site. Now while this is pretty astounding by itself, even more surprising is what the top 5 requests are.

1. Pre-install Linux
2. Pre-install Open Office
3. Native Linux Build - basically the same as #1
4. No extra software installed (I really hate that crap too)
5. Install Firefox as the default browser

I think it's coming down to this. I don't think people are sick of MS necessarily, but people are getting smarter and more tech savy. At the same time, Linux is now much more than a command line. It's robust, very flexible, and pretty easy to use. Add to that the fact that more and more companies are writing software to run on Linux and you've got good recipe for a supportable software platform.

As a result, people aren't as intimidated by it as they once were and are willing to explore it as an alternative to Windows. To that I say Fuck Yeah!

What does this mean to Citrix?

Disclaimer: I don't work for Citrix, so anything I say about them is pure speculation on my part and probably a lie. Do your own homework.

For a long time the Windows platform has been the bread and butter for Citrix both on the server and client side. Of course Citrix already has a Linux client, but if they want to keep their head in the game they need to start paying more attention to where this thing is headed. They need to start putting some resources into rounding out their product offerings to include better than average software on the Linux side of the house - especially on the server platform.

Ideally, you could run a mixed farm of Windows and Linux servers and access applications from most any OS though Web interface. You could be running Gimp and Paint from the same farm. We're talking sick integration here, people. Stuff that today would only be allowed in Massachusetts and California.

Will it happen? Who knows. Remember that Microsoft owns terminal server, and the two companies are in bed pretty closely. It would be interesting to see what kind of pressure Microsoft puts on Citrix if they were to start offering a Linux suite.

-CG

Dear Microsoft, Suck it.

2007-02-21T11:44:00.000-05:00

In case you haven't heard, DST is the new Y2K. That is, the hysteria once owed to the Y2K bug is now circling around the Daylight Savings Time bug.

You see, this year our esteemed government has decided to change the daylight savings dates around a bit. Of course, the typical PC with the typical operating system wasn't invited to that meeting and knows nothing about that decision or the impending collapse of civilization that will come from it.

In a mad rush to save us all from the inadequacies of their own products, Microsoft has released some patches to head off this calamity at the last minute. Swell, right? They only knew about it since August 2005. It's not like we server wonkies have anything else to do, right?

Well, they're only releasing patches for the newer OS's. That's right. Bastards. Oh, because no one in their right mind would still be running Windows 2000, right? That is so, like, old and stuff.

Well, I have news for you Microsoft. Your track record of stable OS releases is less than stellar. Hence, many companies have taken the wait and see approach so that they don't have to devote copious resources to keeping their environments running. So even though they're not on the most fashionable release of Windows, their stuff works and they get to do a little business on the side to keep the lights on. The point is that there are alot of legacy servers out there that are humming right along.

But that's not okay by you is it? You can't get any license revenue if folks don't constantly have to upgrade their stuff. So instead you publish a knowledge base article that outlines the slew of registry updates that have to be made just to get your stuff to work like it's supposed to. (http://support.microsoft.com/kb/914387/en-us).

In a situation such as this, Microsoft should step up and own the fix for their products, legacy or no. It's naive to think that everyone has moved on to Windows 2003 when 2000 is still a viable solution for many companies. Based on the scripts for updating Win2k that are listed on the above site, it would take slightly more than a gorilla to compile those into an MSI or MSP.

I wish I could run a company where the business model was, "screw the customers". It would sure make things alot simpler around here.

Server Uptime Script

2007-02-13T15:03:00.000-05:00

The thing that you have to understand about J & E (former coworkers) is that they can script a sunny day. Script demons these guys were. Me? Yeah, not so much.

So as you might imagine, I was actually quite pleased with myself when I wrote my first vb script to pull server uptime. Of course it shelled out to uptime.exe and was very basic in it's functionality. My gleee was short-lived as J was quick to inform me that only people without penises shell out to stand alone exe's to accomplish tasks.

Alas, with J & E gone it has fallen on me to script things as needed. This is pretty scary when you consider the size company I work for and my relative skill set when it comes to scripting. The flip side is that it's given me a chance to improve.. which is coolio. So today I crafted a script that is pretty handy for pulling server uptime.

It's still pretty basic, but is flexable enough to use logic against the uptime value. i.e. if a server has been up too long, reboot it. Is it the most efficient code? Oh Hell no. E would probably crap a brick if he ever comes across it. Instantiating objects over and over again was one of his pet peaves.

Still it works, and my shabby development skills definitely allow for you to improve it when you steal it for your own use and claim to your manager that you came up with the idea. Hey it's cool; I know how it works. There's one guy in the world who actually knows how to write code, and he posts to the internet. Everyone else downloads, plagurizes, and re-posts it somewhere else. It's the great circle of life.

So here ya go.

'
'Try this in Production first. Just for grins.
'// USAGE: cscript.exe uptime.vbs (duh)

option explicit
'//Declarations
Dim strComputer, thefarm, aServer, intsystemuptime, objWMIService, colOperatingSystems, objOS

'// Get the farm 411
Set theFarm = CreateObject("MetaFrameCOM.MetaFrameFarm")
theFarm.Initialize 1

'// If this doesn't work we're screwed so exit
if Err.Number <> 0 Then
WScript.Echo "Can't create MetaFrameFarm object"
WScript.Echo "(" & Err.Number & ") " & Err.Description
WScript.Echo ""
WScript.Quit Err.Number
End if

'// Loop through the server name
For each aServer in thefarm.servers

'// set the hostname based on where we are in the loop
strComputer = aServer.servername

'// Compensate for small penis and crappy coding
on error resume next

IF not strComputer = "" then
wscript.echo "Checking " & strcomputer
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'// Will error if the server is offline. You might want to know about that.
if Err.Number <> 0 Then
WScript.Echo "Something is jacked up. "
WScript.Echo "(" & Err.Number & ") " & Err.Description
WScript.Echo ""
End If

Set colOperatingSystems = objWMIService.ExecQuery _
("Select * From Win32_PerfFormattedData_PerfOS_System")

'//Nested For loop to enumerate the objects in the collection, yo.

For Each objOS in colOperatingSystems

'\\Get the number of seconds and divide by 3600 to get hours
'\\set as an integer because decimals are for nerds!

intSystemUptime = Int(objOS.SystemUpTime / 3600)
Wscript.Echo strComputer & " has been up for " & intSystemUptime & " hours."
wscript.echo ""
Next
Set objWMIService = nothing
Set colOperatingSystems = nothing
End If
Next

Resource Manager Web Interface

2007-02-12T11:17:00.000-05:00

It's no secret that the resource manager summary database, while robust and filled with wholesome goodness, can be a pain in the ass to deal with. It's gotten better with the introduction of report center in PS3 and PS4, but it's still pretty basic. On several occasions, I've asked Citrix about this, and the response has always been, "It's all there, just write a query."

Fair enough, but if you're like me you don't really have time to devote to doing sql and asp.net development just to provide some useful metrics to some assclown manager. Fortunately if your name happens to the Jason Conger, you're nothing like me. In fact, I would wager that you're a fair bit smarter because this is exactly what Jason has done.

Enter Web Interface for Resource Manager. Just like it sounds - it's an easy way to pull meaningful data from the RM Summary Database and display it in a simple graphical format. Wow. Truly a deeper shade of soul.

Just to be fair, one of the managers at Citrix did author a similar tool a couple years back that was asp based. It's good, but it's not on the level with Jason's. I think it can still be downloaded from the Citrix website if you want to compare.

J turned me on to his website at www.jasonconger.com. Kudos to JC for a job well done. He's got some other cool toys for you MFCom code junkies out there too.

I hate web applications.

2007-02-06T19:53:00.000-05:00

The problem with publishing a browser in Citrix is that it becomes very difficult to control what the hell these tards that call themselves users are actually doing.

Case in point, we have a slew of applications on our intranet that are accessed via a central login provided by websphere. Hence to access any one of them, a user needs to log in to the main page first. So it's just about impossible to limit what these wankers can get to since they all have the same launch page to get there.

So as one might imagine we're having performance problems with a web app. Surprise! Of course as we all know, some crap application going bulimic on system resources is always a Citrix issue. Oh right, because the chance of some half-cocked web application having problems is far and remote! Never mind that it was written by some 2 dollar outsourced developer who could likely not even spell "Terminal Services" much less write anything to run on it.

Like any other homicidally frustrated system admin, we went back to the original business group who absolutely had to have the application published or the company would never make another dime and we calmly said to them, "Hey, your shit is broken."

Then we said it again.

...and again.

...and again.

(you get the idea)

Finally, I consider taking a hostage when I receive an email from one of these business whelks saying that they have no reason to believe that the application is causing performance issues.

AGGGH!! WHAT??

How about the edgesight reports (great product, btw), screenshots, perfmons, and RM reports we sent you? How about the 15 years of experience I bring to the table that might lead me to believe that perhaps I would be able to spot a problem application when it repeatedly projectile vomits all over my damn servers? How about because I friggin say so?

Sometimes it's not even worth bringing the KY.

-CG

The very first post!!

2007-02-02T22:14:00.000-05:00

Hi Folks,

Citrix guy here. And yes, this is the first post. You found it. Lucky friggin you.

Normally, the first post is reserved for fruity little blitherings about who I am, what I do, things I like, and other little factoids to help you get to know me.

Well screw that. I don't really care if you know me, and honestly it's probably better that you don't. I'm kind of an ass hole sometimes.

So on to the Citrix stuff. It's been a week from hell. Our normally stable environment has been riddled with stability problems. All of which have landed squarely on my lap. There's nothing better than some tard of a manager on a crisis call trying to tell you how to do your job. Yes please yell at me some more and then ask me again if the server has been rebooted.

The diagnosis is easy enough. It's a ticketing black hole. The ZDC logs show that some LLS ticketing request crapped out. Then low and behold Web Interface requests start to queue up on the xml broker and pretty soon things start to break down into dung.

The problem is that I'm probably too dumb to figure out what is randomly causing my Metaframe servers to take a dump when trying to issue tickets. It's one of those things that is going to turn out to be exceedingly simple like setting the "GOCOMPLETELYTOSHIT" value to zero in the registry. Of course, I could call my friend J who would listen to the sound of the mouse click over the phone and determine that a .dll file was the wrong version on three of the servers, but that would be the easy way out.

J of course is smarter than me and no longer works for our company.