Working in IT 3.0: xp_cmdshell

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Working in IT 3.0: xp_cmdshell

Wizard of the Deep: Sep 25, 2005; Another productive workday

Honestly? I wouldn't gently caress that situation with a stolen dick. They sound like cheap-rear end motherfuckers, and getting money out of them is going to be like pulling teeth.

In an ideal world, I'd tell them "Get a contract with a local MSP for on-going support. I'll work with them for $(3*[reasonableRate]), and you deal with them from now on." You almost certainly don't want to deal with these folks on an regular basis; it sounds like they're going to screw you seven ways a week and twice on Sundays.

If you absolutely want the money, I'd say figure out your hourly rate, quintuple it, and make them buy a block of hours up-front. No work starts until you have a cashier's check.

# ? Feb 18, 2016 23:08

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 10:19

Sickening: Jul 16, 2007; Black summer was the best summer.

Something Awesome posted:

What would you guys charge hourly for this kind of work?

Potential client is a place I worked for 5 years ago when I was a broke college student, since then I am now a semi-senior systems analyst at an F200. I don't really need the money, but hey, everyone loves money, plus I could do it from home (they are 4 hours away) while getting piss drunk). The client is notoriously pushy and demands the world and never wants to pay a thing to get it.

The current jam they are in? They want me to come fix the systems I setup 5 years ago and have since not received a minute of regular maintenance (but hey they just always worked so well!111). So now, predictably, I would imagine the final drive in the raid5 array died, logs filled up the drives, backups haven't been running since no one decided to ever cycle tapes or pay attention to that annoying morning scripted e-mail. I am sure other landmines are laying around like malware, pirated software, general IT misery.

Oh and they need to be up NOW and it's my responsibility for some reason? I refuse to hand out my cell phone number and am working through a dedicated e-mail address. They are being reasonable and saying they want some short term contract work, but I am not sure what the hell I should charge them and get in writing before I get anywhere near this toxic waste dump.

Quote some obscene triple digit/hour rate and force a contract signature? Tell them are are SOL? Anyone have any fun stories about old clients/bosses coming out of the woodwork?

I would think of a thing I would want to buy and charge for whatever that thing was. Say you like boats, (who doesn't like boats) then I would figure out a hourly rate that would get me that boat. Also, get at least a big chunk of it up front and be clear about terms of when the job ends and its no longer yours.

Oh, also don't let you wife talk you out of said boat with false promises of trips to Europe. She will just get pregnant and use your gently caress-you-money to spoil your child.

# ? Feb 18, 2016 23:12

KillHour: Oct 28, 2007

I got paid $150 for an hours' work for a company I knew was good for it and wouldn't be a pain in my rear end or come back to haunt me. I also gave them a deal because we have a mutual friend.

My fee for "companies that are a pain in my rear end" is triple.

Sickening posted:

I would think of a thing I would want to buy and charge for whatever that thing was. Say you like boats, (who doesn't like boats) then I would figure out a hourly rate that would get me that boat. Also, get at least a big chunk of it up front and be clear about terms of when the job ends and its no longer yours.

Oh, also don't let you wife talk you out of said boat with false promises of trips to Europe. She will just get pregnant and use your gently caress-you-money to spoil your child.

Sounds like "gently caress-you-money" to me. :v:

# ? Feb 18, 2016 23:12

Inspector_666: Oct 7, 2003; _{benny with the good hair}

Powershell is fun. Even though I know I'm pretty much reinventing the wheel, I've spent my free time for the past several days writing a script to create new AD users, with lookups for OU and groups and all that.

Learning all of the required stuff and getting it working within a few tries has made me feel very fancy. Now I just need actual buy-in from my manager to get it up to full functionality, and maybe even extend it to making their Google Apps account.

The real end goal would be to have HR just fill out a form and have nobody actually even have to touch it, which would actually be entirely doable by passing stuff to this script now that I think about it...

Sickening posted:

I would think of a thing I would want to buy and charge for whatever that thing was. Say you like boats, (who doesn't like boats) then I would figure out a hourly rate that would get me that boat. Also, get at least a big chunk of it up front and be clear about terms of when the job ends and its no longer yours.

Oh, also don't let you wife talk you out of said boat with false promises of trips to Europe. She will just get pregnant and use your gently caress-you-money to spoil your child.

Inspector_666 fucked around with this message at 23:37 on Feb 18, 2016

# ? Feb 18, 2016 23:24

MC Fruit Stripe: Nov 26, 2002; around and around we go

Sickening posted:

I would think of a thing I would want to buy and charge for whatever that thing was. Say you like boats, (who doesn't like boats) then I would figure out a hourly rate that would get me that boat. Also, get at least a big chunk of it up front and be clear about terms of when the job ends and its no longer yours.

Oh, also don't let you wife talk you out of said boat with false promises of trips to Europe. She will just get pregnant and use your gently caress-you-money to spoil your child.

Still bitter after all these years lol

# ? Feb 18, 2016 23:33

BrianRx: Jul 21, 2007

Any advice for someone looking to switch fields to IT from something non-technical? I've got a BA and experience doing administrative office work and program support. At my last workplace, we had a very small IT staff (3 guys for about 500 users) and so they threw me basic support issues to deal with whenever my workload allowed it. I resolved connectivity, printer, and general "What's wrong with my computer" problems but had to escalate anything that was network related. I also did most of their writing when they needed to communicate new policies to students and staff. I liked doing it a lot more than the job I was being paid for, and, as I just moved crosscountry for my wife's job and am currently unemployed, want to move into something entry level in IT though it would mean a pretty large pay cut initially.

I'm studying for my A+ cert and should have it done soon, but don't really know where to go from there to make myself marketable. When I left my last job, the IT director told me to list him as a reference and that he would validate basically whatever I wanted to put on my resume, so I've got that in my pocket. My concern is that even entry-level jobs seem to be requesting 1-3 years of dedicated help desk or similar experience and I'm not sure I can write around that on my resume and cover letter.

Has anyone else made a similar jump or hired someone who has? If so, what was your experience?

# ? Feb 18, 2016 23:40

H110Hawk: Dec 28, 2006

Something Awesome posted:

What would you guys charge hourly for this kind of work?

Potential client is a place I worked for 5 years ago when I was a broke college student, since then I am now a semi-senior systems analyst at an F200. I don't really need the money, but hey, everyone loves money, plus I could do it from home (they are 4 hours away) while getting piss drunk). The client is notoriously pushy and demands the world and never wants to pay a thing to get it.

The current jam they are in? They want me to come fix the systems I setup 5 years ago and have since not received a minute of regular maintenance (but hey they just always worked so well!111). So now, predictably, I would imagine the final drive in the raid5 array died, logs filled up the drives, backups haven't been running since no one decided to ever cycle tapes or pay attention to that annoying morning scripted e-mail. I am sure other landmines are laying around like malware, pirated software, general IT misery.

Oh and they need to be up NOW and it's my responsibility for some reason? I refuse to hand out my cell phone number and am working through a dedicated e-mail address. They are being reasonable and saying they want some short term contract work, but I am not sure what the hell I should charge them and get in writing before I get anywhere near this toxic waste dump.

Quote some obscene triple digit/hour rate and force a contract signature? Tell them are are SOL? Anyone have any fun stories about old clients/bosses coming out of the woodwork?

Pass. I would worry about them suing you.

# ? Feb 18, 2016 23:55

Internet Explorer: Jun 1, 2005

KillHour posted:

At least shut down those ports on the switch. Thinking about an unused port being hot is enough to give me nightmares.

gently caress this line of thinking. This is stupid network admin poo poo from 20 years ago. There is absolutely no reason it to have a port hot. Do you superglue your existing poo poo into the jack? What's stopping someone from unplugging something else on the network and plugging what they want in? Nothing. If you care about port security, do it the right way. Otherwise, saying poo poo like this is a good way to get anyone with half a brain to ignore the rest of the poo poo coming out of your mouth.

# ? Feb 18, 2016 23:58

Sickening: Jul 16, 2007; Black summer was the best summer.

Internet Explorer posted:

gently caress this line of thinking. This is stupid network admin poo poo from 20 years ago. There is absolutely no reason it to have a port hot. Do you superglue your existing poo poo into the jack? What's stopping someone from unplugging something else on the network and plugging what they want in? Nothing. If you care about port security, do it the right way. Otherwise, saying poo poo like this is a good way to get anyone with half a brain to ignore the rest of the poo poo coming out of your mouth.

This is a bit extreme but yes, I do agree that turning off ports is generally an outdated idea. If you are so security inclined to worry about ports being on then you should be inclined enough to have physical access restricted at the switch with security measures in place to protect the client side of the wire. Generally someone turning off ports is just adding an extra step to an already secure process.

# ? Feb 19, 2016 00:10

H110Hawk: Dec 28, 2006

Internet Explorer posted:

gently caress this line of thinking. This is stupid network admin poo poo from 20 years ago. There is absolutely no reason it to have a port hot. Do you superglue your existing poo poo into the jack? What's stopping someone from unplugging something else on the network and plugging what they want in? Nothing. If you care about port security, do it the right way. Otherwise, saying poo poo like this is a good way to get anyone with half a brain to ignore the rest of the poo poo coming out of your mouth.

I think s/he needs a hobby.

I will meet you halfway: unpatched ports can be disabled.

# ? Feb 19, 2016 00:11

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

MC Fruit Stripe posted:

Still bitter after all these years lol

I was about to ask, did someone lose a boat to a wife and a surprise baby

# ? Feb 19, 2016 00:13

Sickening: Jul 16, 2007; Black summer was the best summer.

H110Hawk posted:

I think s/he needs a hobby.

I will meet you halfway: unpatched ports can be disabled.

Give me a reason for the port to be disabled.

MF_James posted:

I was about to ask, did someone lose a boat to a wife and a surprise baby

It was me and yes, I am still a little sore about it.

Sickening fucked around with this message at 00:17 on Feb 19, 2016

# ? Feb 19, 2016 00:14

Tigren: Oct 3, 2003

Sickening posted:

Give me a reason for the port to be disabled.

It was me and yes, I am still a little sore about it.

If it's not disabled, someone might super glue a cable into it?

# ? Feb 19, 2016 00:22

KillHour: Oct 28, 2007

Internet Explorer posted:

What's stopping someone from unplugging something else on the network and plugging what they want in?

Sticky MAC.

But to be fair, I used to follow this same line of thinking. "Well, it's not bulletproof, so why use it? It's just extra hassle with no extra security." See also: MAC filtering. But it's not an all or nothing thing. The only ports that need to have stuff plugged in and moved all the time are the userland ports. And I don't really care about those because I don't trust those ports with poo poo. I treat a conference room with the same level of trust I treat my DMZ. There are tons of situations where I want ports off, though. If I have two runs going to an AP, for instance. Or IP cameras. Or anything else that doesn't ever get moved around.

Then again, I work at a bank. You don't get to update Java here without written permission.

Sickening posted:

Give me a reason for the port to be disabled.

Unpatched ports don't really need to be disabled. But then again, they don't really need to be enabled, either. I'd probably disable them just in case some level 1 guy decides to play "oh look, a free port!"

# ? Feb 19, 2016 00:23

Inspector_666: Oct 7, 2003; _{benny with the good hair}

Sickening posted:

Give me a reason for the port to be disabled.

I feel like unpatched ports are the ones you least need to disable because if you're worried about somebody patching into it, the problem is with physical security and if the problem is with physical security nothing else you do matters!

# ? Feb 19, 2016 00:23

KillHour: Oct 28, 2007

Inspector_666 posted:

I feel like unpatched ports are the ones you least need to disable because if you're worried about somebody patching into it, the problem is with physical security and if the problem is with physical security nothing else you do matters!

As a physical security guy, I really, really want to agree with this.

But the pragmatist in me knows it will be an idiot that technically has access rights to be there, but fucks something up on accident.

Edit: TL;DR: Sticky MAC and disabling ports aren't security against bad guys. They're security against stupid people.

# ? Feb 19, 2016 00:26

H110Hawk: Dec 28, 2006

Sickening posted:

Give me a reason for the port to be disabled.

Maybe he won't notice.

# ? Feb 19, 2016 00:32

KillHour: Oct 28, 2007

H110Hawk posted:

Maybe he won't notice.

I noticed. :colbert:

# ? Feb 19, 2016 00:33

Thanks Ants: May 21, 2004; #essereFerrari

H110Hawk posted:

This is my office building, as designed by me and cabled by a professional: http://imgur.com/a/y4xej

Dual wiring pays for itself the first time a stack goes down, or the wireless goes down, etc. We terminate our APs there, and every desk gets 2 ports, both POE, both always hot. Everything is labeled end to end. This is one of two closets for the floor. Keystone colors match the cable colors, so each desk has a "blue" and a "white" port.

I want as many switch ports as I have horizontal runs too :smith:

# ? Feb 19, 2016 00:33

Alereon: Feb 6, 2004; Dehumanize yourself and face to Trumpshed; College Slice

Is "Data Analyst" still a real job title for a position that means "know the system, the data in it, and analyze/correct errors before they are identified in production"? It kinda feels like something from the 90s. For reference my company still employs "computer operators".

# ? Feb 19, 2016 01:57

Internet Explorer: Jun 1, 2005

KillHour posted:

Sticky MAC.

But to be fair, I used to follow this same line of thinking. "Well, it's not bulletproof, so why use it? It's just extra hassle with no extra security." See also: MAC filtering. But it's not an all or nothing thing. The only ports that need to have stuff plugged in and moved all the time are the userland ports. And I don't really care about those because I don't trust those ports with poo poo. I treat a conference room with the same level of trust I treat my DMZ. There are tons of situations where I want ports off, though. If I have two runs going to an AP, for instance. Or IP cameras. Or anything else that doesn't ever get moved around.

Then again, I work at a bank. You don't get to update Java here without written permission.

Unpatched ports don't really need to be disabled. But then again, they don't really need to be enabled, either. I'd probably disable them just in case some level 1 guy decides to play "oh look, a free port!"

The entire conversation was about user-land ports.

# ? Feb 19, 2016 02:21

Proud Christian Mom: Dec 20, 2006; READING COMPREHENSION IS HARD

There isn't a rate. They're lovely people and no amount justifies it. Be happy you aren't working there and move on

# ? Feb 19, 2016 02:27

KillHour: Oct 28, 2007

Internet Explorer posted:

The entire conversation was about user-land ports.

You were talking about APs in the same paragraph. I more took issue with the fact that you said you'd stop taking someone seriously if they advocated for shutting down ports. I can see why you wouldn't, but it still has its place.

# ? Feb 19, 2016 02:35

H110Hawk: Dec 28, 2006

Internet Explorer posted:

The entire conversation was about user-land ports.

Don't worry I don't turn off my ports in server-land either. Except on our MX gear. Which has nothing to do with security and everything to do with making sure we control when links come up for cross connects.

# ? Feb 19, 2016 02:54

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

My home lab is a big pile of ~10 Intel NUCs. I'm tired of having this huge mass of AC adapters plugged in everywhere. Is anyone aware of any 19V DC power supplies with multiple outputs I could use to tighten things up? The NUC uses a regular-ish 2.5mm/ID 5.5mm/OD barrel jack.

e: I don't keep any powered peripherals plugged into these things so I'm also not really concerned with theoretical max power draw

Vulture Culture fucked around with this message at 03:56 on Feb 19, 2016

# ? Feb 19, 2016 03:40

Judge Schnoopy: Nov 2, 2005; dont even TRY it, pal

KillHour posted:

As a physical security guy, I really, really want to agree with this.

But the pragmatist in me knows it will be an idiot that technically has access rights to be there, but fucks something up on accident.

Edit: TL;DR: Sticky MAC and disabling ports aren't security against bad guys. They're security against stupid people.

Our security is way more physical than administrative. Ports are all hot all the time, but access to the building requires a keycard or employee escort so we know who's inside. Switches are configured to email us when ports come up or go down, which happens so rarely we definitely take notice when it happens. Also, no dhcp on the data vlan so I wish my dumb users the best of luck if they try plugging in their own poo poo.

# ? Feb 19, 2016 04:03

MC Fruit Stripe: Nov 26, 2002; around and around we go

On my life, I can not get this over eager project manager to understand why she will not be getting domain admins. She just wants to help as much as possible! Why won't I let her help!?!

# ? Feb 19, 2016 04:26

Virigoth: Apr 28, 2009; Corona rules everything around me
C.R.E.A.M. get the virus
In the ICU y'all......

MC Fruit Stripe posted:

On my life, I can not get this over eager project manager to understand why she will not be getting domain admins. She just wants to help as much as possible! Why won't I let her help!?!

She only wants to help because she cares. SHE BELIEVES IN THE PRODUCT!

(or is trying really hard not to get fired)

# ? Feb 19, 2016 04:38

KillHour: Oct 28, 2007

Judge Schnoopy posted:

Our security is way more physical than administrative. Ports are all hot all the time, but access to the building requires a keycard or employee escort so we know who's inside. Switches are configured to email us when ports come up or go down, which happens so rarely we definitely take notice when it happens. Also, no dhcp on the data vlan so I wish my dumb users the best of luck if they try plugging in their own poo poo.

I feel like no DHCP is WAY more administrative overhead than no open hot ports.

# ? Feb 19, 2016 04:39

Sickening: Jul 16, 2007; Black summer was the best summer.

KillHour posted:

I feel like no DHCP is WAY more administrative overhead than no open hot ports.

Seriously. Disabled ports and no dhcp? Lets make our jobs harder without the benefits of added security. What a weird direction this thread has taken.

# ? Feb 19, 2016 04:42

MC Fruit Stripe: Nov 26, 2002; around and around we go

Virigoth posted:

(or is trying really hard not to get fired)

Honestly, I think it's this.

I'm on a call with her and one of our customers and she has guessed wrong nearly every time her mouth has opened because she's trying to sound smart and engaged, but she's kinda outdistanced herself. Just, calm down, take a breath, we're gonna get through this, sheeeesh.

# ? Feb 19, 2016 04:44

Zaepho: Oct 31, 2013

Vulture Culture posted:

My home lab is a big pile of ~10 Intel NUCs. I'm tired of having this huge mass of AC adapters plugged in everywhere. Is anyone aware of any 19V DC power supplies with multiple outputs I could use to tighten things up? The NUC uses a regular-ish 2.5mm/ID 5.5mm/OD barrel jack.

e: I don't keep any powered peripherals plugged into these things so I'm also not really concerned with theoretical max power draw

High Amperage variable DC power supply? Although it looks like my go to brand (Astron) only does 12/13.8V and 24V stuff. I'm sure there's something available out there. You could also check and see if the NUCs' regulator will handle 24VDC.

# ? Feb 19, 2016 04:51

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

Zaepho posted:

High Amperage variable DC power supply? Although it looks like my go to brand (Astron) only does 12/13.8V and 24V stuff. I'm sure there's something available out there. You could also check and see if the NUCs' regulator will handle 24VDC.

Not even sure about high amperage. Most of these are N3700s, so the TDP of the whole box is <15W. I have a small handful of i3s and i7s that I can power separately.

# ? Feb 19, 2016 04:52

KillHour: Oct 28, 2007

So, what you're saying is you're a masochist? If you don't need a lot of horsepower, just stick Xen on a tower with a bunch of NICs. gently caress, dude.

# ? Feb 19, 2016 04:55

psydude: Apr 1, 2008

KillHour posted:

Sticky MAC.

But to be fair, I used to follow this same line of thinking. "Well, it's not bulletproof, so why use it? It's just extra hassle with no extra security." See also: MAC filtering. But it's not an all or nothing thing. The only ports that need to have stuff plugged in and moved all the time are the userland ports. And I don't really care about those because I don't trust those ports with poo poo. I treat a conference room with the same level of trust I treat my DMZ. There are tons of situations where I want ports off, though. If I have two runs going to an AP, for instance. Or IP cameras. Or anything else that doesn't ever get moved around.

Then again, I work at a bank. You don't get to update Java here without written permission.

If there's this amount of security pressure, you should be investing in 802.1X and a good network access solution that support something like dynamic VLAN assignment, not configuring sticky MAC and worry about disabling ports. Oh hey, and that solution will probably help with wireless security as well.

# ? Feb 19, 2016 04:57

Zaepho: Oct 31, 2013

Vulture Culture posted:

Not even sure about high amperage. Most of these are N3700s, so the TDP of the whole box is <15W. I have a small handful of i3s and i7s that I can power separately.

well hell that means less than 1Amp per NUC so a 10 AMP power supply would be entirely sufficient. I've got a pair of 30 amp 13.8VDC supplies on my desk for my super nerd gear, so 10 amps should be nothing. If the NUC can handle the higher voltage, give yourself a little headroom on total amps and go nuts with some clever wiring. Should net you some (admittedly largely theoretical) electrical efficiency gains as well.

# ? Feb 19, 2016 04:57

KillHour: Oct 28, 2007

psydude posted:

If there's this amount of security pressure, you should be investing in 802.1X and a good network access solution that support something like dynamic VLAN assignment, not configuring sticky MAC and worry about disabling ports. Oh hey, and that solution will probably help with wireless security as well.

So you seriously think I'm advocating using that INSTEAD of 802.1X? That's like wearing kneepads instead of a helmet or having a roll cage instead of brakes.

# ? Feb 19, 2016 04:59

Judge Schnoopy: Nov 2, 2005; dont even TRY it, pal

KillHour posted:

I feel like no DHCP is WAY more administrative overhead than no open hot ports.

Dhcp isn't switch security though. And it's not actually a security measure, it's just that the network has always been running without it and nobody wants to approve setting it up. My senior admin actually thinks it will break kaspersky and our remote management tools because everything has been coded in as IP addresses. He's wrong but convincing him is futile.

It has the side benefit of making it that much more difficult for rogue devices to get on the network, and we don't have to deal with sticky mac addresses or 802.1x or disabling ports.

# ? Feb 19, 2016 05:00

KillHour: Oct 28, 2007

So what you're saying us you don't have 802.1x because you don't have DHCP. :suicide:

# ? Feb 19, 2016 05:02

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 10:19

Zaepho: Oct 31, 2013

Judge Schnoopy posted:

everything has been coded in as IP addresses

Why.. WHY DEAR GOD?? :suicide:

DNS exists for a goddamn reason.

# ? Feb 19, 2016 05:07

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Working in IT 3.0: xp_cmdshell

«‹›2913 »