What the Government should be spending on in the credit crunch

A bit off the usual topic, but...

I was at my local gym this week (part of a larger council run leisure centre) and commented on how hot the poolside and changing rooms felt - not what you need after a 5km run!! It struck me how incredibly high their energy usage must be - 3 pools, sports hall, gym, various studios etc etc with what looks like quite a thin uninsulated roof.

It struck me that instead of pumping millions into banks, the car industry, more roads, 3rd runway at Heathrow etc.. that perhaps the government should embark on a project to retrofit all public owned buildings with solar thermal and electric (where possible). This would cost many millions of pounds but provide much needed jobs by creating a whole new industry and above all would SAVE MONEY and CO2 for years to come.

My local gym has a massive flat roof structure that would be ideal for mounting the panels and tubes etc. Right now the staff are being told to switch off lights to save money... given the lighting is all low energy anyway its hard to see them saving much.

Come on Mr Brown - spend money.. lots of money, but on the right stuff.

Calculated Fields in the Query Builder

This week I had to help a customer with the aaa-reports! query builder - amazingly flexible but equally a little hard to master! So I thought I'd post here by way of a primer.

This particular customer had imported their ACS user database and wanted to list inactive users. Although there is a canned report to do this, they wanted to export the data in XLS - which meant doing it in the query builder. Because  they are using ACS password ageing, the last authentication date is actually stored inside the ACS database, and is imported into aaa-reports!

So in this case we can use the Last Authenticated field as it holds... guess what? The last authenication date. We have to create a "Calculated Field" that is essentially the result of our test condition - say users who havent authenticated for 30 days. We can then set a criteria to test the calculated column.

So to get a .XLS of inactive users (via password ageing):

1. Goto to the Query page and set the Query Type radio button to Filter/Sort
   
2. Select ACS DB User Details from the Data Sets drop down
3. On the Attributes tab select the user attributes you want to display
   
4. On the Sorting tab pick the Last Authenticated attribute then click Add Ascending
   
5. Click run

You'll now get users displayed with the oldest "last authenticated" date at the top. 

Ok, the above simple query will display all users and not just those that have been inactive for some period. To show only inactive users (say for 30 days or more) we need to modify the query slightly:

1. Back on the Attributes tab, select the Calculated Fields radio button
2. In the Name field enter IsInactive and in the Expression enter [Last Authenticated] < (Date() - 30)
3. Click on Set to save the calculated column.
4. Click Run again - you'll see a new IsInactive column with values 0 (false) and -1 (true)
   
5. Finally on the Criteria tab select the new calculated col in the Attribute drop down, select <> from the Operator dropdown and enter 0  (zero) into the Value. Click Add
6. Click Run again and now you will only see users whose last authentication date was more than 30 days ago.

This query can now be saved (for inclusion into a batch of reports) and exported to XLS, CSV etc.

This post shows how the use of a calculated field can help modify the ready made datasets in aaa-reports!

Web Reports Beta 2

After a significant amout of testing we can now confirm additional OS support:

• Windows Server 2003, 32/64 bit, IIS6 or IIS7
• Windows Server 2008, 32/64 bit, IIS7

Some manual configuration is required depending on OS/IIS version. With IIS6 our install script should take care of everything - provided there is a Default Web Site. With IIS7 there are some non-default installation features that are required - asp.net and IIS6 management compatibility and these are documented in the user guide.

Web Report Beta

As described in the previous post... the BETA of aaa-reports! enterprise web reporting is now on the download site.

This can be installed on the same server as aaa-report! enterprise itself and requires that IIS is installed with the "Default Web Site" on port 80.

If your IIS doesnt have the Default Web or isnt running on port 80 you'll have to manually add and configure a virtual web folder using the IIS Management Console.

Web Reporting!

The aaa-reports! enterprise product will soon feature web based reporting. The initial release will feature a simple to use query builder that enables a table based report on each of the primary ACS log types (eg Failed Attempts, TACACS+ Adminstration, RADIUS accounting etc)

Once you're happy with the query and the number of matching records founds, the results are displayed in a tabular report with PDF,CSV,XLS export, paging and sorting controls.

Security is handled by Windows authentication on the web server - users will require an account on the aaa-reports! server but can be put into a dedicated group that only allows web access.

CSVSync V3.0

Released a week or two ago, this new version of csvsync can automate the process of exporting the ACS database via the Support function.

We posted about this a while back here and now its officially released.

If you have an active support & maintenance contract you get an automatic 40% discount on list price, and if you purchase aaa-reports! enterprise you'll get it bundled.

Cisco Secure ACS View 4.0

Well they've been talking about it for long enough... and finally Cisco Secure ACS View 4.0 arrived. Although we have not actually been able to see it in the flesh on first look it seems OK. However Cisco have made some questionable architecture choices.. #1 being that they based log collection on syslog and #2 its appliance only.

Ok, so syslog is one of the widest used logging protocols (historically) but its hardly the robust transport one would wish for when logging security events. The implementation by ACS is also hampered by their choice of format... basically each syslog packet comprises a single line of log data of the form "attr=value, attr=value, ... " so there is a lot of bloat in carrying the attribute names. Its unlikely that complex ACS deployments will be able to log all the required attributes in a single syslog packet (1024 characters max in ACS 4.1). The View user guide does include the odd explanation that is ok to receive partial data because the rest will get picked up at a later date (presumably by importing the ACS cab file). Yikes - creating a cab requires you stop (or at least pause) the ACS services AND importing the same data twice could lead to duplicate rows.

So it uses syslog (unreliable, non-ack'd, un-encrypted) to send partial (1024 characters we guess) log entries using a bloated ascii format that buries attributes names in the data. That could add up to a whole load more WAN traffic if your ACSs are distributed.

extraxi aaa-reports! on the other hand uses the tried and tested bulk download over http(s) using our csvsync client to download logs. The benefit here being that ACS just does what it does best - log locally then csvsync/aaa-reports! download the logs in bulk (and with encryption) at a time of your choosing.

Being appliance only there is no trial version so you cant test it before buying. It really only works with 4.1(4) but needs 4.2(1) to work well - so if you currently still have some 3.x servers in production you're out of luck. extraxi aaa-reports! works with all versions from 2.x through to 4.x and can be installed on anything from Windows XP to Server 2003 Terminal Server running inside VMWare.

On the topic of database size, View is based on Sybase SQL Anywhere which has a fixed 4GB of storage. aaa-reports! enterprise (due for release end of May 2008) uses multiple SQL Server Express databases offering a total of 48GB.

More as it arrives...

Installing aaa-reports! with Terminal Services

As with any other application, to install on Windows Terminal Server you should do one of two things:

1. Use "Add/Remove Programs" in Control Panel to launch the application installer rather than just double-click the setup.exe, or
2. From the command line type "change user /install" before running the setup.

Either of one of these will put the server into install mode and will ensure that installed components and registry changes are made for all users.

Failure to do one of the above will result in the application not functioning correctly for other users because DLLs will not be installed into the global Windows\System32 folder but instead into your own personnal folder under Documents and Settings.

We recommend using the Add/Remove Programs method as is by far the simplest and future proofed.

New Features For CSVSync

Quite a few customers have expressed the desire to generate and collect the ACS Support Cab (package.cab) using csvsync. This gives the advantage of being able schedule the operation via a script on a remote PC - essential if your ACS is the Appliance kind.

In testing now is the next version of csvsync with exactly this feature. You can connect to the following versions of ACS to collect the cab file:

Appliance v4.0(1) onwards
Software v4.1(4) onwards

Prior to v4.1(4) the Support page was not available via ACS Admin Software version.

Beta expected the next couple of weeks.

ACS v4.1(4) Compatibility Issue Resolved

A new build of aaa-reports! v2.2.1 has been posted today that resolves all known issues with importing ACS v4.1(4) cab and dump files.

Hoorah!