Flushing infected mail traffic from Postfix server

Flushing infected mail traffic from Postfix server

Postfix consists of a combination of server programs that run in the background, and client programs that are invoked by user programs or by system administrators.

The Postfix core consists of several dozen server programs that run in the background, each handling one specific aspect of email delivery. Examples are the SMTP server, the scheduler, the address rewriter, and the local delivery server. For damage-control purposes, most server programs run with fixed reduced privileges, and terminate voluntarily after processing a limited number of requests. To conserve system resources, most server programs terminate when they become idle.

Client programs run outside the Postfix core. They interact with Postfix server programs through mail delivery instructions in the user's ~/.forward file, and through small "gate" programs to submit mail or to request queue status information.

Other programs provide administrative support to start or stop Postfix, query status information, manipulate the queue, or to examine or update its configuration files.

If Postfix cannot deliver a message to a recipient it is placed in the deferred queue.  The queue manager will scan the deferred queue to see it if can place mail back into the active queue.  How often this scan occurs is determined by the queue_run_delay.  Postfix will scan the incoming queue at the same time as the deferred queue just to make sure that one does not take all the resources and so each can continue to move messages.

The real question is, What is causing messages to be deferred?  One of the major reasons that messages are deferred is that your server is going to place mail to “unknown recipients” into the deferred queue if they do not have a legitimate user to go to.

First thing that should be done to analyze the mails that are stuck in the queue is typing the mailq command. If you see a lot of mails in the queue shown in the output, than something fishy is going on on you server. Just looking on the mails, IT people should recognize the domain that has the most mails in the queue. When you find out the domain example.com than the next step to do is to run a bash script that will delete only those mails that are from the infected domain.

#!/bin/bash

match="$1"

find /var/spool/postfix/deferred/*/ -type f -exec grep -l $match '{}' \; | xargs -n1 basename | xargs -n1 postsuper -d

find /var/spool/postfix/active/ -type f -exec grep -l $match '{}' \; | xargs -n1 basename | xargs -n1 postsuper -d

This simple scripts are using bash language to find the deferred and active mails from the user keyboard input on the CLI. After that the script is executing the postsuper -d command that is flushing the queue with that specific domain. 

match="$1" is a simple regex that matched text by the first capturing group, in our case a user inputed domain. 

After this the mail queue should be emptied with the infected mails and the server will have some freed up resources. Another faster or simple solution, if the mails are not important at the moment, is to flush the complete queue in the deferred folder.

For this we have a simple command: postsuper -d ALL deferred

Feel free to comment..

Server 2008 R2 as RADIUS for CISCO ASA VPN Clients

Server 2008 R2 as RADIUS for CISCO ASA VPN Clients

As in every Enterprise or a private Data Centar network one must use various of IT systems to insure the security of via meshed systems. The other day I implemented a Cisco 5520 Failover scenario and the main problem I had with the users, is how will they manage so many passwords for VPN, AD, Mail and etc. So I thought why not use Kerberos for VPN and simplify the tasks. 

This easy done task I will explain as short and much I can. The main goal is to make Cisco ASA failover to use the Active Directory for authenticating the users against VPN policy.

Easiest way to configure ASA quick is using the ASDM utility. I use CLI only for initial interface and http commands , after that all is downstream.

First we need to configure an object:

Using the Firewall section we expand Objects and select IP names. Then click ADD and describe the Radius server. After that we enter the IP address of the Intranet located Domain controller.

Next step is to define a AAA Radius group:

Click the Remote Access VPN section.

Expand AAA Setup and select AAA Server Groups.

Click the Add button to the right of the AAA Server Groups section.

Give the server group a name, like TEST-AD, and make sure the RADIUS protocol is selected.

Accept the default for the other settings. 

And click OK.

Next step is to add our RADIUS server to this created group:

Select the server group created in the step above.

Click the Add button to the right of Servers in the Select Group.

Under the Interface Name select the interface on the ASA that will have access to the RADIUS server, most likely inside.

Under Server Name or IP Address enter the IP Name you created for the RADIUS server above.

Skip to the Server Secret Key field and create a complex password. Make sure you document this as it is required when configuring the RADIUS server. Re-enter the secret in the Common Password field.

Leave the rest of the settings at the defaults and click Ok.

To enable RADIUS on Server 2008 we must add a role:

Connect to the Windows Server 2008 server and launch Server Manager.

Click the Roles object and then click the Add Roles link on the right.

Click Next on the Before You Begin page.

Select the Network Policy and Access Services role and click Next.

Under Role Service select only the Network Policy Server service and click Next.

Click Install.

After launching the NPS tool right-click on the entry NPS(Local) and click the Register Server in Active Directory. Follow the default prompts.

We need to define a Radius CLIENT on Server 2008 for our ASA Cluster:

Right-click on RADIUS Clients and select New RADIUS Client.

Create a Friendly Name for the ASA device. I used “CiscoASA” but if you had more than one you might want to make it more unique and identifiable. Make sure you document the Friendly Name used as it will be used later in some of the policies created.

Enter the Server Secret Key specified on during the ASA configuration in the Shared secret and Confirm shared secret field.

Leave the default values for the other settings and click OK. See Figure 1 for all the complete RADIUS Client properties.

Connection Request Policy

Expand the Policies folder.

Right-click on the Connection Request Policies and click New.

Set the Policy Nameto something meaningful. I used CiscoASA because this policy is geared specifically for that RADIUS client. Leave the Type of network access server as Unspecified and click Next.

Under Conditions click Add. Scroll down and select the Client Friendly Name condition and click Add…

Specify the friendly name that you used when creating the RADIUS Client above. Click OK and Next.

On the next two pages leave the default settings and click Next.

Under the Specify a Realm Name select the Attribute option on the left. From the drop down menu next to Attribute: on the right select User-Name. Click Next again.

Review the settings on the next page and click Finish.

Create a Network Policy

Right-click the Network Policy folder and click New.

Set the Policy Name to something meaningful. Leave the Type of network access server as Unspecified and click Next.

Under Conditions click Add.

Add a UsersGroup condition to limit access to a specific AD user group. You can use a generic group like Domain Users or create a group specifically to restrict access.

Add a Client Friendly Name condition and again specify the Friendly Name you used for your RADIUS client.

Click Next. Leave Access granted selected and click Next again.

(Important Step) On the authentication methods leave the default selection and add Unencrypted authentication (PAP, SPAP).

Accept the default Constraints and click Next.

Accept the default Radius Settings and click Next. Review the settings and click Finish.

Restart the Network Policy Server service.

The last thing left is to Test and Save the config.

If necessary re-launch the ASDM utility.

Return to Configuration -> Remote Access VPN -> AAA Setup -> AAA Server Groups.

Select the new Server Group you created.

From the Servers in the Selected Group section highlight the server you created. Click the Test button on the right.

Select the Authentication radio button. Enter the Username and Password of a user that meets the conditions specified in the Network Policy created above then click OK.

Feel free to comment.

Security ethical hacking checklist

Security ethical hacking checklist

We can define an Ethical Hacking Expert as a person who has many skills in many segments of Information Technology. On behalf of the owners of the Information Technology Systems an expert in Network and Systems attacks the complete organization. The main goal is to find vulnerabilities that would a malicious person use to exploit to gain important informations. 

These tasks include Penetration testing, risk assessment and intrusion testing. Many companies also involve some code reviewers to scan the web application code. Complete set of tasks that are involved in, for example a penetration test, are useful to find weaknesses in open source code that is used often in application development. Developers often are too busy in creating the applications and contributing to the opensource community, so the security concerns are not always highlighted. 

These situations require an expertise from people that can objectively look at the code and to verify the completion of the cycles needed for application implementation.

I will explain some basic steps in my White Hat general checklist that every IT security concerned people should know and use. 

RECONNAISSANCE

This is a military term that was used to seek out the intentions and plans of the enemy, using various methods to find out capabilities and composition of the enemy. In ethical hacking world this word is used for information gathering of the target. This is useful to find the weakest spot in the target Information Technology system to exploit and use it for the final goal.

There is also another side of  footprinting that is used for protecting the system instead of attacking it. First of the basic methods of information gathering is:

PING the remote target system to gather basic IP info.

For example Start-Run-CMD>  ping www.google.com  

Or some other range of public IP addresses to see if there are some hosts that are alive on the other side. This is a good starting point for every information gathering. 

PORT scanning of the remote services running on the target system. These TCP scans can be individual or we can scan a range of ports to identify different services. We can use a great tool found on www.nmap.org 

An example of a command line scan:   NMAP -T4 -A -v scanme.nmap.org

Target public information such as company info, telephone numbers, email addresses and many other are very useful to create a big picture. This can be done via whois lookups of the company domain and gathering info from DNS protocol. There are some great online sites for this http://www.uwhois.com/

EMAIL tracking is a good way to analyze the email header which will provide us the informations on the IP stack of the mail servers and other gateway functionalities. A good application that can be used for this is the EmailTracker that can be found on http://www.emailtrackerpro.com/

Network Connections from your computer or from the target systems can be useful to find out incoming and outgoing connections that are persistent and important for the target users. A free command utility called netstat is the best and fastest way to achieve this. 

An example command line:   netstat -ano

Explore the internet libraries to find out the history of the web page is sometimes important. Some URLs are useful in this information gathering.

https://archive.org/

http://www.thememoryhole.org/

Company location can be found using Google Earth. This is important if the company has IT storage rooms in many countries and from a network standpoint, a clear picture on GeoIP locations.

Network nodes displaying will show us the information on various path we can get to the target system. This is useful to find out the most optimized way to enumerate services in the target systems. A cool application for this is called NeoTrace and can be found on this link: http://neotrace-pro.en.softonic.com/

DNS Enumeration

By Enumerating DNS it is possible to get some important public (May be sometime Private information too) information such as Server name, Server IP address, Sub-domain etc.

Useful PERL script called dnsenum.pl can be found on this URL

SCANNING

In general we have three types of scanning:

• Port scanning
• Network scanning
• Vulnerability scanning

Active information gathering produces more details about your network and helps you see your systems from an attacker’s perspective. We can see which server systems are alive and what services they are providing for the target users. The important fact is the system operating systems and the architecture that they are using. 

I can number some types of PORT scanning methods:

- Vanilla: the scanner attempts to connect to all 65,535 ports

- Fragmented packets: the scanner sends packet fragments that get through simple packet filters in a firewall

- UDP: the scanner looks for open UDP ports

- Sweep: the scanner connects to the same port on more than one machine

- Stealth scan: the scanner blocks the scanned computer from recording the port scan activities

Network Scanning is the process of examining the activity on a network, which can include monitoring data flow as well as monitoring the functioning of network devices. Network Scanning serves to promote both the security and performance of a network. Network Scanning may also be employed from outside a network in order to identify potential network vulnerabilities.

Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security.

SUBNET Information whether public or private is very important for time consuming security testing methods. A very useful tool for gathering the subnet information is the AngryIP application. This application is available on this location http://angryip.org/w/Home

There are some useful tools used for target system scannings:

Mcafee superscan tool

http://www.mcafee.com/us/downloads/free-tools/superscan.aspx

Network port scanning

Scan network ports with NetScanTools Pro or Nmap.

UDP ports scanner, very fast and powerfull WUPS

Unicornscan is an attempt at a User-land Distributed TCP/IP stack for information gathering and correlation

The app can be found on http://www.unicornscan.org/

ENUMERATION

Using the previous gathered information the attacker usually start scanning against the victim such as Port scanning, Banner Grabbing, Vulnerability Scanning, Finding Username/Emails address. This is usually active attack(May get detected by IDs or may get blocked by Firewalls.

Enumeration is the first attack on target network; Enumeration is a process to gather the information about user names, machine names, network resources, shares and services ; Enumeration makes a fixed active connection to a system

Null session - exploitation of Windows SMB communications network protocols.

We can exploit a remote machine without any credentials using: net use \\ip address\\IPC$ ""/u:""

If we have only one authenticated user credentials we can use this exploit for many machines in the domain. Also a good tool for enumeration these weak spots is enum4linux.pl found on this url 

NetBios/over/TCP/IP can be used with a integrated tool nbtstat that will display protocol statistics and current TCP/IP connections. We can also provide our information database with the MAC address. 

Usage:   nbtstat -A 192.168.1.1

FTP Enumeration - a crafty tool on NIX is useful for enumerating the TCP port 21 with useful information like server version and the list of users on the target system.

# perl -MCPAN -e shell

 cpan> install Getopt::Std  

This is used for the installation. And the usage on the target system

Usage: ftp-user-enum.pl [options] (-u username|-U file-of-usernames) (-t host|-T file-of-targets) 

TELNET to a service on different number of ports to see if a service is running on the remote server.

Usage: telnet <IP or FQDN> <port>

List of ports for services can be found on this URL.

A list of some useful tools used for enumeration:

IP Tools

http://www.ks-soft.net/ip-tools.eng/downpage.htm

SoftPerfect Network Scanner is a free multi-threaded IP, NetBIOS and SNMP scanner with a modern interface and many advanced features. It is intended for both system administrators and general users interested in computer security. The program pings computers, scans for listening TCP/UDP ports and displays which types of resources are shared on the network, including system and hidden ones.

http://www.softperfect.com/products/networkscanner/

SomarSoft's DumpSec is a (free) security auditing program for Microsoft Windows NT/2000. It dumps the permissions (DACLs) and audit settings (SACLs) for the file system, registry, printers and shares in a concise, readable format, so that holes in system security are readily apparent. DumpSec also dumps user, group and replication information. DumpSec is a must-have product for Windows NT systems administrators and computer security auditors.

https://www.enisa.europa.eu/activities/cert/support/chiht/tools/dumpsec-dump-windows-acl-and-audit-settings

Enumerate some devices like routers, printers, servers, backup devices and similar with default passwords. Many useful passwords can be found on google searches, and one of the list can be found on this URL.

Netcat is a simple networking utility which reads and writes data across network connections using the TCP/IP protocol. It's a wonderful tool for debugging all kinds of network problems. It allows you to read and write data over a network socket just as simply as you can read data from stdin or write to stdout. I have put together a few examples of what this can be used to accomplish.

Establishing a connection and getting some data over HTTP:# 

nc example.com 80

GET / HTTP/1.0

<HTML>

<!-- site's code here -->

</HTML>

HACKING

When above steps has be done the attacker start exploiting the all found vulnerability which may lead to compromise the System or an website. 

There are of four types of password attack:

1. Passive online attack - man in the middle, sniffing and similar

2. Active online attack - password guessing

3. Offline attack - brute force attack, directory attack and hybrid attacks

4. Non technical attack - social engineering

A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer.[1] The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool.

Steganography (Listen) is the art and science of encoding hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message. It is a form of security through obscurity.

An ethical hacker should equip himself with a database and dictionaries of default password. Some useful URLs can be a good starting point.

http://www.defaultpassword.com/?char=&action=dpl
http://www.cirt.net/passwords
http://www.virus.org/default-password%20

LOPTHCRACK can be used as a useful tool to recover passwords
Can be found on this URL

HACKING Windows Server administrator password is a powerful method of gaining access of target systems. Windows servers use the SAM database to encrypt and store passwords. There are many tools to exploit these passwords. One of them is offline NT password recovery tool that can be found on this URL

Keyloggers are useful software tools that log every keystroke that a user generates on the keyboard. These stealth tools are useful to capture credentials on target systems.
Free versions can be found on this URL More stealthy keyloggers are USB ones that hold the keylogger software on the USB stick, that can be manipulated inside the organization and can send credentials outside the corporate networks. Useful software can be downloaded from this URL

Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more.

Openpuff is a opensource stganography tool that can be used to create hidden scripts and apps inside cool extensions like PDF and JPG. Can be found on this URL

Lynis is an auditing tool for Unix/Linux. It performs a security scan and determines the hardening state of the machine. Any detected security issues will be provided in the form of a suggestion or warning. Beside security related information it will also scan for general system information, installed packages and possible configuration errors.

Yersinia is a network hacking tool designed to take advantage of the weaknesses in some network protocols. It pretends to be a framework for analyzing deployed networks and systems. It implements a number of attacks for the following protocols: STP, CDP, DTP, DHCP, VTP, ISL and etc.

The Metasploit Framework is an open-source development platform for creating security tools and exploits. The framework is used to test systems, verify patch installations, and perform regression testing. The framework allows users to configure exploit modules and test systems against attack.

The PsEXEC tool allows white hat people to remote execute applications and processes on target systems. It can launch interactive command prompts on remote computers.
Syntax:       psexec \\computer[,computer[,..] [options] command [arguments]

Core Impact is a penetration-testing tool for testing security threats. It allows systems administrators to test
security patches, network infrastructure, and system upgrades before an attacker does. It is frequently updated,so it is likely to stay ahead of new exploits.

Ratproxy is a semiautomated and largely passive Web application security audit tool. It detects and annotates potential problems and security-relevant design patterns based on the observation of existing and user-initiated traffic. It does not generate a high volume of traffic, taking very little bandwidth.


In this blog I tried to create a small checklist of tools I use , and some of the I have skipped (to be continued). Also the checklist methodology I think will be a good starting point for enthusiastic people that are concerned for the security of their IT systems.

To be continued ...

Check status of IMAP server

Check status of IMAP server

The Internet Message Access Protocol (commonly known as IMAP) is an Application Layer Internet protocol that allows an e-mail client to access e-mail on a remote mail server. The current version, IMAP version 4 revision 1 (IMAP4rev1), is defined by RFC 3501. An IMAP server typically listens on well-known port 143.

I had configured a Dovecot server with IMAP status, for many users , so I needed a mechanism to check if the server is responding on client requests during the high traffic. I wanted to do this using a Cron job and a simple script. This script will telnet to the IMAP port on the Linux server and check the status every 60 seconds. This is how often I configured the Cron job, it can be configured on every 5 minutes or so.

Now let us take a look on this simple code I wrote:

#!/bin/bash

#http://itstuffallaround.blogspot.com/

#program to check if connection is possible with Dovecot and log errors and success full connections

if telnet localhost 143 </dev/null 2>&1 | grep -q Escape; then

  echo "Connected Dovecot on $(date)" >> DOVSTATUS.txt

else

  echo "No connection to Dovecot on $(date)"  >> DOVSTATUS.txt

fi

The simple BASH language script is constructed of a single loop, that telnets to port 143 and returns the status of the service to a dovstatus.txt file. 

The parameter /dev/null 2>&1 was very useful to me, because it will disable returning the on screen prompt for action on telnet, and Escape the login sequence because it is not neccessary, it will redirect both the output and the error streams. Even if your program writes to stderr, that output will not be shown. After this rename the file as .sh and add the execute perrmissions on it. Configure it as a cron job and wait for the results in the dovstatus.txt file.

Feel free to code more!

Improved Linux DDOS detection program

Improved Linux DDOS detection program

With a lot of help with some friend on the Linux comunity, I have improved the DDOS detection program on Linux systems. This BASH code gives the IT people possibility to fine list what is currently going on at their servers. And what is more important where from.

The code presented in the following blog is not to be used in loops of any sort becuase it would deny the admin resources to log on.

 #Zeljko Milinovic - http://itstuffallaround.blogspot.com/

 #Cached lookup of ddos whois IP sockets

 #v1.1

 #!/bin/bash

 cachefile="$HOME/ddostestercache"

 # return 0 if address is to be filtered from the processed

 filter()

 {

 case "$1" in

 0.* | 127.* | 10.* | 172.1[6-9].* | 172.2[0-9].* | 172.3[0-1].* | 192.168.* | 169.254.*)

 return 0

 ;;

 esac

 return 1

 }

 remote_ips()

 {

 # print only IPv4 addresses

 netstat -tun4 | awk '/:/ {gsub(/:.*/,"",$5);print $5}' | sort -n | uniq -c

 }

 get_country()

 {

 local country=$(sed -nr "s/^$1 (.*)/\1/p" $cachefile 2>/dev/null)

 if [ -z "$country" ];then

 # some queries produce multiple lines so for now use only the first line..

 country=$(whois "$1" | sed -nr 's/^country:[[:space:]]+(.*)/\1/ip' | head -1)

 country=${country:-unknown}

 # cache search result for future use

 echo "$1 $country" >> $cachefile

 fi

 # let's not print the text "unknown" to screen

 [ "$country" = "unknown" ] && unset country

 echo "$country"

 }

 remote_ips | while read count ip;do

 if ! filter $ip;then

 echo "$count $ip $(get_country $ip)"

 fi

 done

And finally the output for the script:

1 50.31.xxx.xxx US

9 98.28.xxx.xxx DK

1 109.12.xxx.xxx BA

As we can see, in the output we have 3 IP addresses, numbered, listed with concurrent connections , and their country origin. This is very useful to detect where from is the attack, and to mitigate fast.

Feel free to code more and comment.

Linux Security script to determine DDOS origin location

Linux Security script to determine DDOS origin location

In computing, a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet.

On various Nix server setups we are always exposed to the DDOS attacks from various other similar setups or intended use. Often in some cases our server is used as a Botnet machine to exploit resources on other systems.

These attacks can be verified from the shell in a form of many open sockets from one or more IP addresses. Often these open sockets are more than 150 , which is not normal. Many IT people are using a DDOS prevention scripts to ban those IP addresses. I stumbled upon a request from a friend to write a script that will tell us the Country of attack origin. This was always missing in our troubleshooting. 

So I have written a small and useful script, that is a combination of often used Netstat and Whois commands that can be found online. Also similar script code can be found on the internet, and people can adjust the code to their needs. I needed a script that will associate and display the origin of country and the IP socket combination.

Code

#!/bin/bash

{

cat=$( netstat -ntu  |  grep ':'  |  awk '{print $5}'  |  sed 's/::ffff://'  |  cut -f1 -d ':'  |  sort  |  sort -nr | less);

for i in $cat; do

Country=$( whois $i | grep -i Country | awk '{print $2}' );

echo "Land+IP=  $Country $i ";

done;

}

end of code.

To elaborate more on code I will explain the details. I am using the Bash shell scripting, which is very common. This code is using a Netstat command from the classic and tuned ddos Deflate script that is common for fighting DDOS attacks. 

netstat -ntu  |  grep ':'  |  awk '{print $5}'  |  sed 's/::ffff://'  |  cut -f1 -d ':'  |  sort  |  sort -nr | less

This command gives us the output of IP sockets and we print them out using the AWK for text processing. I have attached the sed switch to replace the empty addresses and space with null ffff value. 

The sort and less switches are helpful for sorting and properly displaying the addresses. I have put this into on CAT function and defined this concencated output with a $ sign as a variable.

The variable is further used for a loop that is needed for the WHOIS command which will tel use the Country of origin. Classic for loop is using a i for the increment value. 

Country=$( whois $i | grep -i Country | awk '{print $2}' );

If we use the whois command with the grep function for the Contry it will only display us the Country of origin. So I have used this command with the incremented concencated display in the loop.

Simple enough we get a display of current IP sockets with Country of origin:

Land+IP=  BA 71.222.xxx.xxx

Land+IP=  BA 71.222.xxx.xxx

Land+IP=  BA 71.222.xxx.xxx

Land+IP=  BA 71.222.xxx.xxx

Land+IP=  IT 88.138.xxx.xxx

Land+IP=  IT 88.138.xxx.xxx

Land+IP=  IT 88.138.xxx.xxx

Land+IP=  IT 88.138.xxx.xxx

Land+IP=  BA 61.38.xxx.xxx

Land+IP=  BA 61.38.xxx.xxx

Land+IP=  BA 61.38.xxx.xxx

Land+IP=  BA 61.38.xxx.xxx

Land+IP=  BA 61.38.xxx.xxx

So this output will generate all the Sockets, and if we see many exact same sockets from one Country we can pinpoint the location and origin from the attack. Script can be more fine tuned so everyone is welcome. 

Feel free to code.

Configure Corefig as a free managament tool for Hyper-V 2012

Configure Corefig as a free managament tool for Hyper-V 2012

Reading a lot of articles online I have found that Hyper-V 2012 has some cool new features that are free to use. Some of them are in battle with VMware, like HA and the new SMB 3.0 protocol. I have installed a nested Hyper-V 2012 under the VMware setup to test the management tools. 

One tool I have found as a useful collection of PowerShell scripts is the Corefig. Here are some steps to use with this management tool and how to configure it.

On a fresh install of the Hyper-V Hypervisor one should enable the Remote Managament under the initial powershell options. To copy the files from the downloaded Corefig site firewall should be disabled on the Hyper-V 2012. This can be done via a simple command using netsh.

The next step is to download the Corefig.zip file and copy it to the Hyper-V hypervisor. One can copy the files using the Netbios protocol, and simply typing the \\hyper-vsrv location and creating a folder under the root of the Hypervisor called Corefig.

The link for the Corefig installation can be found here.

After extracting the files , we should start the Powershell script to initialize the Corefig installation process and to make it as a startup service. This can be done via a simple command:

CD C:\COREFIG

POWERSHELL .\COREFIG.PS1

Soon after that we have an instance of the Corefig started and can use all of the managament functions it offers us. A simple screenshot will show the GUI of the tool.

We can easily change the network settings, a small Control Panel utilities, and general Hyper-V settings. One great security tool is to manage the firewall via the GUI is easy for creating the first initial rules. I have disabled the firewall for testing purposes.

Acording to Microsoft this tools is verified to work with these setups:

• Verified: Microsoft Windows Server 2012 (Core Installation)
• Verified: Microsoft Windows Server 2012 (Complete GUI Installation)
• Verified: Microsoft Hyper-V Server 2012

Feel free to use the tool and comment on it.