Search

Heads Up! Big vulnerabilities in Cisco PIX, VMware and Mac OSX

Posted by Irving Popovetsky on June 9th, 2008

Last week, quite a few major vulnerabilities were discovered in some of our customer’s favorite products, namely:

  • VMWare (all products, from ESX Server all the way down to VMware Player)
  • Cisco PIX and ASA (versions 7.1, 7.2, 8.0 and 8.1)
  • Mac OS X (Both Server and Client editions, 10.4 and 10.5 are affected)

Quite a few of these vulnerabilities are remotely exploitable and especially dangerous on the PIX and unprotected OSX and VMware installations.   VMware also looks like it may have a  local “VM breakout” bug or two, watch out for these.   We strongly recommend getting these products updated as soon as possible.

For more information and relevant links, check out the US-CERT Cyber Security Bulletin SB08-161.  Search for the product you’re running on this page.

Thinking about switching to Zimbra?

Posted by Irving Popovetsky on May 16th, 2008

I switched ProStructure over to Zimbra about a month ago.   The good news is that we are absolutely loving it.   The sad part is that this is our 4th open source based workgroup/calendaring solution in 5 years of doing business.

The Backstory

We started out with Webcal.pl for 2 years, then “upgraded” to OpenXchange (which was terrible) for 6 months or so, then SugarCRM for the last 2 years or so.   Nobody was particularly happy with SugarCRM either, the interface was slow and buggy, and the interoperability with fat clients and devices never really worked out.  You could say that our commitment to open source was hurting us, because none of the solutions were successful business enablers.

The hype around Zimbra has been considerable.  Zimbra seemed to be advertised as the best open source based MS Exchange competitor. Although the Zimbra folks mention Exchange as little as possible, it is clearly where they set their sights.

Mini Review

Held at face value, the single most compelling feature for users is Zimbra’s Outlook-killer web interface.  The user experience is really fantastic, I’ve seen Outlook, Thunderbird and Apple Mail/iCal users drop their fat clients and switch to using the web interface exclusively.  It is just that good.   You really have to try it out for yourself to see cool things like the Gmail-style email conversation views, smart tags and calendar views.  The built-in IM functionality is a brilliant add-on as well.

But that’s not all.  The commercial version of Zimbra (which is worth every penny) provides an Outlook connector which provides an Exchange-like user experience that is nearly imperceptible to most users.  You can also purchase (as an add-on) over-the-air sync functionality for Windows Mobile, Palm and Blackberry devices (BES required).

Zimbra is also totally interoperable.  The web interface works under IE, Firefox and Safari.  Zimbra provides classic POP/IMAP/SMTP services for those that want to keep their old mail client.  Calendars can be accessed via the iCalendar protocol, and even exposed to other users as authenticated or open icalendar or free/busy feeds. The IM functionality is fully standards-based, and supports any XMPP capable client like Pidgin/Gaim, Adium or Trillian.

But is Zimbra right for you?

Every business needs Calendaring just as much as it needs Email capability these days.  In my opinion, business fall into 4 camps:

1. You have already invested in a recent version of Exchange or equivalent (Groupwise, Domino, etc)

Probably not.  You’ve already invested 5 or 6 digits worth of capital, if not more, to get to your existing platform.  If it’s running poorly, or seeing low rates of user acceptance, you may want to look at other factors first.  There could be architecture or user expectation issues that could be managed with outside help, if you need it.  You can consider a forklift to a better platform several years down the line, but a wholesale email/calendaring platform switch now may cost you your job.

2. You are running older versions of Exchange (5.5 or 2000)

Lets face it, most IT systems are fully depreciated within 3-5 years.  Microsoft has left you out in the cold with mainstream support.  Your server hardware is ancient and dying.  Or did you try to just move that aging email system to newer hardware?   You know who you are.

Upgrading to newer version of Exchange may not have to be a foregone conclusion for you.  The cost savings of migrating to Zimbra may be significant.  You’ll have to buy new servers, but those servers may be spec’ed a little bit leaner than you’d need for Exchange.  You’ll need to retrain your admins anyway.  The big issue is:  Are you prepared to start running Linux servers?   If you’re a blue-blooded Microsoft shop with absolutely no Linux experience or aspirations, Zimbra is probably not for you, Linux (or MacOS X server) is a requirement.   If you think that you can train (or hire) some Linux talent, and pull it off, you will be loved by your users and management alike.

3. Those that currently run an open source based system (Postfix, Sendmail, etc + Sugar, webcal,etc)

What are you waiting for?  Seriously, you’re probably holding your users back from having proper calendaring and scheduling, AntiSpam and AntiVirus filtering (unless you’re running AMaViS) or internal IM functionality.  Go forth, and download the “Network Edition trial”.   If you decide that the $399 “starter edition” or $35/user pricing is too expensive, let your license expire and it will automatically fall back to the open source edition functionality, disabling Outlook/mobile integration.


4. Those that currently have a hosted/outsourced solution

If letting someone else run your Email server doesn’t give you the heebeejeebies, check out the long list of providers lining up to do hosted Zimbra, which tends to run cheaper per-mailbox than hosted Exchange.

My Only concern about Zimbra is…

Yahoo and Microsoft.   Last year, Zimbra was acquired by Yahoo.  So far, Yahoo has let Zimba flourish, but all of this may change if Microsoft gets its hands on Yahoo.  We thought the threat had passed, but recent news shows that Carl Icahn is launching a proxy battle to replace Yahoo’s board with a more Microsoft-friendly one.

What do you think Microsoft is going to do if it purchases the new single biggest threat to its very profitable Exchange product?  I don’t think anyone who’s been following Microsoft’s decades of brutal predatory takeovers and monopolistic business practices is expecting Zimbra, its staff and any patent portfolio to survive in one piece or be spun off.

The fact that large parts of Zimbra is released under the GPL may not help.   Microsoft may try threaten patent lawsuits against Zimbra’s customers as well as any business that sprouts up to support the GPLed version.  They’ve done it with Linux, remember that they funded Baystar which funded SCO’s lawsuit against IBM, Novell, and a few large Linux customers.

Just to be clear, I’m not saying that the threat of Microsoft takeover should ruin the the taste for Zimbra.  Just be smart, and keep an eye out for the writing on the wall.

-Irving Popovetsky

Principal Consultant, ProStructure Consulting

Welcome to the ProStructure Blog!

Posted by Irving Popovetsky on May 14th, 2008

Welcome, readers!

Here at ProStructure Consulting, we’re extremely enthusiastic about technology and the trials and tribulations of its implementation in the field.  We are fortunate enough to get to build, manage and secure some of the most sophisticated IT environments in the Pacific Northwest.  As a result of our position, we get to do things that nobody has ever done (or fully documented) before.

We believe that the web in general is and always will be the ultimate resource for IT professionals who are trying to understand, implement and troubleshoot pretty much anything.  The purpose of this blog is to chronicle some of our adventures, document challenges, lessons learned and best practices that nobody has yet written about, and in general give back to the IT community by providing our own resource.

We’re starting out with a team of three writers, each with very unique talents and specialties:

  • Irving Popovetsky, Principal Consultant: Anything and everything about information security, systems engineering, storage, disaster recovery, IT policy and management.
  • Brandon Psmythe, Principal Consultant: Large-scale networks and monitoring, network engineering, information security, IT policy and management
  • Amber Pham, Systems Engineering Consultant: Microsoft Operating Systems and Servers, Project Management, Data Center design and engineering

Stay tuned as we begin to fill out some recent war stories.