June 30, 2009

Fix for “Value does not fall within expected range”

Encountered a very strange error recently when trying edit the properties of a MOSS 2007 page.

Error: Value does not fall within the expected range
not_expected_range

This particualr page was created on a development sharePoint farm and then the content database was migrated to a production Farm.

Searching the Web it looks like this is a pretty common occurrence that can happen in one of two ways:

  1. If the content database is migrated from one Farm to Another (development farm to production farm)
  2. Or if you copy an aspx page using SharePoint designer from one server to another severs (development server to production server).

Once you try to edit the Page Setting, the error will occurs. (more…)

June 28, 2009

SPN Discussion and MOSS/Sharepoint

Filed under: Sharepoint — Tags: , , , , , , , , , — Tim Lefler @ 8:00 pm

Like many people, we want MOSS 2007 or SharePoint to use Kerberos to authenticate because we already have Active directory setup or the applications we present to the end user require authentication to another machine within our domain.

I just went through a lot of pain and agony trying to get MOSS to work with Kerberos!!!  This is what I discovered:

You cannot have two web sites on the same physical server with the same root URL, just differentiated by a port number (this is important…. by default MySite and the Central Admin site are on different ports…. and SharePoint seems to want to create a web application on on a different port # by default).  A problem occurs when multiple web applications use Kerberos for authentication and are accessed using the same URL, unless the web application runs with the same Application Pool  security account as the other web applications.

For example these two web applications would have a problem authenticating using Kerberos:

http://domain

http://domain:1000

SharePoint Best practices state that a different Application Pool Account should be used for each web application or service…. I’m not satisfied this is correct (please comment).. (more…)

June 26, 2009

MOSS Logical Design and Migration Discussion

Filed under: Sharepoint — Tags: , , , , , , , , — Tim Lefler @ 1:42 pm

Recently our department began an implementation of Microsoft Office SharePoint Server 2007 (MOSS).  Like most shops we wanted to make sure we designed the infrastructure so that we could ensure maximum availability and scalability.  Our initial goal was to start small, but quickly, so we could start to work on returning the rather expensive investment in SharePoint.  We could then continue to develop content and applications.  To support this goal we produced 2 farms: One to be used for production and the other to be used for development.  The idea being to move applications/content from the development environment after testing and certification. (more…)

June 24, 2009

Forensic Analysis of ET Malware VPP Technologies Spyware

Filed under: Incident Response — Tim Lefler @ 9:32 am

Forensic Analysis of:
Snort alert “ET Malware VPP Technologies Spyware” fired 6/23/2009 11:17:30 AM

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:”ET MALWARE VPP Technologies Spyware”; flow:established,to_server; uricontent:”/DittoIA.jsh?pid=”; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2002348; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_VPPTechnologies; sid:2002348; rev:3;)

http://doc.emergingthreats.net/bin/view/Main/2002348

Snort Rule fired while attempting to GET a jsp page on the machine a72-246-30-33.deploy.akamaitechnologies.com (72.246.30.33)

“Coupon Printer for Windows” found installed on computer. (more…)

Powered by WordPress