Edit Your Hosts File

On occasion you will need to edit the hosts file on your machine. Sometimes because of an attack or prank, and others so that you can simply and freely control access to websites and network traffic.

hosts files have been in use since ARPANET. They were used to resolve hosts names before DNS. hosts files would be massive documents used to aide the network name resolution.

Microsoft kept the hosts file alive in Windows networking which is why it varies very little whether used in Windows, OS X or Linux. The syntax stays mostly the same across all platforms. Most hosts files will have several entries for loopback. We can use that for the basic example for the typical syntax.

The first part will be the location to redirect the address to, the second part will be the address that you will want to redirect, and the third part is the comment. They can be separated by a space, but for ease of reading are typically separated by one or two tabs.

127.0.0.1 localhosts #loopback

Now let’s look at accessing the hosts files in the different operating systems…

Windows 7

To access the hosts file in Windows 7 you can use the following command in the Run Line to open notepad and the file.

notepad c:\windows\system32\drivers\etc\hosts

Once notepad is open you can edit the file. In this example we will block Facebook. To do this just enter in the following after the # mark.

0.0.0.0    www.facebook.com

Now that you have edited your Hosts file make sure to save it.

Now notice if we try to access Facebook in IE we can’t get to the page.

We also were not able to get to it in Google Chrome… (check notes at the end). Also for more info on editing your Hosts file, check out The Geek’s article on how to create a shortcut to quickly edit your Hosts file.

Ubuntu

In Ubuntu 10.04 and most Linux distro’s you can edit the hosts file directly in the terminal. You can use your favorite editor or even open your favorite GUI text editor. For this example we will use VIM. Like Windows 7, Ubuntu’s hosts file is located in the /etc/ folder, though here it is in the root of the drive. In order to edit the file you will need to open it as root which is why we use sudo here.

Now that it is open we can edit it to redirect Facebook into nothing. You will notice that with Ubuntu there is also a section for IP6. For most needs you will only need to edit it the top section and ignore the IP6.

Now we can save the file and try to go to Facebook.com. Just like in windows we will see that we are now redirected to a site that does not exist.

Snow Leopard (OS X 10.6)

In Snow Leopard, accessing the hosts file is very similar to Ubuntu. Begin in terminal and use your favorite editor, even is you wish to call a GUI text editor, it is easier to do so from terminal.

The file will look a bit more like Windows, only with a little less explanation. Again we are going to redirect Facebook.

This time it seems that 0.0.0.0 is a loopback and will direct you to the computers Apache test page.

Read More

How To Install DD-WRT On NETGEAR's R6300 802.11ac Wireless Router

tep 1: Download DD-WRT for the R6300

The first step -- like all the other steps, now that I think about it -- is very simple. Grab the latest DD-WRT build for the R6300 from our downloads area and unarchive the file. You will find a file with the .CHK extension inside the archive.

Step 2: Log Into the R6300's GUI

Navigate to 192.168.1.1 in your favorite browser and enter your username and password. Then, head to the Advanced tab at the top, and click Administration in the left menu panel.

Step 3: Upload DD-WRT Firmware to the R6300

In the Administration panel, click Router Upgrade. A new option will pop up asking you to browse for the upgrade file to use -- simply select the .CHK file for the upgrade that you unarchived in step 1.

Note that you will most likely, depending on the version, be presented with a warning regarding the firmware version being "older than the one you had." Simply bypass the warning by clicking through, and the router will begin the update.

When I performed the update, it happened extremely quickly, and I panicked at first -- thinking that it may have corrupted the router. However, this wasn't the case, and it was just that fast of a process. Allow the R6300 to reboot and settle for a few minutes before trying anything. (You may also want to perform a 30-30-30 reset, which the professionals usually recommend after flashing a new firmware. I did not do this and it worked fine, but your mileage may vary.)

Step 4: Log In to DD-WRT and Reset Password

Assuming the upgrade completed successfully, you'll be presented with an initial password reset screen, where you'll input your username (I suggest "admin") and password. Make sure to save this, of course, or else you'll have to do a hard reset and start all over.

After taking care of this, check out the main screen and make sure all is well.

Step 5: Complete Some Basic Setup Steps and Reboot

Now, it's recommended that you configure a few initial settings in the router to get things rolling, such as setting up your 2.4 GHz and 5.0 GHz access points (with encryption, of course).

uPnP is not enabled by default in the build as of this writing, so make sure to enable that as well.

After getting all set with the basics, perform an additional reboot to ensure all is well and your settings have been retained by the router.

Initial Testing of DD-WRT for the R6300

In my initial tests, the firmware has been performing extremely well. All of my devices have been immediately recognized, throughput is top notch as expected, uPnP is working flawlessly -- all is good.

Some users on the DD-WRT forums have reported that the 5 GHz band is not working properly, and as this is an early build as of the time of this writing (10/30/2012) some bugs are to be expected, or at least not surprising. However, 5 GHz worked for me with no issues, and has been working for many other users as well. One suggestion is to try different channels and also to eliminate any outside interference from other devices.

Please post your experiences with the R6300 DD-WRT buiild in our dedicated DD-WRT forum!

Read More

Turns on or disable Windows Firewall.

If you enable this policy setting, 

Windows Firewall runs and ignores the "Computer Configuration\Administrative Templates\Network\Network Connections\Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting.

If you disable this policy setting,

 Windows Firewall does not run. This is the only way to ensure that Windows Firewall does not run and administrators who log on locally cannot start it.

If you do not configure this policy setting, 

administrators can use the Windows Firewall component in Control Panel to turn Windows Firewall on or off, unless the "Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting overrides.

Read More

How To use Software Restriction Policies in Windows Server 2003

How to start Software Restriction Policies

For the Local Computer Only

1. Click Start, point to Programs, point to Administrative Tools, and then click Local Security Policy.
2. In the console tree, expand Security Settings, and then expand Software Restriction Policies.

For a Domain, a Site, or an Organizational Unit on a Member Server or a Workstation that is joined to a Domain

1. Open Microsoft Management Console (MMC). To do so, click Start, click Run, type mmc, and then click OK.
2. On the File menu, click Add/Remove Snap-in, and then click Add.
3. Click Group Policy Object Editor, and then click Add.
4. In Select Group Policy Object, click Browse.
5. In Browse for a Group Policy Object, either select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit, and then click Finish.
   
   Alternatively, you can create a new GPO, and then click Finish.
6. Click Close, and then click OK.
7. In the console tree, go to the following location:
   Group Policy Object Computer_name Policy/Computer Configuration or User/Configuration/Windows Settings/Security Settings/Software Restriction Policies

For an Organizational Unit or a Domain on a Domain Controller or a Workstation that has the Administration Tools Pack installed

1. Click Start, point to All Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. In the console tree, right-click the domain or organizational unit that you want to set Group Policy for.
3. Click Properties, and then click the Group Policy tab.
4. Click an entry in Group Policy Object Links to select an existing GPO, and then click Edit.
   
   Alternatively, you can click New to create a new GPO, and then click Edit.
5. In the console tree, go to the following location:
   Group Policy Object Computer_name Policy/Computer Configuration or User Configuration/Windows Settings/Security Settings/Software Restriction Policies

For Your Site and on a Domain Controller or a Workstation that has the Administration Tools Pack installed

1. Click Start, point to All Programs, point to Administrative Tools, and then click Active Directory Sites and Services.
2. In the console tree, right-click the site that you want to set Group Policy for:
   • Active Directory Sites and Services [ Domain_Controller_Name. Domain_Name]
   • Sites
   • Site
3. Click Properties, and then click the Group Policy tab.
4. Click an entry in Group Policy Object Links to select an existing Group Policy object (GPO), and then click Edit.
   
   Alternatively, click New to create a new GPO, and then click Edit.
5. In the console tree, go to the following location:
   Group Policy Object Computer_name Policy/Computer Configuration or User Configuration/Windows Settings/Security Settings/Software Restriction Policies
   Important: Click User Configuration to set policies that will be applied to users, regardless of the computer to which they log on. Click Computer Configuration to set policies that will be applied to computers, regardless of the users who log on to them.
   
   You can also apply software restriction policies to specific users when they log on to specific computer by using an advanced Group Policy setting named loopback.

How to prevent Software Restriction Policies from applying to Local Administrators

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. In the details pane, double-click Enforcement.
4. Under Apply software restriction policies to the following users, click All users except local administrators.

Notes:

• You may have to create a new software restriction policy setting for this GPO if you have not already done so.
• Typically, users are members of the local administrator group on their computers in your organization; therefore, you may not want to turn on this setting. Software restriction policies do not apply to any users who are members of their local administrator group.
• If you are defining the software restriction policy settings for your local computer, use this procedure to prevent local administrators from having the software restriction policies applied to them. If you are defining the software restriction policy settings for your network, filter user policy settings based on membership in security groups by using Group Policy.

How to create a Certificate Rule

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. In either the console tree or the details pane, right-click Additional Rules, and then click New Certificate Rule.
4. Click Browse, and then select a certificate.
5. Select a security level.
6. In the Description box, type a description for this rule, and then click OK.

Notes:

• For information about how to start the software restriction policies in MMC, see "Start software restriction policies" in Related Topics in the Windows Server 2003 Help file.
• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• By default, certificate rules are not turned on. To turn on certificate rules:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry key:
     HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  3. In the details pane, double-click AuthenticodeEnabled, and then change the value data from 0 to 1.
• The only file types that are affected by certificate rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
• For software restriction policies to take effect, users must update policy settings by logging off from and then logging on to their computers.
• When more than one rule is applied to policy settings, there is a precedence of rules for handling conflicts.

How to create a Hash Rule

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. In either the console tree or the details pane, right-click Additional Rules, and then click New Hash Rule.
4. Click Browse to find a file, or paste a precalculated hash in the File hash box.
5. In the Security level box, click either Disallowed or Unrestricted.
6. In the Description box, type a description for this rule, and then click OK.

Notes:

• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• You can create a hash rule for a virus or a Trojan horse to prevent the malicious software from running.
• If you want other users to use a hash rule so that a virus cannot run, calculate the hash of the virus by using software restriction policies, and then e-mail the hash value to other users. Never e-mail the virus itself.
• If a virus has been sent through e-mail, you can also create a path rule to prevent users from running mail attachments.
• A file that is renamed or moved to another folder still results in the same hash.
• Any change to a file results in a different hash.
• The only file types that are affected by hash rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
• For software restriction policies to take effect, users must update policy settings by logging off from and then logging on to their computers.
• When more than one rule is applied to policy settings, there is a precedence of rules for handling conflicts.

How to create an Internet Zone Rule

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. In the console tree, click Software Restriction Policies.
4. In either the console tree or the details pane, right-click Additional Rules, and then click New Internet Zone Rule.
5. In Internet zone, click an Internet zone.
6. In the Security Level box, click either Disallowed or Unrestricted, and then click OK.

Notes:

• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• Zone rules apply to Windows Installer packages only.
• The only file types that are affected by zone rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
• For software restriction policies to take effect, users must update policy settings by logging off from and then logging on to their computers.
• When more than one rule is applied to policy settings, there is a precedence of rules for handling conflicts.

How to create a Path Rule

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. In either the console tree or the details pane, right-click Additional Rules, and then click New Path Rule.
4. In the Path box, type a path or click Browse to find a file or folder.
5. In the Security level box, click either Disallowed or Unrestricted.
6. In the Description box, type a description for this rule, and then click OK.
   
   Important: On certain folders, such as the Windows folder, setting the security level to Disallowed can adversely affect the operation of your operating system. Make sure that you do not disallow a crucial component of the operating system or one of its dependent programs.

Notes:

• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• If you create a path rule for a program with a security level of Disallowed, a user can still run the software by copying it to another location.
• The wildcard characters that are supported by the path rule are the asterisk (*) and the question mark (?).
• You can use environment variables, such as %programfiles% or %systemroot%, in your path rule.
• To create a path rule for software when you do not know where it is stored on a computer but you have its registry key, you can create a registry path rule.
• To prevent users from running e-mail attachments, you can create a path rule for your mail program's attachment folder that prevents users from running e-mail attachments.
• The only file types that are affected by path rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
• For software restriction policies to take effect, users must update policy settings by logging off from and then logging on to their computers.
• When more than one rule is applied to policy settings, there is a precedence of rules for handling conflicts.

How to create a Registry Path Rule

1. Click Start, click Run, type regedit, and then click OK.
2. In the console tree, right-click the registry key that you want to create a rule for, and then click Copy Key Name.
3. Note the value name in the details pane.
4. Click Start, click Run, type mmc, and then click OK.
5. Open Software Restriction Policies.
6. In either the console tree or the details pane, right-click Additional Rules, and then click New Path Rule.
7. In Path, paste the registry key name and the value name.
8. Enclose the registry path in percent signs (%), for example:
   %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PlatformSDK\Directories\InstallDir%
9. In the Security level box, click either Disallowed or Unrestricted.
10. In the Description box, type a description for this rule, and then click OK.

Notes:

• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• You must be a member of the Administrators group to perform this procedure.
• Format the registry path as follows:
  % Registry Hive\ Registry Key Name\ Value Name%
• You must write out the name of the registry hive; you cannot use abbreviations. For example, you cannot substitutedHKCU for HKEY_CURRENT_USER.
• The registry path rule can contain a suffix after the closing percent sign (%). Do not use a backslash (\) in the suffix. For example, you can use the following registry path rule:
  %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK*
• The only file types that are affected by path rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
• For software restriction policies to take effect, users must update policy settings by logging off from and then logging on to their computers.
• When more than one rule is applied to policy settings, there is a precedence of rules for handling conflicts.

How to add or delete a Designated File Type

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. In the details pane, double-click Designated File Types.
4. Perform one of the following steps as appropriate:
   • To add a file type, type the file name extension in the File extension box, and then click Add.
   • To delete a file type, click the file type in the Designated file types box, and then click Remove.

Notes:

• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• The designated file types list is shared by all rules for each configuration. The designated file types list for computer policy settings is different from the designated file types list for user policy settings.

How to change the default Security Level of Software Restriction Policies

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. In the details pane, double-click Security Levels.
4. Right-click the security level that you want to set as the default, and then click Set as default.
   
   Caution: In certain folders, if you set the default security level to Disallowed, you can adversely affect your operating system.

Notes:

• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• In the details pane, the current default security level is indicated by a black circle with a check mark in it. If you right-click the current default security level, the Set as default command does not appear in the menu.
• Rules are created to specify exceptions to the default security level. When the default security level is set to Unrestricted, rules specify software that is not allowed to run. When the default security level is set to Disallowed, rules specify software that is allowed to run.
• If you change the default level, you affect all files on the computers that have software restriction policies applied to them.
• At installation, the default security level of software restriction policies on all files on your computer is set toUnrestricted.

How to set Trusted Publisher options

1. Click Start, click Run, type mmc, and then click OK.
2. Open Software Restriction Policies.
3. Double-click Trusted Publishers.
4. Click the users who you want to decide which certificates will be trusted, and then click OK.

Notes:

• You may have to create new software restriction policy settings for this GPO if you have not already done so.
• You can select who can add trusted publishers, users, administrators, or enterprise administrators. For example, you can use this tool to prevent users from making trust decisions about publishers of ActiveX Controls.
• Local computer administrators have the right to specify trusted publishers on the local computer, but enterprise administrators have the right to specify trusted publishers on an organizational unit level.

Read More

Configuring Folder Redirection

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2 Windows Server 2008

Use the Group Policy Object Editor snap-in to redirect special folders to network locations.

The primary tasks that pertain to configuring Folder Redirection include:

• Creating or selecting a GPO for Folder Redirection.
  
• Selecting Basic or Advanced Folder Redirection options. Advanced redirection allows you to apply the redirection to users that belong in a specified security group.
  
• Identifying the target folder location. You can redirect folders to any of the following locations:
  
  
  • The root of a network file share
    
  • A folder on a network share
    
  • A local folder
    
  • A home directory (only applicable if you have existing home directories in your environment)
    
• Setting permissions for root folders and users’ folders.
  

Note

• If you allow Folder Redirection to create the redirected folders on a specified network, the folders that are created in this way have proper permissions assigned to them. If you create the folders manually, you must make sure that permissions are properly assigned.
  

Redirecting Special Folders

In most cases, you should redirect special folders to the root directory instead of to a specific location because this appends the correct paths for you, including %username%.

To redirect special folders to the root directory

1. Open a GPO that is linked to the site, domain, or OU that contains the users whose special folders you want to redirect.
   
2. In the console tree, under User Configuration\Windows Settings\Folder Redirection, double-click Folder Redirection to display the special folder that you want to redirect.
   
3. Right-click the special folder that you want to redirect (such as Desktop or My Documents), and then click Properties.
   
4. Click the Target tab, and then in the Settings box, select Basic - Redirect everyone’s folder to the same location.
   
5. Under Target folder location, select Create a folder for each user under the root path.
   
6. In the Root Path box, type a Universal Naming Convention (UNC) path, such as \\servername\sharename, and then click OK.
   
7. In the Properties dialog box for the special folder, click OK.
   

The user name and folder name are appended to the UNC path automatically.

To redirect special folders to a specific path

1. Open a GPO that is linked to the site, domain, or OU that contains the users whose special folders you want to redirect.
   
2. In the console tree, under User Configuration\Windows Settings\Folder Redirection, double-click Folder Redirection to display the special folder that you want to redirect.
   
3. Right-click the special folder that you want to redirect, and then click Properties.
   
4. In the Setting box on the Target tab, select Basic - Redirect everyone’s folder to the same location.
   
5. Under Target folder location, select Redirect to the following location. In the Root Path box, type an UNC path, such as \\server\share, or type a locally valid path, such as C:\somefolder, and then click OK.
   

If necessary, you can return redirected folders to their original default locations by using the following procedure.

To redirect special folders to the local profile location

1. Open a GPO that is linked to the site, domain, or OU that contains the users whose special folders you want to redirect.
   
2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect.
   
3. Right-click the special folder that you want to redirect (such as Desktop or My Documents), and then click Properties.
   
4. In the Setting box on the Target tab, select Basic - Redirect everyone’s folder to the same location.
   
5. Under Target folder location, select Redirect to the local user profile location, and then click OK.
   

Redirecting to the home directory

It is recommended that you do not redirect to a home directory unless you have already deployed home directories in your organization. However, if you have already deployed home directories and you want to maintain compatibility with your existing home directory environment, you can redirect My Documents to the home directory.

To redirect My Documents to the home directory

1. Open a GPO that is linked to the site, domain, or OU that contains the users whose My Documents folders you want to redirect.
   
2. In the console tree, double-click Folder Redirection to display My Documents.
   
3. Right-click My Documents, and then click Properties.
   
4. In the Setting box, on the Target tab, select Basic - Redirect everyone’s folder to the same location.
   
5. Under Target folder location, select Redirect to the user’s home directory, and then click OK.
   

Note

• Domain administrators have full control over the users’ My Documents folder when you redirect My Documents to the home directory. This is the case even if you select theGrant the user exclusive rights to My Documents option on the Settings tab in the My Documents Properties dialog box.
  

Redirecting special folders based on membership in security groups

You can redirect special folders for use by members of security groups to the root directory, a specific path, the local profile directory, or to the home directory.

To redirect special folders to the root directory based on security group membership

1. Open the GPO that contains the users whose special folders you want to redirect.
   
2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect (for example, Desktop or My Documents), right-click the special folder, and then click Properties.
   
3. On the Target tab, in the Setting box, select Advanced - Specify locations for various user groups, and then click Add.
   
4. In the Specify Group and Location dialog box, under Security Group Membership, type the name of the security group, or click Browse to search for it.
   
5. Under Target Folder Location, select Create a folder for each user under the root path.
   
6. In Root Path, type the UNC path to use for redirection (for example, \\servername\sharename), and then click OK.
   
7. In the special folder’s Properties dialog box, click OK.
   

For more information about Folder Redirection, in Help and Support Center for Windows Server 2003, on the toolbar, click the Index button, in Type in the keyword to find, typefolder redirection, and then double-click the topic that you want in the index list.

Troubleshooting: Creating a Log File for Folder Redirection

Folder Redirection logs events in the Application Event Viewer log. To aid troubleshooting, administrators can also create detailed log files for Folder Redirection.

Caution

• Do not edit the registry unless you have no alternative. The registry editor, regedit.exe, bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you edit the registry, make sure to back it up first and see the Windows Server 2003 Resource Kit Registry Reference on theWindows Server 2003 Deployment Kit companion CD or at http://www.microsoft.com/reskit.
  

To enable logging for Folder Redirection

1. In the Run dialog box, type regedit, and then click OK.
   
2. Locate the following subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Diagnostics.
   
3. Create a new entry called FdeployDebugLevel of data type Reg_DWORD, and set its value to 0x0f.
   

The log file is created in %windir%\Debug\Usermode\Fdeploy.log.

Read More