Storix - Story of Anthony Johnson
Thursday, October 8. 2015
Epilogue
This story is so unbelievable, I have to share it with all of you. It has Hollywood material in it: it's a story about a hard working man who succeeds and then gets dealt bad cards. As the final good thing he does share his fortune with people he trusts. Then there is the surprising twist in the plot and he bounces back. The real surprise is when the ungrateful people don't want him back. That results in a bitter fight in the court. But as in all Hollywood flicks, there is a happy end.
All this started years ago, but my version starts two days ago when I received an e-mail. I found it from my spam-box and my initial glace was, that it was some kind of 419-scam. Something in the style of the text struck me as a scam, so I was just about to file a report of it into SpamCop, and then I saw the subject of the mail. It had word Storix in it. The mail was sent to one of my ancient addresses, which I had used with Storix. A random bulk spam wouldn't be about Storix, backups aren't that lucrative when compared to regular spam-topics, women, money or medicine.
The e-mail
This is the entire e-mail as I received it:
Subject: Notice of Copyright Infringement by Storix, Inc.
Date: Tue, 6 Oct 2015 16:15:31 -0700Dear Sir or Madam,
This letter is to inform you that you may be in possession of unauthorized and infringing copies of Storix System Backup Administrator (SBAdmin). I am the author of the software, which is protected by US Copyright Registration No. TXu000988741, and expert testimony in the US Southern California District Court case No. 14-cv-1873 H (BLM) has
indisputably determined that I am the owner, have never transferred, nor received any consideration for its license by Storix.I hold none of Storix' customers or business partners accountable, and you may continue using the current software, even if you received an infringing license after it was revoked. However, I must demand that you cease any further payment to Storix in relation to this software and refrain from downloading any further copies.I founded Storix in, Inc in 2003 to sell and support the software I had already been marketing since 1999. In 2011 I was diagnosed with terminal cancer and gifted 60% of the company shares to long term employees before taking my medical leave. Those shareholders then elected themselves as directors and officers of the corporation:David Huffman, President and CEO
Richard Turner, Director of Software Development
Manuel Altamirano, Director of Sales and Marketing
David Kinney, Director of Software SupportNo new programmers were hired, and the software has now seen little change in over 4 years. After an unlikely recovery, I returned to the company full time in 2013 to continue development of the software, working alone for 9 months on major enhancements to address known security vulnerabilities and increase the network security. After requesting that others assist in the final development and testing, I was harassed by my former employees until I left in May, 2014.After exhausting every effort to negotiate, the board was notified that I would assert my rights to the software if not given a position of control over its development. Instead, they chose to challenge my copyright. Using my remaining 40% stock, I took control of 2 board seats, but not before a 5th seat was added and occupied by David Smilkjovich, the new CEO and personal friend of Mr. Huffman. Every effort since to save the company, its employees and customers from the damages of this litigation has failed in a 3/2 vote.As Storix has been well aware since my departure, I continued development of the software, believing we would eventually work out our differences. I made no effort to disparage or compete with Storix in any way. Yet, as a decision in the copyright case grew near, they filed new action against me for unfair competition and breach of duty as a company director (San Diego County Superior Court No. 37-2017-00028262-CU-BT-CTL). After I warned them in advance of this very notice, they requested, and were denied, a motion for temporary restraining order (San Diego US District Court Court No. 14-cv-1873 H
(BLM)).Although a plaintiff in the copyright case, I'm also a 40% shareholder and a director of the company, and am obligated to do everything possible to put an end to this nonsense before the company is lost. Iwould have preferred the customers and employees remain unaware of this needless battle, but the actions taken by these individuals to protect their majority positions have resulted in the company becoming unprofitable for the first time in its history. They will accept no personal responsibility or compromise, and are now turning to a new employee stock incentive program to cover their losses. This nonsense
cannot continue.The security enhancements to the software have been completed, along with much more. Unfortunately, far too much damage has been done to me personally and financially to allow these greedy individuals to profit from my work any longer. Many of you I had worked with personally for many years, so it pains me to inform you that support for Storix SBAdmin
will very likely end when a ruling is made on the copyright case at the end of the month.Whatever the eventual outcome, I sincerely hope to rebuild your trust as well as the thriving company and innovative product I once had.Best Regards,
Anthony Johnson
Author and Owner of Storix Backup Administrator
Former President/CEO, Storix Inc.
Show me the proof!
Ok, this is all sad and cool at the same time, but how do we know that all this is legit? I don't have any solid proof, but here is what I have:
- My own records indicate, I've been using Storix back in 2004 to 2009 when I did DLT backups. Then the company got greedy and the price of licence went out of my reach. At that point, I stopped doing tape-backups and went for Bacula and USB-drives. Software free and USB-drives are very inexpensive to store backups.
- The e-mail in question may very well be sent to me, because I have a customer account at Storix, Inc.
- In the e-mail Mr. Johnson wants you to: pretty much do nothing, he doesn't want your money, he just says not to pay any more to the software company not owning copyright of his work, but he does not want you to pay him for it. Asking for nothing is not a typical request in spam.
- Motive: What would be the alternate motivation or hidden agenda for doing this? Throwing mud at his own company? Slinging mud at some people he doesn't like (anymore)? I guess, the classic ones: money and power have something to do with this. Depleting Storix, Inc. main source of turnover is the primary motive.
- The origin of the mail is from Google. Yes, there is some Google spam, but no way it can be considered as a major source of crap.
- Google got the mail from a Comcast user located in Miami, Florida. Again, there is no typical source of hijacked computer, it can be any, even from Florida. However, it would be very unlikely scenario for a malware to hijack Google credentials for sending misinformation from a random Comcast user.
- There is a man in Linkedin with name Anthony Johnson claiming to be author of Storix
- There is a man in Linkedin with name David Huffman claiming to be the CEO of Storix, inc. He is registered as the president of the business entity C2494479 in California.
- There is a legal case 3:14-cv-01873-H-BLM in California Southern District Court, it is Johnson v. Storix, Inc.:
- Lawsuitdata.com
- RFCExpress.com
- I don't know which, if any, of the documents contain the judge's ruling.
- If assumed, that the judge ruled as the e-mail explains, it would be obvious for not to pay for a product to somebody who doesn't own it. That would be fraud if anybody else than a legal owner would ask for you money.
When all of this is combined, there are two possible scenarios left: either this is the weirdest scam I've seen, or it is all true. My take here is: after looking, searching and using my own judgement, I believe the above story of a complete stranger. I sympathize all that happened to him. I also believe, that people shouldn't be thrown out of their own companies, that's just wrong.
Pitch in with a comment, if you have some knowledge of this. I'll be waiting for the movie. 
Update 9th Oct 2015:
It's given, that I replied to the mail. I sent the link to this article and told that he has my support.
This is what he wrote back: "Wow, quite an endorsement, and no, it's definitely not a scam. Thanks!"
Official PHP-packages from Parallels
Friday, April 24. 2015
Last year I spent couple of days tinkering PHP-packages that will work on my Parallels Plesk Panel box. To my surprise, my box failed to auto-upgrade itself. The reason was: "Exception: Failed to solve dependencies:". I was dumbfounded, as the proper packages were already installed.
plesk-php54-mysqlnd-5.4.31-1.el6.x86_64 requires plesk-php54-pdo = 5.4.31-1.el6
plesk-php55-mysqlnd-5.5.6-1.el6.x86_64 requires plesk-php55-pdo = 5.5.6-1.el6
A closer inspection revealed, that packages from my own repository weren't good for installation. There were package dependencies, that required packages with exactly the same name, but from somebody else's repository.
Here are some links:
- http://autoinstall.plesk.com/PHP_5.4.40/dist-rpm-CentOS-6-x86_64/packages/
- http://autoinstall.plesk.com/PHP_5.5.24/dist-rpm-CentOS-6-x86_64/packages/
- http://autoinstall.plesk.com/PHP_5.6.8/dist-rpm-CentOS-6-x86_64/packages/
If you need to install new version, do something like this:
yum install --enablerepo PHP_5_6_8-dist plesk-php56-cli
The information for those came from file /etc/yum.repos.d/autoinstaller-sources.repo.
My only conclusion is, that Parallels guys took my source RPMs and created their own. Thanks for ripping me off!
Ok, this is open-source. I put my stuff out there willingly and knowing, that somebody eventually will use it. The sensible thing to do is to give appropriate credit, though. That one the big greedy corporation didn't do.
Goodbye Maxthon
Thursday, February 19. 2015
I have a policy of running a lot of different browsers on my computers. The idea is to gain experience of what works and what won't. When doing web development, any run-of-the-mill developer gets a tunnel vision and starts spewing out the classic "it works for me!" -style answers, when there are issues with a site.
So, I'm fighting hard to defeat that by using a lot of different browsers. One of my tools has been Maxthon browser. It isn't anymore. Goodbye Maxthon!
I was reading an article about "Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections" and went to https://filippo.io/Badfish/ to check my browser. Amazingly it showed YES:
Whaat!
If I download the https://badfish.filippo.io/yes.png directly, then there is a proper notification about the problem:
... but seeing the picture embedded nicely in a website means, that the browser won't bother checking while rendering a page. Anybody can display anything on a web page and I won't get any information about the dropped security. Not good. 
There is no other way, than to uninstall. I absolutely won't recommend using anything that insecure!
SSH connection fails
Thursday, January 8. 2015
One day I was SSHing into my ArchLinux, but it didn't succeed. The thing didn't even attempt authentication. It said:
Key exchange failed.
No compatible cipher. The server supports these ciphers: AES-128-CTR,AES-192-CTR,AES-256-CTR,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
That was surprising. It did work earlier. Ok, Arch is one of those bleeding-edge distros. It does use newest of the new stuff in it. My client is SecureCRT and it has been serving me well for years, actually over decade. I had to confirm the connectivity with Cygwin's OpenSSH client. It worked just fine. Connection opens, no grievance from there. So, something must be wrong with my SecureCRT's settings. This is what the cipher list looked like in Session Options -> Connection -> SSH2 -> Advanced:
Darn! It didn't have the newest big guns enabled. I must have ran too many upgrades to it. Apparently the upgrade doesn't enable that in my settings. I manually changed it into:
... which made the connection succeed.
I checked the server version number and it was OpenSSH_6.7p1. The sshd_config manual says:
Ciphers
The default is:
aes128-ctr,aes192-ctr,aes256-ctr,
aes128-gcm@openssh.com,aes256-gcm@openssh.com,
chacha20-poly1305@openssh.com
Also I found OpenSSH 6.7 release notes saying:
Changes since OpenSSH 6.6
=========================Potentially-incompatible changes
* sshd(8): The default set of ciphers and MACs has been altered to
remove unsafe algorithms. In particular, CBC ciphers and arcfour*
are disabled by default.
So the defaults did change in that upgrade. I checked Fedora 20 defaults and they are:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
aes128-gcm@openssh.com,aes256-gcm@openssh.com,
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
aes256-cbc,arcfour
That explains the change!
Parallels Plesk Panel updated PHP versions 5.4.32, 5.5.16 and 5.6.0
Sunday, September 21. 2014
Plesk Panel: Upgrading to version 12
Monday, July 28. 2014
All the nerds like me (escpecially me!) love new versions of software.
Backup
I got new toys for my Parallels Plesk Panel box and went for the automated upgrade. I attempted to do the mandatory full backup first:
/usr/local/psa/bin/pleskbackup server \
--output-file=/Backups/pre-12.0.18.backup.tar -v -v
... just to make sure, that I have something to roll back to if it hits the fan. But it kept failing on me. Any domains having PostgreSQL databases failed to backup properly. I got log entries like:
Failed to execute backup database
Failed to pack files backup_hqcs_blog_1407141359 in /dumps/domains/hqcodeshop.fi/databases/hqcs_blog [ 115057410048 bytes free of 158532106240 bytes total on mount point 0]
Totally puzzling. Didn't make any sense at all! Looking at the detailed XML-log of the backup revealed following:
<?xml version="1.0" encoding="UTF-8"?>
<object name="server" type="server">
<object name="hqcodeshop.fi" type="domain" uuid="domain#hqcodeshop.fi">
<object name="hqcs_blog" type="postgresql">
<message id="e6d718ef-5b52-49af-8c4f-4473393b30bd" severity="error" code="msgtext">
<description>Failed to execute backup database</description>
</message>
<message id="d5e6cfd1-fa94-45d4-89b6-a47a0627134a" severity="warning" code="msgtext">
<description>sh: AB12: command not found
sh: AB12: command not found
sh: AB12: command not found
sh: AB12: command not found
sh: AB12: command not found
sh: AB12: command not found
</description>
</message>
</object>
</object>
</object>
What command not found!? After a few puzzling moments later I realized it, that is the end of my panel admin's password! In the original form the password was [lot of characters here]>AB12. Somebody at the Parallels goofed! What would happen if your password has special characters. What if some of those characters were special in your command prompt? Not very solid backup code, huh!
The next thing was to change the password to one not containing any of these characters £$<>()&;"'`, they have special meaning on *nix command prompt. I always use randomly generated passwords and during my quests I regularily bump into systems that do not sanitize user input properly. I find that the ones from the number keys with shift are especially nasty. During registration process it is very easy to input a proper random passwod, but the system botches something and don't let me log in, or does something nasty like Parallels Plesk did.
Unfortunately changing the admin password didn't make the backup succeed! Apparently PostgreSQL password is stored somewhere else. I did do a:
/usr/local/psa/bin/admin --show-password
... to confirm, that system knows what the new password was. The thing is, that PostgreSQL password needs to be changed manually. I found the knowledge base article about that KB 120262 - How to update password for PostgreSQL admin user in Plesk? Running:
# plesk bin database-server --update-server localhost:5432 \
-type postgresql \
-passwd `/usr/local/psa/bin/admin --show-password`
SUCCESS: Server localhost:5432 is successfully updated.
... did solve it. Then I managed to get backups.
Upgrade
There were no issues during upgrade. The web-upgrader took a while and then it said everything was done. There really was nothing special about this part.
During my checkings I found a really good knowledge base article about system settings. This is something that Parallels didn't have for previous versions. This is really good stuff: Parallels Plesk Panel for Linux services logs and configuration files. I kept going back to that one a lot.
Testing
When the new version was running, I naturally wanted to see that all my services were running properly. Things I found to be broken were POP3 and IMAP SSL-certificates. Also the Presence Builder didn't upgrade properly.
The funny thing about Courier IMAP/POP3 was, that upgrade reset my certificate settings back to something really stupid. I went to /etc/courier-imap/ to check the imapd-ssl and pop3d-ssl. I changed both of them to contain:
TLS_PROTOCOL=TLS1
That was done to reflect the setting I have in my /etc/postfix/main.cf:
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
My policy is, that if you're running something that does not support TLSv1, v1.1 nor v1.2 then you should use somebody else's services. It simply is insane to rely on SSL!
The Web Presence Builder said this on startup:
File: /usr/local/sb/include/Base/ORM/Object.php; Line: 249
Message: Undefined property "controlPanelLink" in object "SB_ORM_TokenAccess".; Code: 0
Luckily, that issue is covered by knowledge base article KB 119875: Cannot open a site in Web Presence Builder: "Undefined property "controlPanelLink" in object "SB_ORM_TokenAccess". A simple SQL-command:
ALTER TABLE `token_access` ADD `control_panel_link` VARCHAR( 255 ) NULL DEFAULT '' AFTER `skin_code`;
did do the fix.
Life after the upgrade
My system has been running as usual. There hasn't been any complaints from the users or I have not encountered anything else that didn't work.
Firefox untrusted certificate fail
Wednesday, July 2. 2014
Something changed in Firefox 30. Once in a while everybody runs into an untrusted certificate while browsing. There is a support article "This Connection is Untrusted" error message appears - What to do at Mozilla's support site. The idea is to click I Understand the Risks and proceed to the site.
Now the latest version chose not to display the button:
If the HTTPS-connection would fail miserably, it wouldn't display the option anyways, as there isn't any possibility to continue to the site. Here is an example:
But since this is not that case, the button should be there. Something changed, since it was there before. Googling gave me an about:config variable of browser.xul.error_pages.expert_bad_cert:
It had been turned into false for some reason. When the setting is true, the error screen changes:
Now there is an option to proceed. While at it, they failed. Adding an exception won't work:
Storing the option permanently or not has no effect. It still won't proceed.
Perhaps they'll fix this into Firefox 31.
Setting Cyberfox as the default browser
Thursday, June 19. 2014
Making the choice of a default browser in Windows 7 should be an easy task, right? If you are a fan of 64-bit Firefox browser like I do, then you should consider Cyberfox. The problem is, that ever since Cyberfox stopped using Firefox user profiles, it fails to set itself as the default browser.
Every single time you start your beloved Cyberfox, it will do something like this:
No matter what you try, it will do the same thing every single time. Crap!
The good thing is that this particular issue is a common one. It has been discussed in [Error] Problems Setting As Default Browser and [Solved] Cyberfox 28.0.1 Not the Default Browser bug, which contains enough information to solve the problem. The information is in the cracks of the discussion thread, but I managed to scavenge enough to fix my browser.
Start the fix by setting something else as the default browser:
Confirm, that Cyberfox should be the default browser, but it just doesn't work:
I'm setting IE as the default browser for the time being. Later I'll switch back to Cyberfox, but the fix requires you to change into something else:
Next, go to Cyberfox and go to Options, Advanced, General settings and un-check the Always check to see if Cyberfox is the default browser on startup. Later you need to be able to start Cyberfox without the check:
Download (or copy/paste) a small registry file defaults-64.reg. The entire file will be 7 lines (2 blank ones):
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\CYBERFOX.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\CYBERFOX.EXE][-HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\FIREFOX.EXE]
When you have the file in your disc, start File Explorer and right click the file:
Select Merge. It should say something like this (The keys and values successfully added to the registry):
Next thing is to start Cyberfox with administrator permissions. This is very important. If you attempt the fix with regular user permissions, you will fail and need to start over. Example:
Go to Options, Advanced, General settings again:
This time click the Make Cyberfox the default browser (you can check Always check to see if Cyberfox is the default browser on startup, if you want to). This time the button will disappear:
If the button disappears, it means that you succeeded! Cyberfox is the default browser for your Windows and it won't complain about it on startup.
All this trouble pays off. Now your super efficient and well optimizer browser works even better!
The obligatory shame-on-you prize goes out to Mozilla for scrapping their 64-bit Windows browser project. Even Google Chrome is heading towards 64-bit on Windows. Anyway, the 64-bitness is a weird subject, on Linux or Mac OS X 64-bit browsers have existed a very long time. What's with the Windows having only 32-bit versions?
Parallels Plesk Panel updated PHP versions 5.4.28 and 5.5.12
Tuesday, May 13. 2014
Fixing Postfix: Make mail exit your Linux-box
Monday, April 7. 2014
EPIC4 maildir patch
Sunday, March 30. 2014
Trivial mod_rewrite: Redirect to another file in the same directory
Wednesday, March 19. 2014
I found a funny quote at Htaccess Rewrites - Rewrite Tricks and Tips, it says:
``Despite the tons of examples and docs, mod_rewrite is voodoo. Damned cool voodoo, but still voodoo. ''
-- Brian Moore
bem@news.cmc.net
The quote is originally at http://httpd.apache.org/docs/2.0/rewrite/. Now obsoleted documentation for old Apache version.
I'll have to second Brian's opinion. I've touched the subject earlier at Advanced mod_rewrite: FastCGI Ruby on Rails /w HTTPS.
My YUM-repo definition RPM had a bug in it (see: CentOS 6 PHP 5.4 and 5.5 yum repository) and I had to release a new version of it. There exist already couple of links to the file. Why didn't I think of a situation where an update is released? Darn! So, let's keep the URL alive, even if a new version of the file with different name is released. That way everybody stays happy.
Attempt 1: Failure
An over enthusiastic "hey, that should be simple!" -type of naive solution. Create a .htaccess-file into the appropriate directory with content:
RedirectPermanent oldname.rpm newname.rpm
Well ... no. The result is a HTTP/500 and in the error log there was a:
/home/the/entire/path/here/.htaccess: Redirect to non-URL
Ok. It didn't work.
Attempt 2: Failure
Let's ramp this up. Forget the simple tools, hit it with mod_rewrite! Make .htaccess contain:
RewriteEngine on
RewriteRule ^oldname\.rpm$ newname.rpm [R=301]
Well ... no. The result is a HTTP/404, because the redirect goes really wrong. The result will be http://my.server.name/home/the/entire/path/here/newname.rpm, which is pretty far from being correct. There is a funny mix of URL and the actual filesystem storage.
The reason can be found from the Apache docs at RewriteRule PT-flag:
"The target (or substitution string) in a RewriteRule is assumed to be a file path, by default. The use of the [PT] flag causes it to be treated as a URI instead."
and
"Note that the PT flag is implied in per-directory contexts such as <Directory> sections or in .htaccess files."
That phrase can be translated as:
- Internally RewriteRule works with filesystem paths
- When using RewriteRule from a .htaccess-file it does not use filesystem paths, but URLs
- A .htaccess-file really messes things up
Something more elegant is obviously needed.
Attempt 3: Failure
I studied the Apache docs and found a perfect solution! What about if there was a way to discard the filesystem path entirely. Nice! Let's go that way, make .htaccess contain:
RewriteEngine on
RewriteRule ^oldname\.rpm$ newname.rpm [R=301,DPI]
Well ... no. I have the DiscardPathInfo-flag there, but it changes absolutely nothing. It is the same with or without the flag. It clearly says that "The DPI flag causes the PATH_INFO portion of the rewritten URI to be discarded" in the docs. Apparently the flag is used for completely different thing (which I'm having hard time to comprehend), but the thing is that I cannot use it to fix my redirect.
Attempt 4: Success!
After browsing the Apache-docs even more I struck gold. The docs for RewriteBase-directive say:
"This directive is required when you use a relative path in a substitution in per-directory (htaccess) context"
and
"This misconfiguration would normally cause the server to look for an "opt" directory under the document root."
That's exactly what I'm doing here. I have a relative path. I'm using a substitution in a .htaccess-file. It even mis-behaves precisely like in the example from the docs.
The solution is to make .htaccess contain:
RewriteEngine on
RewriteBase /path/here/
RewriteRule ^oldname\.rpm$ newname.rpm [R=301]
Now it works exactly as I want it to do! Nice!
When a request is done for the old filename, Apache will do an external redirect and notify browser about the new version. wget fails to save the file with the new name (it will use the old name), but for example Firefox does that correctly.
Conclusion
Darn that voodoo is hard.
The mod_rewrite's complexity simply laughs at any system administrator. I consider myself to be one of the experienced ones, but still ... I find myself struggling with the subject.
Java 1.7 update 51 breaking Cisco ASDM login
Monday, March 10. 2014
One day I needed to drill a hole to a Cisco firewall. I went to Adaptive Security Device Manager and could not log in. Whaat?!
It did work before, but apparently something changed. Sneak peek with Wireshark revealed that SSL handshake failed. Java console has something like this in it:
java.lang.SecurityException: Missing required Permissions manifest attribute in main jar: https://dm-launcher.jar
at com.sun.deploy.security.DeployManifestChecker.verifyMainJar(Unknown Source)
at com.sun.deploy.security.DeployManifestChecker.verifyMainJar(Unknown Source)
at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
at com.sun.javaws.Launcher.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
and:
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Java couldn't trust Server
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
Little bit of googling revealed Issues Accessing ASDM at Cisco's learning network and Cisco ASDM blocked by Java? at spiceworks.com. So I wasn't alone with the problem. Oracle's release notes for update 51 revealed a number of changes to earlier versions. Java is still piece of shit, but they're trying to fix it. Too little, too late. It is very unfortunate that I have to have Java Runtime installed and use it for a number of important applications. Now Oracle is making radical changes to JRE to improve its flaky security and these customer companies like Cisco cannot keep up with the changes.
Anyway, enough rant, here is how to fix it. The idea is to take the self-signed certificate from the Cisco firewall and import it for Java. This is yet another nice feature of a Windows-computer. There needs to be separate a separate certificate store for operating system, browser and Java.
First go to web-interface of the Cisco appliance. Internet Explorer cannot export a certificate from a web site, so use a Firefox or Chrome or pretty much any other browser. Save the certificate to a file. Like this:
When you have the file, go to Control Panel on Windows:
Select Java and Security-tab:
From there you can find Manage Certificates. Import the certificate-file from there:
It is very, very important that you first select Certificate Type: Secure Site. Any other certificate type won't fix the problem.
On the security-tab there is an exception list for certificates. Adding an exception won't fix this, since the problem is with the fact that the certificate is self-signed.
Now login works again.
When I first encountered this issue, I asked help from couple of guys who are very familiar with Cisco IOS (not Apple iOS). The initial response was "What is ASDM?" Apparently the GUI is not the expert's way to go.
Firefox per dir save
Sunday, March 9. 2014
Once upon a time there was a Firefox version which remembered where something was saved from a website. I think the last download destination directory was stored per host. I clearly remember that when I downloaded something from SourceForge, it would remember the directory, but since there are number of projects I download from it didn't always be a correct one. But for websites, I use for only one piece of software, it was always correct.
Then something changed. My Firefox wouldn't remember my destinations anymore.
Now for some nostalgic reason I wanted the functionality back. My loyal/hated aide Google found me a solution for that. A Mozilla support forum discussion named Changing FF25 download location in Win7 - Browse will not get past /User folder. It clearly states that such a setting exists, but is now off by default. When I went to my about:config, it looked like this:
Like the support forum promised, the configuration directive is hidden. They say hidden, but actually it is not created at all. Luckily you can add it by yourself by right clicking on the Firefox configuration:
Just add a new boolean variable with name browser.download.lastDir.savePerSite and you're good to go. Remember to set the value into true. It is enabled immediately, no restarting or anything needed.
The last thing for me to do is keep wondering why it was enabled in a couple of versions when it was introduced and then turned off.
