JTechWorks Projects

Access 2010 Security

JTechWorks — Thu, 13 Jan 2011 22:30:56 +0000

After working in MS Access for as many years as we have most of our applications using a combination of MDB encryption and custom MDW workgroup files. Our blank encrypted database template allowed us to set groups, users, and detailed permissions on both data (if stored in Access) and all screens, modules, reports, and other objects. Building the framework took quite a long time, but we had a very good permissions design. User levels prevented changes to the system, except where we specifically designed them.

New versions of MS Access, 2007 and 2010, have changed all that. Not necessarily for the good either.

Access files now only support a single password, for all users. Encryption is better, but once a user is logged in system changes can be made by anyone.

It follows the new direction of Microsoft. Data should be stored in SQL Server or Sharepoint. That’s the stated recommendation. That we agree with, even though there are many times saving data in Access tables makes perfect sense.

However we do need to prevent users from making any mistaken changes to the structure. And that is now more time consuming.

The methods are to set Access to not display any internal features, block the Ribbons, and then create custom menu’s or Ribbons. Replacing the Ribbons correctly is not an easy task. To date Microsoft has not provided any developers tools and pretty much requires XML code.

We do have several third party utilities, and old fashion hand coded XML, that helps. I’m not complaining since this is why companies hire us. But next time we document specs a new line item will be needed.

Creating PDF Documents

JTechWorks — Tue, 14 Dec 2010 22:51:05 +0000

OK…not an exciting subject. But it is something we all do, and often.

By now all but developers have found third party software to use rather then buying full versions of Adobe Acrobat. Don’t get me wrong, we use Acrobat in our company. The advanced functions are necessary for some things.

For simple daily PDF creation we also install CutePDF Writer.

This is simple to use, easy to install, and the free version does most all a typical user wants.

The program does not display advertising, no embedded logo’s or watermarks, just builds a PDF.

The install is a two step process, but it’s easy. The CutePDF web site has 2 links for a download. Load the open source program GhostScript, then CutePDF.

Once installed the option for a PDF appears, like Acrobat, as one of your printers.

It’s great for home, secondary PC’s in the office, or any computer that does not require advanced PDF functions.

DVD From Your Hard Drive

JTechWorks — Tue, 09 Nov 2010 22:33:16 +0000

Some days things that should be easy just get way too complicated.

Downloading files from Microsoft I found some were .img files. How do I run those from my DVD drive. They should be typical .iso like most DVD files. After many dead ends trying to get Roxio to burn a DVD I discovered all I needed to do was rename the file from an .img to .iso! Of course everyone else in the world knew this.

OK, so now I needed to install a large program. Error…Error… you get the idea. Again time wasted looking at all the usual techie places. After awhile I woke up and discovered the DVD drive was ‘burping’.

A friend and I had just talked about drive problems to I quickly went on-line to find a ‘Virtual DVD Drive’ software. ISODisk.com was the answer.

A small download, installs in seconds. Now I just copy files to my hard drive, open IOSDisk and click the file. The file is assigned a drive letter and just runs like a DVD. Fast too.

At the least keep a copy (free) in cased your DVD drive dies.

Simple File Encryption

JTechWorks — Wed, 22 Sep 2010 21:55:54 +0000

Several times in the last month we have needed to provide encrypted files. In both cases I needed a simple tool with an easy interface for the users when they opened the file.

I found Zip2SecureExe at www.ChilKatSoft.com and tried their utility. Works great.

The trick is the file to be encrypted must be a zip file. That’s easy since I just right click and select the Windows Send To Compressed option.

Zip2Secure creates an .exe file from the new zip. Inside the .exe is an unzip function which just unzips the file in a folder selected by the user, after entering the correct password of course.

I use AES 128 encryption but others are available. You can add an option of where to open, change the instructions and comments the user will see, or delete the encrypted file when complete. There are others, these are just what I have tried.

Price is pretty good…….free.

Zip2Secure is another nice tool to keep on hand to make like a little easier.

PHP Lock Down Revisited

JTechWorks — Mon, 09 Aug 2010 23:06:26 +0000

In a recent entry I wrote about malicious requests looking for ‘less then’ secure PHP sites.

Based on recent events I felt a quick update would be wise.

In the past 3 weeks we have seen a new bot with world wide installations. Most requests originate in China, but a good 40% are from places or companies you would never suspect.

The thing they all have in common is a short burst of 166 PHP requests. Most all looking for PHPMyAdmin, PHP, or other common open source applications. They will send requests to all the default installation directories, one at a time. Even go so far as to try each applications different versions.

PHPInfo.php is a common request.

So at the least be sure to install any PHP sites in custom directories, not the default. This simple change will send them on their way, to someone else.

Don’t be surprised to find 2 or 3 hits every day. Also look for a new variation. The same requests, just sent at 2 different times.

I assume once they find a directory that responds the bot will come back with additional requests added to the URL.

Web Meetings With Vyew.com

JTechWorks — Wed, 12 May 2010 22:02:47 +0000

Web meeting services can get expensive if it’s not something you do on a regular basis. I love GoToMeeting by Citrix. But the price is too much for me since I have on-line meetings no more then once every few months.

Vyew.com offers a small free version of their meeting service. It’s really quite good. Like all on-line meetings once you get the hang of the small delay between users and your screen everything runs well.

The features include Screen sharing, uploading of files, web cam, free VOIP, white boards, and private meeting rooms. There are many more once you dig around.

PC’s require Java and Flash, typically everyone has them. If Vyew finds something missing a download can be run as you login.

The free version has a limit of 10 users, and 20 saved presentations of 50 pages. More then enough for the average small business with minimal meetings. Small ads appear in the upper corner of the control panel where they are not intrusive at all.

I have not used many of the options. I do use screen sharing and uploaded documents.

Vyew.com fits a need and obviously the price is right. When testing Vyew I used 2 PC’s. One I signed in as the presenter, the other as a user. Open an account and try it.

Lock Down PHP

JTechWorks — Wed, 10 Mar 2010 22:33:16 +0000

One of our on-going projects is to monitor and maintain a client’s web servers. These servers do contain some sensitive information so it’s critical we pay attention.

To make things easier we have the IIS web server software write the logs to a database. This allows us to write reports and queries on all activity. All traffic has a ‘type’ code, 200 ranges are usual day to to day stuff. However the 300 and 400 ranges (IE web error page 404) show all the nasty things that go on, and on, and on…..

PHP is the favorite target, by far. Automated bots will send numerous requests to find the PHP file folders and what PHP applications might be running. They look hard for any old PHP install folders that might have been left behind. If they find one, it’s an open door.

Favorite targets are shopping carts, content management, WordPress, and the other popular PHP applications. Bots scan for their default installation folders. Change them !

If you run PHP and have access to Apache or IIS it’s worth your time to write logs to a database. Lookup the bad guy’s IP addresses. They are pretty busy in China.

Also be sure PRX2.php or PRX1.php is no where on your server. Not sure what they are but I assume they contain some nasty scripts.

Microsoft Expression Web

JTechWorks — Sat, 13 Feb 2010 22:41:24 +0000

Recently we were sponsored to join the Microsoft WebSiteSpark program. Microsoft partners, through a certified hosting partner, are eligible to join. The program offers developers support and software to help promote building web sites with Microsoft site building tools. They actually have quite a few.

Expression Web, and Expression Studio, are provided as part of the program. This gave us the opportunity to take the software ‘out for a drive’. It turns out they are pretty impressive. In some areas maybe better then Adobe Dreamweaver the industry standard.

Style Sheets are created for the developer on the fly. At first it’s a bit odd, but after trying it for awhile it takes some of the work (pain) out of using detailed CSS.

Another feature that’s great is the built in Browser testing. Expression Web has a preview function that allows you to select the type of Browser to test (IE8, Firefox, etc.) and simulated monitor sizes. No guessing on how a page looks in different Browsers and monitors !

Expression Studio includes Expression Design. This is the new Microsoft graphics program. I personally find all graphics software to have confusing interfaces. Design is no different. It’s OK, but Adobe has nothing to fear with Design, at least not yet.

If you maintain your own site, especially an ASP or .Net site, Expression Web is a pretty good choice. PHP is supported also. No Coldfusion, but that makes sense.

WordPress Blog Updates

JTechWorks — Fri, 25 Dec 2009 19:17:47 +0000

Blogs, like any other software, require updates at times. WordPress is pretty good about providing updates and patches. In addition we install an ‘automatic update’ module for our clients that use WordPress to make the process easier.

The following is a quick review of running the updates:

When the message ‘Updates Available, Run Automatic Update’ appears in the Dashboard click the Auto Update link.

Follow each step displayed on screen.

Whenever the directions on a screen provide an option to ‘Skip’ a step select the ‘Skip’ link. Some steps are not needed on our servers, so just ‘skip’ them.

The final screen will alert you that all updates have been applied.

To complete the process select the option at the the top of the screen to cleanup all temp files.

The screens displayed while running the patches is based on the type of update in progress. At times you may be automatically exited from the admin dashboard and need to login again. Other times the dashboard can display screens with just simple command buttons to click.

In general the process is straight forward and quick. WordPress blogs, like many other open source software, can be a frequent target of automated bots looking to insert malicious scripts and links. It’s best just to take a few minutes and run the Auto Update option we install.

Email Campaigns

JTechWorks — Tue, 22 Dec 2009 23:55:40 +0000

Email marketing, newsletters and other on-going client contact has become a standard. And why not? It is very cost effective and now perfectly acceptable, as long as you are not spamming.

The real issue is just how effective is your email? For several years we have used Constant Contact with our clients. They are not the only service, however they are the largest. This has helped getting Email past many strict spam filters in the past since they are a well known service.

We recommend CC because of the tools provided to monitor Email. Once an Email has been sent we can track how many were actually delivered, how many opened, and even the number of click-through’s to the clients Web Site or other links.

Tracking the actual responses quickly identifies strengths and weakness in a marketing campaign. Try a free trail for 60 days, send a small mailing, and track your results. I think you will find it interesting.