The RedMon 1.7 Redirection Port Monitor is an open source product of GhostGum Software, frequently used to configure virtual printers on Microsoft operating systems based on Microsoft Windows NT technology. Among other uses, RedMon is often used to configure a virtual PostScript printer to bypass bugs in printer drivers provided by printer manufacturers (e.g. the current PrintStik driver from PlanOn) or to provide a network print server for clients that don't have native drivers for the shared printer.
RedMon 1.7 was released in 2001, and its design did not anticipate the new security features that Microsoft would add to Windows Vista and Windows 7 (as well as Windows Server 2008 and later.) RedMon extends explorer.exe, which in Windows 7 is started, by default, without the Administrator privileges needed to configure a virtual printer port. Running explorer.exe as an Administrator is deliberately made difficult in post-XP versions of Microsoft Windows, so as to deter the severe security vulnerabilities that may result. The following instructions assume that you are a skilled system administrator with a thorough knowledge of security considerations, and of system administration technologies such as the CygWin toolkit. If you are not in this category, please do not try, and do not blame me if you try and your system becomes compromised and useless because you did.
1. Make sure that you have, and know how to use, a shell tool capable of launching a background process on the Microsoft Windows distribution of your choice. I use XTerm, which runs under XWin from CygWin.com. You will need to have XWin running on your system in advance before you launch a privileged XTerm as described below.
2. Install all the software that you will need. For example, in order to configure a virtual PostScript printer, you will have installed GhostScript, gsprint and RedMon in advance.
3. Back up the system, so that you will be able to restore it if it becomes compromised while explorer.exe is running in privileged mode.
4. Before you run explorer.exe as Administrator, cut off all potential vectors through which a privileged instance of explorer.exe can be exploited (and through it, your system.) Shut down all applications that can act as web or e-mail clients, and do not start any such applications again until you have finished configuring the virtual printer. Physically unplug the network from your computer if you can. If you can't, disable all external network interfaces. If you are administering remotely, make sure that the network you are using for remote administration is physically isolated from non-secure networks, and disable all external network interfaces other than the one you are using.
5. Start a privileged instance of your shell tool. For example, right-click XTerm in the Start->Programs menu and select "Run as Administrator." Then change directory in this shell tool to /cygdrive/c/Windows or equivalent.
6. Use the Task Manager to kill the default instance of explorer.exe.
7. Background a privileged instance of explorer.exe with your shell tool. For example, in the above privileged instance of XTerm give the command "./explorer.exe &".
8. Configure your virtual printer.
9. Use the Task Manager to kill the privileged explorer.exe and to start a new default instance.
10. Restore network connections.
Most administrator tasks that worked in Windows XP but don't work in Windows 7 can be made to work with a work-around similar to the above.
Friday, September 24, 2010
Subscribe to:
Posts (Atom)
