2025 - Update to How to setup an automated WakeOnLan with Cisco Meraki using MAC allow list

Back a while a go I did a post about setting up an automated WOL system using linux and cron.  With the new updates in the Linux Kernel, and other security updates things break so this is an update to my post in 2020,  as some utilities are now required to keep WOL working.

So the uplink switch that has the WOL clients is set to MAC ALLOW LIST.  with the specified VLANS.  You need to add the server sending the WOL packet, in my case is a virtual machine, and it should be set to a STATIC MAC.

The only required packages required for WOL on Linux, was SAMBA, Net-Tools and wakeonlan.  After some security updates WOL stopped working even though on the linux server it shows that it is running the magic packet but it is not getting though.  It also shows that the WOL, SAMBA and net-tools packages are up to date.

So after troubleshooting using the firewall and the Cisco Meraki Switch, testing the WOL from the firewall and the switch, with it successfully running.

I found an update where I was missing a package called etherwake.  While the windows clients on Windows 10 and 11 still require the driver settings form my post in 2020, the linux server needs to be updated with the etherwake package.  

sudo apt install etherwake

For the startup script I used this format for running cron.

####################

##Put IN ARP CACHE##

####################

sudo arp -i ethx -s $ipaddress $macaddress #Computer Label

####################

##Send WOL Packets##

####################

sudo -i -u $user -p $password wakeonlan -i $ipaddress $macaddress #Computer Label

or

wakeonlan $macaddress #Computer Label

How to setup Intel Vpro with Mesh Commander

I really like VPRO, it is one of the intel technologies that I find extremely useful.  I did a post back in 2017 for setting up VPRO on systems so you can remotely manage systems using Mesh Commander.  

Starting with the 12th generation systems, VPro systems use TLS to connect, which MeshCommander supports.  Below is a step by step setup of the BIOS/UEFI Settings required to use VPRO with MeshCommander.

Enter BIOS/UEFI

Go to Intel Manageability and enable intel manageability control

If this is the first time you have setup VPRO you will need to update the password, it needs to be at least 8 characters long, with one number, one capital and one alternative character i.e. -%#_@ 

Once we have updated the password, we will configure Intel AMT.

In AMT Configuration I enable all the redirection features

SOL - Serial Over Lan (for trouble shooting via serial interface)

Storage Redirection -  (Remotely booting images)

KVM - Allows the remote control of a client even if the OS isn't running

For User Consent I changed it to none so there is no issue to remotely access the computer, however if it is a user's workstation you may want to set it to KVM or ALL to get permission to access the system.

None  - You can access the computer anytime without alerting the user

KVM - You can access the computer anytime but need permission from the user to access the computer when using it for KVM access

ALL - You need to get permission from the user to access anything vpro function

For the network settings, you can specify a specific FQDN and a static ID

Network Access State, set the network access state to active.

Network Active - You can use VPRO Features

Network Inactive - VPRO is not available

Full Unprovision - Reset VPRO to the default state

Power Control, I set the sleep states to S0, ME Wake in S3, S4-5

Desktop: On in S0

Desktop: On in S0, ME Wake in S3, S4-5

Once configured you can add the system to mesh commander

Hit the add computer

Here is where the VPRO setup is slightily different from the 12gen version and above vs 11 gen and below.  For 11 gen and lower you need to set the Auth/Security to Digest/None, if you don't have kerberos setup.  Otherwise for 12 gen and up you need to set it up for Digest/TLS.

Auth/Seucrity Options:

Digest/None (use for 11 gen intel and below)

Digest/TLS (use for 12 gen intel and above)

Kerberos/None

Kerberos/TLS

Fill out the system information, the friendly name is the name that you will see in mesh commander for connecting and can be anything.  The important information is the hostname which can be a FQDN or IP address, use the auth/security for the system your using.  The username/password is what you have setup in the VPRO bios/UEFI.

Once your finished hit OK, if it is 12th gen intel and above you have to accept the certificate.

When you connect to access the KVM go to the remote desktop on the menu as shown below.

Enable the AMT Redirection in meshcommander

When you connect you will then be able to interact with the full system

How to fix clients overwriting other clients in Action 1

Action 1 is a great patch management system.  However one thing you should not do is add the action 1 client when imaging, the client should always be added on after or you will need to run a script to clear a registry entry.

The issue looks like this

The client that was imaged shows up but then when the action 1 client is imaged and deployed it doesn't change a registry entry so when you have systems with the action 1 client imaged and deployed the clients over write each other in the action 1 web interface.

Uninstalling and reinstalling the action 1 client will not fix the issue however clearing the registry value should, and should not require re-installing the client.

On the affected system(s) check the registry 

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Action1

The 'agent guid' should be unique, if not stop the service and clear the registry value; then restart the service.

You can also get the information for this fix form Action1

https://www.action1.com/documentation/distribution-with-pc-images

1) Install Action1 agent on the computer that will be the image
2) Open Start > Services > Stop 'Action1 Agent' service
3) Open Start > Regedit > Clear 'agent.guid' value

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Action1

Using Powershell in Action1 to update RustDesk

This script can be used to install and update RustDesk using Action1.  Action1 is a wonderful cloud based patch management system, though I can create an on prem solution for deploying RustDesk, it was decided that we needed to be able to deploy updates for the software to users at home as well for remote support options as RustDesk is more responsive and faster than Action1.  This can be run as a custom script created and saved in the script library in action1 

or it can be run directly on the endpoint if it is a script you don't need to run over again which can be found near the actions column in action 1.

Below is the powershell script for updating/installing RustDesk.  If you have your own rustdesk server this WILL keep your settings when updating.

##START COPY

$Folder = 'c:\itTemp'

$URL = 'https://github.com/rustdesk/rustdesk/releases/download/1.3.7/rustdesk-1.3.7-x86_64.msi'

##"Test to see if folder [$Folder]  exists"

if (Test-Path -Path $Folder) {

##If it exsists remove it

Remove-Item 'c:\itTemp' -Force

##Is RustDesk Installed?  If it is uninstall it.

Get-CimInstance -ClassName win32_product | Where-Object Name -Match "RustDesk" | 

    ForEach-Object -Process { 

        Invoke-CimMethod -InputObject $_ -Name Uninstall 

                            }

##Create a temporary folder, download the latest version of RustDesk and install it

New-Item -Path "c:\" -Name "itTemp" -ItemType "directory"

Invoke-WebRequest https://github.com/rustdesk/rustdesk/releases/download/1.3.7/rustdesk-1.3.7-x86_64.msi -OutFile c:\itTemp\rustdesk-1.3.7-x86_64.msi

$pkg = "c:\itTemp\rustdesk-1.3.7-x86_64.msi";

Start-Process msiexec "/i $pkg /norestart /qn" -Wait;

##Wait 30 seconds before removing the directory

Start-Sleep -Seconds 30

##Clean up garbage

Remove-Item -Recurse -Force c:\itTemp\*.*

Remove-Item 'c:\itTemp' -Force

} else {

##If the itTemp folder doesn't exsits remove rustdesk 

Get-CimInstance -ClassName win32_product | Where-Object Name -Match "RustDesk" | 

    ForEach-Object -Process { 

        Invoke-CimMethod -InputObject $_ -Name Uninstall 

                            }

##Create a temporary folder, download the latest version of RustDesk and install it                            

New-Item -Path "c:\" -Name "itTemp" -ItemType "directory"

Invoke-WebRequest https://github.com/rustdesk/rustdesk/releases/download/1.3.7/rustdesk-1.3.7-x86_64.msi -OutFile c:\itTemp\rustdesk-1.3.7-x86_64.msi

$pkg = "c:\itTemp\rustdesk-1.3.7-x86_64.msi";

Start-Process msiexec "/i $pkg /norestart /qn" -Wait;

##Wait 30 seconds before removing the directory

Start-Sleep -Seconds 30

##Clean up garbage

Remove-Item -Recurse -Force c:\itTemp\*.*

Remove-Item 'c:\itTemp'

}

##END COPY

How to fix CURL call imporitng an RSS feed on a site blocking CURL calls

There is a 3rd party service provider that my organization uses called bibliocommons.  They have these nice book carousels.  However the carousels are not very customizable and are only available for specific lists made by Bibliocommons. 

So I wrote a php rss reader that takes an RSS feed that is produced by the page list and built a carousel that is more customizable and updates it's self once a day (see below)

The carousel I wrote has all the art at the same height; and it puts the name of the book under the art which makes it more accessible and still links to the book in the catalogue just like the other carousel.  It has been working fine for 6 years but not after a major DDoS attack on the vendor; they are using cloud front to stop scripts from hitting the site using CURL and broke my carousel (see below).

Even after asking the vendor to whitelist the webserver things were not progressing on getting the issue resolved so; comes sublime text edit (my all time favorite coding tool).  So I thought I would see what exactly is going on since I could access the RSS feed just fine in my web browser but my script was receiving 301 - 307 errors (whatever the server felt like throwing).

So troubleshooting this I found two issues.  One was a full url that was in the node value and not being escaped and a USER_AGENT detection which was causing the script from accessing the RSS feed; which seems silly because I would think you would want users to access RSS feeds.  Since my browser was able to access the RSS feed; I determined that they must be doing some sort of detecting; which they were.

CODE

<?PHP  

$ch = curl_init();

  $url = "$RSSURL";

  curl_setopt($ch,CURLOPT_URL,$url);

  curl_setopt($ch,CURLOPT_USERAGENT,'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36');

  curl_setopt($ch,CURLOPT_HEADER, 0);

  curl_setopt($ch,CURLOPT_NOBODY, 0);

  curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);

  curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);

  curl_setopt($ch,CURLOPT_CONNECTTIMEOUT ,5);

  curl_setopt($ch,CURLOPT_TIMEOUT, 20);

  $response = curl_exec($ch);

  curl_close ($ch);

file_put_contents("$XMLDATAFILE.xml", $response);

?>

So the key was adding the CURLOPT_USERAGENT to get access to the RSS Feed; I randomly chose the user agent but you could randomize it in a variable so you wouldn't have the same useragent hitting the server every time if you wanted something more random.  

You can get some sample agents from deviceatlas.com,  Once added to my CURLOPT; my carousel started to work again and the XML errors where corrected using the file_put_contents command into a different xml file and reading that XML file.