The last issue to be resolved is to guarantee that the client machines will execute the patch script on a regular basis. This program must be run during the operating system boot process but after network support has been enabled.

     HKEY_LOCAL_MACHINE
          Software
               Microsoft
                    Windows
                         RunOnce

registry key which can be set using a remote update of the system policies.

In order to install updates on Windows NT clients, the update program must have administrative privileges on the local host. Therefore the patch program may not be run during a normal user’s domain login script. The Windows NT 4.0 Server Resource Kit contains a service utility named AutoexNT that, upon start up, executes a batch file named %SYSTEMROOT%\System32\AutoexNT.bat. By configuring the service to start up automatically, AutoexNT.bat will be executed during the boot process. It is from this batch file that the Patch32 script is launched. By running the AutoexNT service under a local administrative account, the program is able to update system files and settings.

3.1. Permissions

When run under Windows NT, the patch program must run as a local administrative account in order to update system files. This results in three security issues that must be addressed. These are the integrity of the patch files themselves and their associated setup programs, the security of the registry keys which are defined by the system updates and the security of the batch file run by the AutoexNT service. Obviously the last two issues are irrelevant in Windows 95 since such access control does not exist and because the AutoexNT service is not used.

In order to insure the integrity of the update packages, write access to the files should be restricted to administrative accounts only. Without this protection, a virus or Trojan Horse program could easily be distributed to clients by modifying the patch files on the server.

It is also important to maintain the security of the system registry keys created by the updates because these are the only means by which the Patch32 program can determine whether or not an update has been installed. If the security of these keys were comprised, it would be possible to avoid the installation of an update simply by creating the correct registry key. It is important to remember that the patch script makes no attempt to verify the status of currently installed patches. It is not technically difficult to perform this type of system examination, but would result in an increased execution time and degraded system performance.

The last security issue to address is the AutoexNT service. As stated previously, this service runs as a local administrative account and executes the contents of the AutoexNT.bat file whatever they may be. It is therefore extremely important that only administrative accounts be allowed to modify this file for reasons similar to those given for ensuring the integrity of updates packages.

In a distributed environment, it is important not only to be able deploy updates effectively, but also to be able to determine which machines were successfully updated and those which failed. Patch32 supports logging to the Windows NT EventLog via Perl’s Win32::WriteEventLog() function.

Figure 9: Patch32 EventID’s and descriptions.

During the initial installation, Patch32 requires that certain variables, which determine paths to OS updates, be defined. These variables, located at the beginning of the source file, allow the administrator to specify the base location of the Patch32 directory hierarchy and the install methods and parameters for Windows 95 and Windows NT updates. The server administrator may also choose to modify the reboot message that is executed upon the successful application of an update.

One advantage to Patch32, besides the fact the all software components are freely available, is that the patch script itself is very short, about two hundred lines at the time of this writing. Because the code is easy to understand, site specific changes can be made easily. This makes Patch32 extremely flexible. For example, one of the many, freely available SMTP console mail programs such as Blat (see Appendix A) could be used to augment the system’s current logging abilities. In this way, network administration would be notified via e-mail upon update completions or failures.

The patch installation method is also very flexible. The current configuration at the College of Engineering uses methods available with the updates released by Microsoft. A simple alternative to this would be to use a batch script named "update.bat" that would execute specific patch installation programs. This would provide the ability to have an individual installation mechanism for each OS patch. The only restrictions would be that the update program runs non-interactively under Windows NT and that it creates the registry key necessary to allow future executions of Patch32 to determine its existence.

Another possibility of expanding the current installation method would be to determine it based on the OS build number. Then each version for Windows 95 and Windows NT would have a separate method for installing updates. This would be most helpful when supporting Windows NT 3.51 and 4.0 clients from the same server.

One issue that arose from the experience of implementing this system is the question of ‘What is a patch?’ A system update is really nothing more that a reconfiguration of the client machine. Files and registry keys are created, updated and deleted. In essence, this is software installation. It is perceivable that the Patch32 system could be used to configure software packages on client machines. This, however, is left as an exercise for the reader.

This section lists relevant URLs for freely available software discussed in this paper.

Samba is available under the GNU General Public License and comes with full source code. Information is available at http://samba.anu.edu.au/samba.

The Microsoft OS updates for Windows 95 and Windows NT are available from Microsoft’s web server and FTP server. See http://support.microsoft.com and ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes.

ActiveState distributes Perl5 for Win32 which available at http://www.ActiveState.com.

All source code for the Patch32 system are available on-line as will be future versions. See http://www.eng.auburn.edu/users/cartegw/Patch32 for information about obtaining the files.

Blat is a public domain console SMTP mailer for the win32 platform. It is designed to run under Windows NT and comes with full source code. Visit http://gepasi.dbs.aber.ac.uk/softw/blat.html for more information.

[1] Windows NT 4.0 Server Resource Kit, Microsoft Press, Redmond, Washington, 1996. ISBN 1-57231-344-7

#######################################################################
#      Filename          : patch32.pl
#      Author            : Gerald ( Jerry ) Carter
#                          jerry@eng.auburn.edu
#      Date Created      : November 17, 1997
#      Last Update       : June 6, 1998
#
#      Perl5 for Win32 script to patch Windows 95 / NT clients on the
#      College of Engineering network.  Client supported are
#           Windows 95 OSR1, OSR2, OSR2.1
#           Windows 98
#           Windows NT Workstation 3.51, 4.0, 5.0 Beta 1
#
#      The following variables must be set for each OS
#           $basePatchDir            Base directory of all patches
#           $patchDirectory          Location of the patch files
#           $installPatch            Patch installation method
#           $installParameter        Patch install parameters
#           $rebootMessage           win32 command that will run if any
#                                       patches are installed
#
#      $installPatch . $patchDirectory . '\' . $pSourceDir . 
#         '\' . $installPatchParameter
#
# ================================================================ 
# LICENSE
# ================================================================
# This program is free software; you can redistribute it 
# and/or modify it under the terms of the GNU General Public 
# License as published by the Free Software Foundation; either 
# version 2 of the License, or (at your option) any later version.
# 
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# 
# You should have received a copy of the GNU General Public 
# License along with this program; if not, write to the Free 
# Software Foundation, Inc., 675 Mass Ave, Cambridge, 
# MA 02139, USA.
#
#######################################################################

# Needed module for registry functions
use Win32::Registry;

# Setup some script variables
$DEBUG = 1;
$reboot = 0;
$eventLog = 0;
$eventSource = "Patch32";
$computer = $ENV{'COMPUTERNAME'};
$eventLogFile = "Application";

#######################################################################
# Script variables - Fill these in with values appropriate for 
#                    your site

# Base patch directory
$basePatchDir = "\\\\ivy\\patch32";

# Win95 patch install method
$win95InstallPatch = 'rundll.exe setupx.dll,InstallHinfSection DefaultInstall 133 ';

# Win95 patch install method parameter
$win95InstallPatchParm = 'install.inf';

# Win95 reboot message to be executed if patches are applied
$win95RebootMsg = "$basePatchDir\\win95\\w95upd.exe";

# WinNT patch install method
$winntInstallPatch = '';

# WinNT patch install method parameter
$winntInstallPatchParm = 'update -z -u -q';

# WinNT reboot message to be executed if patches are applied
$winntRebootMsg = "start $basePatchDir\\winnt\\shutdown /l /y /r /t:30 \"Patches completed.  System rebooting.\"";

#######################################################################

# First we must determine what OS we are running
($osString, $majorVer, $minorVer, $osBuild, $osId) = Win32::GetOSVersion ();
if ( $DEBUG >= 2 ) {
   print "ID = $osId\n";
}
# win32s
if ( $osId == 0 ) {
   print "Can't patch win32s!.";
   exit ( -1 );
}
# Windows 95
elsif ( $osId == 1 ) {
   # Print the OS information
   print "OS version is Windows 95$osString.\n";

   # Set the $patchDirectory
   $patchDirectory = "$basePatchDir\\win95\\$osBuild";
   $installPatch = $win95InstallPatch;
   $installPatchParameter = $win95InstallPatchParm;
   $rebootMessage = $win95RebootMsg;
}
# Windows NT
elsif ( $osId == 2 ) {
   # Needed by Windows NT EventLog
   require "NT.ph";

   # Print the OS information
   print "OS version is Windows NT $majorVer.$minorVer (build $osBuild: $osString)\n";

   $patchDirectory = "$basePatchDir\\winnt\\$osBuild";
   $installPatch = $winntInstallPatch;
   $installPatchParameter = $winntInstallPatchParm;
   $rebootMessage = $winntRebootMsg;

   $eventLog = 1;
   Win32::OpenEventLog ( $ntlog, $computer, $eventLogFile) || warn $!;
}
# Unknown
else {
   print "Unable to determine what OS we're running!\n";
   print "Script exiting...\n";
   exit ( -1 );
}

if ( $DEBUG >= 1 ) {
   print "Patch Directory = $patchDirectory\n";
   print "Install Patch method = $installPatch\n";
   print "Install Patch parameters = $installPatchParameter\n";
   print "Reboot Message = $rebootMessage\n";
}

# Now we are ready to gread the patch.list file
open ( PATCHLIST, "$patchDirectory/patch.list" ) || die $!;

# Now we loop through the listing of patches
while ( $patch =  ) {
   
   # Check for comment
   $tmpChar = substr ( $patch, 0, 1);
   if ( ("$tmpChar" ne ";") && ($tmpChar ne "#") ) {

      # Get the individual patch information
      chop ( $patch );
      ( $pRegKey, $pSourceDir ) = split ( /:/, $patch );

      # ...This should be able to handle other hives as well as HKLM...
      # ...a kludge for now...
      $pRegKey =~ s/HKLM\\//;
      $regObject = $HKEY_LOCAL_MACHINE;

      # If we can open the given registry key, then we assume that
      # the patch is in place and go on
      if ( $pRegKey ne "" ) {
         if ( $DEBUG >= 2 ) {
            print "Patch Registry Key = \n     $pRegKey\n";
            print "Patch Source Directory = \n     $pSourceDir\n";
         }
         if ( $regObject->Open ( "$pRegKey", $patchVer ) ) {
            print "Patch $pSourceDir already installed!\n";
         }
         else {
            $reboot = 1;
            print "Installing $pSourceDir...\n";
            $installTmp = $installPatch . $patchDirectory . "\\" . $pSourceDir . "\\" . $installPatchParameter;
            print "$installTmp\n";
            system $installTmp;
            print "\n";
            if ( $eventLog == 1 ) {
               if ( $regObject->Open ( "$pRegKey", $patchVer ) ) {
                  Win32::WriteEventLog ( $computer, $eventSource, &EVENTLOG_SUCCESS,
                                         &NULL, 3002, &NULL, 0, "$pSourceDir" );
               }
               else {
                  Win32::WriteEventLog ( $computer, $eventSource, &EVENTLOG_ERROR_TYPE,
                                         &NULL, 3003, &NULL, 0, "$pSourceDir" );
               }
            }
         }
      }
   }
}


# Check to see if we installed patches
if ( $reboot ) {
   system $rebootMessage;
   if ( $eventLog == 1 ) {
      # Event : rebooting the system
      Win32::WriteEventLog ( $computer, $eventSource, &EVENTLOG_INFORMATION_TYPE,
                             &NULL, 3004, &NULL, 0, "" );
   }
}

if ( $eventLog == 1 ) {
   # Event : Successful script completion
   Win32::WriteEventLog ( $computer, $eventSource, &EVENTLOG_INFORMATION_TYPE,
                          &NULL, 3000, &NULL, 0, "" );
   Win32::CloseEventLog ($ ntlog );
}

exit (0);

########## end of patch32.pl ##########################################
#######################################################################

;
;     Patch listing for Windows NT 4.0 ( build 1381 )
;
;     Author          : Gerald ( Jerry ) Carter
;                       jerry@eng.auburn.edu
;                       College of Engineering Network Services
;                       Auburn University
;     Date Created    : February 20, 1998
;     Last Update     : June 1, 1998
;   

; Service Pack 3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\ServicePack3:sp3

; This fix corrects GETADMIN problem
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q146965:admnfix

; This fix corrects the chargen/telnet port issue (135)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q154460:chargen

; Workaround for Pentium problem with invalid opcode
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q163852:pentfix

; Fix for newtear and bonk attacks.  Also ICMP attacks
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q179129:tearfix

; This fix is for lsahack.exe problem..  Also increased encryption on 
; the LSA secrets in te registry.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q184017:lsa2fix