New computer!!

So I recently got a new computer, an Alienware Alpha. It is a nice little machine but I could not for the life of me get the controller to work in games. I found out that it was because I set it up as a PC first. Turns out the alpha ui driver for the controller takes precedence. To solve this I simple uninstalled the alpha ui. It was better than doing a factory restore after I had downloaded most my games. I am finding that it runs great though.

VPN Connection

So there are different types of VPNs specifically I am talking about the ones I have made using Cisco with IPsec I believe.

For Windows I use Shrew Soft:
This gives you lots of options, most of which I haven't used because of how I have done my Cisco configs it hasn't been necessary.



For Linux I use vpnc:
First you need to install vpnc
sudo yum install vpnc
Then you need to change the contents of /etc/vpnc/default.conf to:
IPSec gateway the.external.ip.address
IPSec ID CiscoGroupPolicy
IPSec secret ItIs@Secret
Xauth username YOURUSERNAME
Xauth password YOURPASSWORD
IPSEC target network network.ip.scheme.0/24
or
If you put the config information in /etc/vpnc/filename.conf and use "sudo vpnc filename" to connect to the vpn instead.

Replacing YOURUSERNAME and YOURPASSWORD with your own username and password.

After you have done that, just run sudo vpnc to start up the vpn. To disconnect from the vpn, just run sudo pkill vpnc or vpnc-disconnect

It appears that I have found a fix for the "No internet access" issue. Simply create a file with these contents and run the following commands:

(i will work on formatting this correctly so it looks like code and not just a bunch of lines)
diff -aur vpnc-0.5.3.svn527.old/vpnc-script vpnc-0.5.3.svn527.new/vpnc-script
--- vpnc-0.5.3.svn527.old/vpnc-script 2013-08-16 15:30:17.422036172 -0600
+++ vpnc-0.5.3.svn527.new/vpnc-script 2013-08-16 15:31:20.228503547 -0600
@@ -227,7 +227,7 @@

  set_default_route() {
  $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE"
- $IPROUTE route replace default dev "$TUNDEV"
+# $IPROUTE route replace default dev "$TUNDEV"
  $IPROUTE route flush cache
  }

This should finish with the just the message of "patching file vpnc-script" on success. It may also say something along the lines of "Hunk #1 succeeded at 131 with fuzz 1 (offset -96 lines).". If it doesn't, something went wrong (or the patch file needs updating).
cd /etc/vpnc/
sudo patch -Np1 -i /path/to/the/patch/file/you/downloaded.patch

I also have installed shrewsoft from source.
-This has been the guide I have followed.

You can also use ShrewSoft via the command line.

Tunnelling
ssh -f searchadmin@10.30.30.23 -L 8080:10.30.30.1:443 -N

Then go to 127.0.0.1:8080

Recently I've been having to install Shrew Soft on my Linux machines as well which has been a pain. The reason for this appears to be some change Cisco made. I'm looking into a way to fix it but basically it causes so much network traffic when I connect via vpnc it doesn't allow anyone else online.

Honey Pots (heffalumps and woozles)

Heffalumps and woozles love honey. So how do we prevent them from getting ours?

So the first time I heard this term was last week. Which means I still have a lot to learn. First lets answer a few questions:

Q. What is a honey pot?
A. Simply put a honey pot is a server that looks too good to pass up for a hacker, and lets you know the network has been compromised amongst other things.

Q. Why use a honey pot?
A. Uses for a honey pot will vary from understanding the attack methods used by hackers, to a base start for an IDS (intrusion detection system) or IPS (intrusion prevention system).

Q. How do I set one up?
A. Well there are Many ways to do this. The simplest is downloading a Virtual Appliance that has a lot of the tools already installed. That can be found here. HoneyDrive has its benefits and fails just as all such services do. I am still looking into other options as HoneyDrive is the first and only one I have played with at the moment, but it has some sweet looking graphs with kippo already set up.

It also has a "Playlog" that you can playback and see everything a user typed once they got in.

So I got this set up and played with it a bit and found a few issues off the bat.

1) An updated ssh version won't recognize kippo due it it requiring stronger keys.
2) Some errors it throws back will let me detect that its not actually an ssh client.

In the mean time I will continue looking for a better option. I am also hoping to find one that will automatically send me an email once someone connects to it (which this might I just only spent a day going through its tools).

Penetration Testing

So in the last two months (December and January) I have had the opportunity to do a bit of penetration testing for work. This has renewed my interest in cryptography once again. So the first thing I did was just basic Kali Linux penetration tests.

Kali Linux is simply Linux with a bunch of free penetration tools pre-installed. The hard part is learning to utilize each tool and understanding what it is doing. Basically it allows you to run known exploits.

Recently an exploit has come to fruition called the CVE-2016-0728, has been found. While not as bad as some it is still fairly dangerous as anyone with shell access can get root access. I got to test and make sure we were secure against it. When you are pen-testing and you fail that's a good feeling. Especially when you are dealing with sensitive data.