Cisco Site to Site VPN

So the reason I have not posted is because I have been working on setting up a site to site VPN using Cisco. I had gone through the configs a few times and couldn't figure out what I was doing wrong. After a week we got Cisco support involved, but it took a week to get the support.

All in all I found out a few things in the process. The most important thing I found out was that make sure you send the correct data to the other end. I had put in an incorrect IP in the form I sent them which made my end correct according to what they sent me and their end incorrect.

I'll post some of the other things I learned along the way in another post (for example the troubleshooting that I did).

I am also planning on putting up a VPN at home this week so I will let you know how it goes!

Tunneling

So sometimes it is necessary to tunnel to get access to a router (which is a way more secure way to get to that router).

Windows:
Windows doesn't have a native terminal. I use PuTTY (tty - teletypewriter new fun fact)
UPDATE: Windows 10 does have a Linux terminal now (its basically an Ubuntu shell if I remember correctly). I will add a post on how to enable it but honestly I have found I prefer KiTTY.
In the settings under Connections>SSH>Tunnels you can add a tunnel. Source port is the port you want to connect through and then the ip of the gateway and port. Click add and it adds it to the list above.

Then go to 127.0.0.1:8080

For those seeking an alternative to PuTTY I found KiTTY it is similar but gives the end user a few more options, as well as allows for saving sessions to a directory or registry. I am pretty sure it was built with the PuTTY backbone though.

Linux:
ssh -f user@ip.of.lan.machine -L 8080:ip.of.default.gateway:443 -N
-L is for local-port:hostname:remote-port format
-N is to not execute a command on the remote system.

Then go to 127.0.0.1:8080 -note if it is https you may have to put in https:// before the 127
A Ctrl + c should end the tunnel.

Google Voice getting phone calls.... And other settings!

I love Google Voice. I am a huge fan of texting it gets things done its quick. Mostly I grew up in the era of IM's so it is something I used to spend many sleepless nights doing. Google voice just makes sense for this. I used it for a bit but didn't really need it. Now I rely heavily on it as I do not have a phone outside of emergencies and an old iPhone with no service.

So it took me a while to figure out why my Google voice was not accepting calls correctly to my iPhone, I didn't have the time until recently to dig into it, a few quick searches and I found it. In saying that I want to point out that searching for the correct key words really helps.

Basically what I use for all calls is my Google voice and it was great for outgoing calls and text, but I couldn't receive calls. Well I found the answer! There is setting that it seems is only turned off initially with iPhones, thank you Google...

To send pictures using your Google Voice number from a computer go to the bottom.

Below is how to fix it.

What I found was
1) You have to use the "Hangouts" app (the Google voice app makes it go through your phone)
2) You have to change a single setting called incoming calls or something of that sort which is under another setting called phone number.

I pasted the instructions from

https://support.google.com/voice/answer/3438876?hl=en

Get an incoming call

To receive incoming calls through Hangouts, you must have a Google Voice account. Incoming calls will appear as notifications instead of ringing directly on your cell phone. You can answer the call by touching the notification or swiping it on the lock screen. But remember, if your screen is passcode-protected, you’ll have to unlock it first.

If you have Google Voice set to forward calls to your cell phone, you’ll receive the call directly to your phone instead of through the Hangouts app.
Set the Hangouts app as the default for incoming Google Voice calls

You can only set the Hangouts app as the default for incoming Google Voice calls if you are a U.S. Google Voice customer.
Open the iOS Hangouts app.
Touch your profile photo at the top of the screen.
Choose the settings icon .
Touch Phone number.
Touch Incoming phone calls to on make Hangouts the preferred destination for all calls made to your Google Voice number.

Hangouts will be the automatic setting for calls to the Hangout app on iPads and iPod Touches, but not iPhones.

This setting is only for each device you have, not each account. So if you more than one device you'll need to change the setting on each device.

Sending Pictures from Google Voice number
First off you have to be using the new hangouts chat in G-mail. Once there search for the person or number you want to send to. With this just start typing in the contact name and then click on the sms link for the desired phone number.

From the iPhone app you just click the paperclip button...

Random Tips

These are just things I don't really have a place for but I don't want to forget either.

Notepad++

Add "," comma to end of lines in Notepad++

Notepad made life is easier for user to add comma at the end of the each row.

1) Keep the cursor at the end of the column 

2) Press SHIFT + ALT + DOWN ARROW KEY till you reach last row or drag till the rows you wish to add comma

3) Press "," comma and you see comma is added to end of all rows,

- You can also use this feature for indenting as well. In the above example, you just have to use SPACE or TAB instead of COMMA.

Thanks to: http://techtips-it.blogspot.com/2011/03/add-comma-to-end-of-all-columns-in.html 

Compare 2 files?

WinMerge is a good tool Linux has a native file comparison (comm) need to find out more about it

diff can also be used in Linux but that just shows the differences comm compares.

Super large file?

Vim is for Linux and Windows. It is the only thing I have found that allowed me to navigate a sql database file that was massive (a couple of gig).

http://www.vim.org/download.php

Windows keys that come with computers can only be used on that mother board (there are ways around this although the legality I have heard is questionable).

Disable enable Task Manager and Windows Lock Work Station
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
32 bit REG_DWORD

• DisableTaskMgr 1 is disable and 0 is enable.
• DisableLockWorkstation 1 is disable and 0 is enable

Random things pop up while typing?
Hit your Window keys really fast and make sure it pops up quickly. It is most likely jammed (I couldn't figure out why windows media player kept popping up). Other possible culprits are Ctrl and Alt keys but I have seen Windows key most.

Chrome extensions:
Adblock and Adblock plus if you do not have these install them.
I decided to include a story about why these are great tools I support. So I had them installed and then my sister asked for a program like dia where you could make a map of things etc. I decided to try dia out and thought it was nice and intuitive. I sent her a link to one of the download pages and it was filled with ads (which I did not know as I had adblock on) and she clicked an incorrect download link and got some nice adware. A simple system restore fixed her problem but at the same time I realized that everyone needs this and from now on when sharing downloads to family I will just have to do it through Drop Box.

Syslog Server for localhost and Cisco.

A bit ago I posted about Linux audit logs. This is kind of a follow up to that. It is a much nicer way to view and search them.

So I set up a syslog server, but I decided to make it much nicer to myself and add a program called loganalyzer to it (it uses apache and php to view the logs and makes it look so much nicer).

I was going to put this in a CentOS box I had installed but I forgot the password, so I was going to fresh install everything anyway but the most recent Virtual Box update broke PXE booting.. So I installed everything on my Fedora 20 test box.

I followed the basic instructions (with a few modifications) from
http://tecadmin.net/setup-rsyslog-with-mysql-and-loganalyzer/
and
http://tecadmin.net/setup-loganalyzer-with-rsyslog-and-mysql/ but I will post them as well as I had trouble with step 3.6 to 3.7 so I started over from step 3.1 and got it to work. Basically it kept looping me weird.back to step 6.

The basics are:
Install the packages:
# yum install php php-mysql mysql-server httpd
Start the services:
# service httpd start
# service mysqld start
Make sure they are on at startup:
# chkconfig httpd on
# chkconfig mysqld on <-wouldn't run for me
# mysqladmin -u root password 'itsasecret'
Install more packages:
# yum install rsyslog rsyslog-mysql
Turn off syslog:
# service syslog stop
# chkconfig syslog off
Turn on rsyslog:
# service rsyslog start
# chkconfig rsyslog on
Create rsyslog Database:
# mysql -u root -p < /usr/share/doc/rsyslog-mysql-4.8.10/createDB.sql
Create MySQL user and grant privileges
# mysql -u root -p
mysql> GRANT ALL ON Syslog.* TO 'user'@'localhost' IDENTIFIED BY 'itsadifferentsecret';
mysql> FLUSH PRIVILEGES;
mysql> exit
# vi /etc/rsyslog.conf <-note you can use whatever editor you want here.
In the Modules section of the file (this is near the begining) add:
$ModLoad ommysql
 *.* :ommysql:127.0.0.1,Syslog,user,itsadifferentsecret
Restart the service
# service rsyslog restart

Then install loganaylzer:
# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz
# tar xzf loganalyzer-3.6.5.tar.gz
Move it to where httpd can get to:
# mv loganalyzer-3.6.5/src /var/www/html/loganalyzer
Create a blank config file and give apache the rights to it:
# cd /var/www/html/loganalyzer
# touch config.php
# chown apache:apache config.php
# chmod 777 config.php

Here I had some selinux issues. I ran: "setenforce 0" and was able to find out the problem.

Run: setsebool -P http_read_user_content 1

If you changed setenforce change it back to 1

In a web browser go to:

http:ip.of.log.server/loganalyzer/install.php

(I did this on the local machine)

Here is where I recommend using the other guys pictures as I didn't take any... Sorry. It is pretty intuitive to set up from here as well.

I went through quite a few sites and most all have the same content so you can google rsyslog and loganalyzer and they find one. I liked his because it had pictures as well as the commands written out.

Changes: I couldn't set the mysqld to run at start up but the mariadb would so I did that (not sure if this is working yet).

Also note there is a newer version of loganalyzer than he is using.

I will be adding other servers to the logging once I get that figured out.

I had some trouble setting up the Cisco configuration on the server but all in all I got it working. This is what I ended up doing:

In the rsyslog.conf file:
Uncomment out $ModLoad imudp and $UPDServerRun 514 lines
At the bottom add the following two lines to the bottom of the file:
# # Logging for Cisco router 192.168.1.1 # local7.* /var/log/cisco
$AllowedSender UDP, 127.0.0.1, ip.of.cisco.router

Then add the file:
touch /var/log/cisco

restart the rsyslog service:
rsyslog service restart

In order to get it to show up in loganalyzer:
chmod 755 cisco (I don't remember why i did those permissions but they worked)

Make sure firewall rules allow for connections on ports 514 and 80

#not necessary
In the admin console (after the permissions are changed) add a source that looks like the following:

I also ended up opening port the default port 514 on udp for the server as I couldn't figure out why the settings were not working. I basically changed things a number of times so I am not sure when it started working but this is the ending configuration of everything.

Lastly you have to set up the Cisco part. That was pretty intuitive basically I just put the logging level I wanted as well as the IP address I was sending the logs to. Once that was done I made sure it was turned on. I was using Cisco Configuration Professional but ASDM is pretty similar in its config.

The end results!! BEHOLD!

When I rebooted I noticed my firewall was not working correctly. I opened ports 514 for TCP and UDP and everything worked again. I did this through the GUI in Fedora 20.

Password Rants and Raves...

Sometimes it is necessary to update a password or sometimes you can't use the default one you use for everything. For things you use regularly I recommend at minimum changing your password every three months, especially for anything that has sensitive information. Not that passwords are all guessable, I love my base one, but I did see 2014 top dumb passwords list and was surprised at how easy some are, including numbers 1 and 2 respectively 123456 and password (http://www.cnet.com/news/worst-passwords-of-2014-are-just-as-awful-as-you-can-imagine/).

If you don't want the hassle of changing all of your passwords, most online services have two factor (basically a number that changes every 30 seconds). So long as you have an accurate time it works nicely. I have seen private ones get blocked by firewalls because the ntp service could not reach the server.

So here are a couple of suggestions for varying strength in passwords.

Simple:
Go to a dictionary (physical book or online) and find a random word (thumb the page for a few seconds and stop after about 3-7 then find a word on the page or choose a random word from your favorite dictionary site). Convert that word into leet (1337) there are various methods of doing this, including online converters that you choose the conversion. Generally I only use a few @ for a $ for s and 3 for e to keep it simple.
Find a poem you like and choose the first letters of each word, or line.
Write a poem and do the same.
Add a ... or ,,, or ??? etc at the end of your current password - (this actually increases it's complexity significantly)

http://creativitygames.net/random-word-generator is a site that I often use as it lets you pick a number of random words.
http://watchout4snakes.com/ is another good one that gives you options to make a phrase etc.

More Complex:
Convert a phrase to leet from your favorite quotes, books, etc.
Grab multiple words in the dictionary (3 to 4 is generally a good amount of security) and throw in random numbers and symbols.

http://www.robertecker.com/hp/research/leet-converter.php

This is my favorite leet converting site. Mostly because it lets you pick a few things thus making it more random or pre-generated if you are lazy ^.^

Most complex:
Use a random alpha numeric and symbol generator (the utility here is from a personal developer I know http://www.maxoutput.com/)

It is actually a networking utility (I use that aspect of it the most) but the fact that it creates random passwords has been a bonus. It even does more than one at once.

From my experience I believe generally 10 to 12 characters minimum is sufficient, but beefier the better.

If you are anything like me you have many variations on your password and cannot always keep straight which one is which. Well I have 3 solutions:

Classic little black book - no one looks for these any more, you can get one for about a dollar at the store for notes and such and just choose a page for passwords.

KeePass - If you don't like carrying notebooks around but always have a flash drive you can use Key Pass. the nice thing about it is it lets you organize everything as well. It does however take a password to open so in reality you only need to remember 1 password so you can access everything else. You can also make notes about each item. It includes a random password creator which is (I think) intended for use as you are making accounts.

Passpack - So I recently started using this because of work. It is nice in that you can share your password with people if you want as well as has 2 layers of passwords before you get to actually see the passwords. The other nice thing is it is online. A simple account is free to use with limited sharing etc but I found I didn't need more than that. You create an account, Then you create what they call a packing key (they recommend using a sentence). Then you can view things, search the database they have and even "hide" things from people peeking over your shoulder. They even include a generator as well I found out the other day.
https://www.passpack.com/online/

I mostly use KeePass as I have used that one the longest and am most comfortable with it.

This one was a bit long but hopefully people will be encouraged to beef up their security a bit.

Wireshark and tcpdump

First off let me say I started using Wireshark having NO IDEA what the crap was going on other than I see things on the network. This made it a very non useful tool to me. I could find out things I wanted to know without so much jumble in the middle other ways. That said I never had to look at packets as I was generally trying to figure out other things.

Now I have taken the time to look at a few things with it, as I needed a way to capture the packets so the development department at work could figure out if we were truncating responses in our software or if a client was.

Some things to note:
1) Working with Wireshark is much easier once you understand it a bit. It is not something I think someone should just jump into as it gets frustrating.

2) Know what you want to do before you go to Wireshark. In this example I am looking for requests and responses to one other machine.

3) Understand filtering of what you want to do.

So I want to filter two machines (hopefully based on IP) and I want to follow their tracing.

Now I can only capture based on what is sent to one computer so I would need Wireshark on both computers (this being said I only have access to one so I was only responsible for getting results to one).

So objective: Compare two packets and see if loss occurs.

tcpdump is another tool that lets us do basically the same thing but command line only. Write it to a file and then import it to another machine and load it in Wireshark if you prefer the gui.

tcpdump -w <filename>.pcap -i eth0
tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16

(I forgot my username at first, then I forgot to do it with sudo ^.^ sorry but at least it has the commands in there)
Ctrl+c to stop the dump. I believe you can also run it as a daemon but I don't remember.

Results:
Effectively what I ended up doing was using just what I said using tcpdump and inporting it to Wireshark. I dumped everything as I didn't have my notes with but but luckily Wireshark lets you filter very nicely which made it easy. The hard part is I don't have the .pcap file from the other people to compare with they only sent over the csv of ALL the communication between the two computers but none of the packets, which I want to compare.

I merged the two files together so it would be easier to try and use native Wireshark tools to try and analyze it. Here is what I used to filter out the two. The times are different on our end and theirs which made it hard to search through and note I am only looking for https requests hence port 443 being looked at only.

(ip.src == internal.ip.addr.server && ip.addr == external.ip.addr.client)  || (ip.src == external.ip.addr.server && ip.addr == internal.ip.addr.client) && tcp.port == 443
I don't have a server and client scan that I can use (the one I was using has sensitive data on it so I don't want to take a chance).

Here is a smaller filter of a packet capture I did that uses part of this larger filter:

The || is or so if you have both files combined it works nicely. There are lots of tips for filtering Wireshark. Just give Google a go.

Wiresharks native compare tool almost lined the times up exactly from what I could tell which made it much easier to tell where the packet loss happened as well as the fact they issued a connection reset. All in all it was most useful yet we didn't find what was causing the "bug" in our (or their) software, but now I know a lot more about packets and networking.

The compare tool told me basically the time difference and I was able to find it on both sides using that but also because I was at the location on one side and at the beginning of the trace on the other and it just happened to be at the beginning of the other trace. We calculated the difference by hand (basically found some packets that matched and subtracted the time difference) and the compare tool was right on. If you are using two different traces, you have to combine them together first then compare, otherwise it won't tell you much.

Other things to note the sending side will always have more than the receiving as parts are getting stripped in the routing.