VPN Connection

So there are different types of VPNs specifically I am talking about the ones I have made using Cisco with IPsec I believe.

For Windows I use Shrew Soft:
This gives you lots of options, most of which I haven't used because of how I have done my Cisco configs it hasn't been necessary.



For Linux I use vpnc:
First you need to install vpnc
sudo yum install vpnc
Then you need to change the contents of /etc/vpnc/default.conf to:
IPSec gateway the.external.ip.address
IPSec ID CiscoGroupPolicy
IPSec secret ItIs@Secret
Xauth username YOURUSERNAME
Xauth password YOURPASSWORD
IPSEC target network network.ip.scheme.0/24
or
If you put the config information in /etc/vpnc/filename.conf and use "sudo vpnc filename" to connect to the vpn instead.

Replacing YOURUSERNAME and YOURPASSWORD with your own username and password.

After you have done that, just run sudo vpnc to start up the vpn. To disconnect from the vpn, just run sudo pkill vpnc or vpnc-disconnect

It appears that I have found a fix for the "No internet access" issue. Simply create a file with these contents and run the following commands:

(i will work on formatting this correctly so it looks like code and not just a bunch of lines)
diff -aur vpnc-0.5.3.svn527.old/vpnc-script vpnc-0.5.3.svn527.new/vpnc-script
--- vpnc-0.5.3.svn527.old/vpnc-script 2013-08-16 15:30:17.422036172 -0600
+++ vpnc-0.5.3.svn527.new/vpnc-script 2013-08-16 15:31:20.228503547 -0600
@@ -227,7 +227,7 @@

  set_default_route() {
  $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE"
- $IPROUTE route replace default dev "$TUNDEV"
+# $IPROUTE route replace default dev "$TUNDEV"
  $IPROUTE route flush cache
  }

This should finish with the just the message of "patching file vpnc-script" on success. It may also say something along the lines of "Hunk #1 succeeded at 131 with fuzz 1 (offset -96 lines).". If it doesn't, something went wrong (or the patch file needs updating).
cd /etc/vpnc/
sudo patch -Np1 -i /path/to/the/patch/file/you/downloaded.patch

I also have installed shrewsoft from source.
-This has been the guide I have followed.

You can also use ShrewSoft via the command line.

Tunnelling
ssh -f searchadmin@10.30.30.23 -L 8080:10.30.30.1:443 -N

Then go to 127.0.0.1:8080

Recently I've been having to install Shrew Soft on my Linux machines as well which has been a pain. The reason for this appears to be some change Cisco made. I'm looking into a way to fix it but basically it causes so much network traffic when I connect via vpnc it doesn't allow anyone else online.

Honey Pots (heffalumps and woozles)

Heffalumps and woozles love honey. So how do we prevent them from getting ours?

So the first time I heard this term was last week. Which means I still have a lot to learn. First lets answer a few questions:

Q. What is a honey pot?
A. Simply put a honey pot is a server that looks too good to pass up for a hacker, and lets you know the network has been compromised amongst other things.

Q. Why use a honey pot?
A. Uses for a honey pot will vary from understanding the attack methods used by hackers, to a base start for an IDS (intrusion detection system) or IPS (intrusion prevention system).

Q. How do I set one up?
A. Well there are Many ways to do this. The simplest is downloading a Virtual Appliance that has a lot of the tools already installed. That can be found here. HoneyDrive has its benefits and fails just as all such services do. I am still looking into other options as HoneyDrive is the first and only one I have played with at the moment, but it has some sweet looking graphs with kippo already set up.

It also has a "Playlog" that you can playback and see everything a user typed once they got in.

So I got this set up and played with it a bit and found a few issues off the bat.

1) An updated ssh version won't recognize kippo due it it requiring stronger keys.
2) Some errors it throws back will let me detect that its not actually an ssh client.

In the mean time I will continue looking for a better option. I am also hoping to find one that will automatically send me an email once someone connects to it (which this might I just only spent a day going through its tools).

Penetration Testing

So in the last two months (December and January) I have had the opportunity to do a bit of penetration testing for work. This has renewed my interest in cryptography once again. So the first thing I did was just basic Kali Linux penetration tests.

Kali Linux is simply Linux with a bunch of free penetration tools pre-installed. The hard part is learning to utilize each tool and understanding what it is doing. Basically it allows you to run known exploits.

Recently an exploit has come to fruition called the CVE-2016-0728, has been found. While not as bad as some it is still fairly dangerous as anyone with shell access can get root access. I got to test and make sure we were secure against it. When you are pen-testing and you fail that's a good feeling. Especially when you are dealing with sensitive data.

Backing up Data

Backing up data is always a good idea, especially if it is something you will want later.
If it is a personal file Google Drive, Drop Box and One Box are all great resources that give you between 5 and 30 gig of space for free.

There are various methods of backing up data. If you are just backing up files the above will do. If you want more advanced options or more space you can always set up an sftp server and rsync your files. Whatever it is you are backing up make sure you back it up properly.

One thing I do want to mention is backup rotation. There are various methods of backing up data and one is simply to overwrite the old backup with a new one. This is nice if you loose a file but what if you over wrote changes that you wanted to keep?

If you are constantly adding data to a server or constantly changing a file or configuration it is best to back up using dates. One example of this is every time I make a change to a Cisco firewall I backup the change with the name of the machine and the current date.

For things that get changed more often and have large amounts of data sometimes its necessary to make a rotation cycle. For example:

Everyday for 1 week (7 backups)
Every week for 1 month (3 additional backups)
Every month for 1 year (11 additional backups)
and for tax purposes every year for 7 years I think (an additional 6 after that)

This leads to a total of 27 backups. While this method doesn't back up EVERY single change it goes with the assumption that you have a week to find a problem before it starts deleting data. The benefit to this is that it takes less space. If you are unconcerned about space then by all means backup and keep every backup.

For Databases:

MySQL backups can be done with a mysql dump. This "dumps" an entire database or databases into a file. You can also do individual tables. An LDAP database is similar in that you dump the database using slapcat (or some other commands).

Once I had to do a different dc for an ldap backup and it caused so differences.
Here are the commands I ran:

 sudo slapcat -b dc=special,dc=com > ldapdumpspecial.raw
 slapadd -l /home/mwaldorf/ldapdumpspecial -b dc=special,dc=com

I will include further instructions on specifics in different posts but I wanted to have this saved somewhere. I do believe before the restore we run:
egrep -v ‘^entryCSN:’ < /root/ldapdump.raw > /root/ldapdump on the

Always remember to restore permissions and SeLinux context. If you do not do this it will not work properly a lot of the time. For windows users backing up a file system can be different. There are various options for backup and recovery.

ASA 5506

The new ASA frustrated me for quite a while. First I couldn't get the ASDM to run. Turns out it needs Java 7. I use Java 6 for Cisco CCP (a software predating the ASDM). So after playing with my network I got it to work in a Linux virtual machine (I like to do all of my Cisco networking changes in one environment). Turns out that sometimes on that linux bot the ASDM just stops loading until you restart the software. Well beggars can't be choosers I guess (another reason why the CLI is better... that worked instantly no problems at all). I did find the initial set up of the router a bit more friendly. DHCP is already enabled. ASDM is already enabled, and the wizard in the ASDM is a bit more friendly.

I have 6 of these to configure. Three sites each with a failover unit. One of them is supposed to have wifi. I spent a good amount of time trying to login the the wifi part of the unit. I had to dig around for a while before I found the command "hw-module module wlan recover configuration" after running that I was able to finally get in. I will mention I did use the wrong IP at first the default IP is http://192.168.10.2 while I was using http://192.168.10.1 an simple quick read error. I got the 5GHz up but not the 2.4, still not sure why its not up.

This is mostly a bit of ranting to remind me of two things 1) the correct IP for the wife and 2) the fact that ASDM has to be on Java 7 on in a Linux box. As an aside I also was unable to use Chrome and had to use Firefox to get it to work right.

As an update to this post the 5506 will not run properly in the newest Java either. Java 8 update 51 is the closest I can find to allowing everything to run correctly. On a separate machine I had to revert back to Java 8 update 11. I haven't tested everything with both of them and in part it is because we tunnel into machines that we get some problems. I also found that my Linux vm won't do for configuring everything on these machines as it doesn't show the entire spectrum of options. I am not sure why but this means that I will have to continue to have a windows box (or two depending on what we do with our old router I need Java 6 on).

SELinux

So I have commented on SELinux before and to be honest it frustrates me very badly, but it also makes a system much more secure. I have heard taht A lot of people just turn SELinux off. Working with Health Care info that is not an option.

I have found that most of the time you can either fix it simply by going through the logs and a quick google search or if you know the context is supposed to be like another files by copying it (for example I ran into an error when a file did not have permissions due to recently being ssh'd over so a service would not start). I have found 2 commands to be extremely helpful.

This one copies the security permissions of one file to the new one
chcon --reference=/path/to/existingfile /path/to/newfile

The other one is restorecon -R /path/to/file(s) which I had to do when I deleted the entire folder in /etc/folder that was being used instead of just the contents of the folder.

All in all I have to say PLEASE don't just disable SELinux. You'll find the answer somewhere that's what the internet is for.

.eml file? and other IE uses

So I haven't done much ever with outlook and I have only dinked around with Thunderbird. These applications just are just too much from what I want in email. I do know however that many people use them in a professional environment. Normally this has no problem in sending emails back and forth but I got an attachment as a .eml file. I needed the file because it had how to set up specific VPN. Turns out this is a file type that Outlook and Thunderbird use (and quite possibly other systems from what I can gather)!

There are a few solutions to viewing it, changing the extension to be html and any browser will work but as it turns out the only one that will simply load it (and format it perfectly) was Internet Explorer.

Now I dislike IE as much as the next guy (well any one under the age of 60 to be fair), but as it turns out I have found 2 uses for it now. One being this .eml file viewer and the other being that you can disable the certificate check. Normally I would say NEVER DO THIS and if you are using IE make sure it is enabled but in my case it was necessary as the certificate was never properly installed on a server (which is now in the process of being fixed so we can all go back to using Chrome and Fire Fox).

I mentioned installing certificates for websites in this post but I probably will not write on that if I don't do it for a personal site. It is a fairly straight forward process that involves creating a .csr and .key files and uploading/emailing them and then downloading the .crt file and it will depend on who you get your domain from etc. Most sites will have specific instructions on how to make them.

Here is the one from GoDaddy. It also has ones for generating a CSR etc.