Fir3net.com

How to Secure your Cisco Router

Thu, 29 Jul 2010 12:10:19 GMT

Below shows a number of commands that you can use for securing your Cisco router.

Block Denied Logins - Useful for delaying denied logins when someone is trying to brute force your router.
{c}(config)# login block-for [seconds] attempts [attempts] within [seconds]{/c}Quiet Login Allows you to still login once the router has blocked login attempts because of the above. A permitted list is created via the ACL.
{c}(config)# login quiet-mode access-class [acl]{/c}Login Delay Adds a delay at the point of your login being unsuccessful.
{c}(config)# login delay [seconds]{/c}Login Logging Generates a log after a certain amount of failed or successful attempts.
{c}(config)# login on-failure log [#]
(config)# login on-success log [#]{/c}Min Password Length Ensures that any new password created on the router meets a minimum password length.
{c}(config)# security password min-length [number of characters]{/c}Set Timeout Sets a time out period for your line (con vty).
{c}(config-line)# exec-timeout [min/hour] [time]{/c}Encrypt Passwords Encrypts all passwords within your routers config.
{c}(config) service password-encryption{/c}

Creating CLI Views on a Cisco Router

Thu, 29 Jul 2010 11:46:55 GMT

CLI Views allow your to to create sub administratos to for your cisco devices. This can also be thought of as an extension to privailage levels, giving you further granulaity over what your users are allowed to do.

Creating views

Below shows you the commands required to create a view mode. In all the examples we use SHOWMODE and HELPDESK and view mode names, these could be changed to anything you want. Also to access the root view (which allows you to administor all the view modes) use the command enable view.{c}# aaa new-model

(config)# parser view SHOWMODE
(config-view)# secret [password]
(config-view)# commands exec include all show
(config)# parser view HELPDESK
(config-view)# secret [password]
(config-view)# commands exec include all show
(config-view)# commands exec include configure terminal
(config-view)# commands configure include ip route
(config-view)# commands configure include all interface{/c}

Logging into a Viewmode

In order to move yourself into a particular view mode once you logged in use the following command.

Configuring TACACS+ on a Cisco Router

Tue, 27 Jul 2010 20:57:19 GMT

TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco proprietary protocol which provides access control for routers, network access servers and other networked computing devices via one or more centralized servers. TACACS+ uses port tcp 49 and provides separate authentication, authorization and accounting services.

Below shows you the general steps involved,

First of all configure you router to use TACACS+. Make sure that you do not logout of the router at the point of running the command aaa new-model as this will clear your current login settings. {c}(config)# aaa new-model
(config)# tacacs-server host [tacacs ip] single-connection
(config)# tacacs-server host [tacacs ip] key [key]{/c}On your TACACS server configure you router as a TACACS client.
Back on your router add the following commands. This only shows you a brief general guide on the configuration steps, and in a real world scenerio your config would be much more detailed.{c}(config)# aaa authentication login [AUTH LIST NAME] group tacacs+ local
(config-line)# line vty 0 4
(config-line)# login authentication [AUTH LIST NAME]{/c}

How to enable SDM on your router

Mon, 26 Jul 2010 20:21:45 GMT

SDM allows you to configure and manage your router via the use of a GUI. Please find the steps below :

Ensure that you have the sdmconfig*.cfg file within your routers flash.
via using the command `show flash`.

If it is not then you can download the SDM installation file from Cisco and then Choose to either install the SDM software on your local machine, on your router or both. {c}router(config)# username [password] secret [password] privilege 15
router(config)# ip http server
router(config)# ip http secure-server
router(config)# no ip http server
router(config)# ip http authentication local{/c}

Tip : When you are in the SDM GUI go to "Edit Perferences | Preview Commands before delivering router". Check this tick box to allow you to see commands before sending them to the router.

Build a Samba Server on Redhat / CentOS

Mon, 26 Jul 2010 18:36:31 GMT

Below shows you the basic steps in order to configure your Linux Redhat CentOS server as a Samba server.

Install and Configure

{c}yum install samba -y
chkconfig --level 123 smb on
cd /etc/samba
mv smb.conf smb.conf.backup
vi smb.conf
cat > /etc/samba/smb.conf {/c}[paste the text below]{c}# Global parameters

[global]
workgroup Workgroup
netbios name SambaServerserver string Samba Server %v
log file /var/log/samba/log.%m
encrypt passwords yes
max log size 50

[data]
path /data
valid users smbuser
read only No{/c}

Configure Users
{c}adduser smbuser

Restart Samba
{c}/etc/init.d/smb restart{/c}
Map Drive

You can now map your drive with the windows command prompt using the command :{c}C:\Users\admin>net use \\[SAMBA SERVER IP]\data /user:smbuser [password] /PERSISTENT:YES{/c}

Troubleshooting

To see if the share is available you can run the following command {c}[root@SambaServer smbclient -U smbuser -L //[SAMBA SERVER IP]
Password:
Domain=[FILESERVER] OS=[Unix] Server=[Samba

How to set the Time / Date and Timezone in CentOS

Sun, 25 Jul 2010 21:27:28 GMT

In this article we will show you how to set the time, date and timezone within CentOS. Though im sure this method will remain the same through the various Linux distrobutions.

Steps

Set the time zone
Set the time and date
Sync the hwclock with the current time and date

Commands

Below are the commands that are required. For the date command this will set the time and date to 25th July 22:17. The syntax is `date MMDDhhmmYYYY`.{c}rm /etc/localtime
ln -s /usr/share/zoneinfo/GMT /etc/localtime
date 072522172010
hwclock --systohc{/c}

Confirm Settings

To confirm your machine is set with the right time and date run the following commands {c}[root@Fileserver date
Sun Jul 25 22:38:47 GMT 2010
[root@Fileserver hwclock
Sun 25 Jul 2010 10:38:51 PM GMT -0.125883 seconds{/c}

How to install SSH on Solaris 10 x86

Wed, 14 Jul 2010 12:22:08 GMT

This guide will show you how to install SSH on Solaris 10 x86 from the Solaris installation DVD.

Mount CD
If you havent enabled the feature that will automatically mount your CDROM drive you will need to mount it using the following commands :
{c}mkdir /cdrom{/c}Find the name of your cdrom
{c}-bash-3.00# iostat -En
c0d0 Soft Errors: 0 Hard Errors: 0 Transport Errors: 0
Model: VMware Virtual Revision: Serial No: 000000000000000 Size: 16.11GB <16106065920 bytes>
Media Error: 0 Device Not Ready: 0 No Device: 0 Recoverable: 0
Illegal Request: 0
c1t0d0 Soft Errors: 3 Hard Errors: 0 Transport Errors: 0
Vendor: NECVMWar Product: VMware IDE CDR10 Revision: 1.00 Serial No:
Size: 2.56GB <2563440640 bytes>
Media Error: 0 Device Not Ready: 0 No Device: 0 Recoverable: 0
Illegal Request: 3 Predictive Failure Analysis: 0{/c}{c}-bash-3.00# mount -F hsfs -o ro /dev/dsk/c1t0d0s0 /cdrom{/c}
Install the packages
{c}-bash-3.00# cd /
-bash-3.00# pkgadd -d /cdrom/Solaris_10/Product/ SUNWsshcu SUNWsshdr SUNWsshdu SUNWsshr SUNWsshu{/c}
Enable SSH
{c}-bash-3.00#svcadm enable ssh
-bash-3.00# svcadm restart ssh{/c}
Additonal Notes

You

ESX4 - How do I turn on/off a Virtual Machine from the command line ?

Mon, 12 Jul 2010 16:42:29 GMT

Using the vmware-cmd command you can perform a number of actions on your Virtual Machines from the command line.

Below shows you some of the functions you can perform :

List Virtual Machines

{c}[root@ESX4 vmware-cmd -l
/vmfs/volumes/4c16a0ec-2c7ebe2a-6ad5-0011s8azz71c/OpenSolaris 2009.06/OpenSolaris 2009.06.vmx
/vmfs/volumes/4c16a0ec-2c7ebe2a-6ad5-0011s8azz71c/CentOS 5 Oracle/CentOS 5 Oracle.vmx
/vmfs/volumes/4c16a0ec-2c7ebe2a-6ad5-0011s8azz71c/CentOS 5a/CentOS 5a.vmx{/c}

Turn On Virtual Machine

Below shows you how to start a virtual machine, to stop it just change the start command for stop.
{c}[root@ESX4 vmware-cmd "/vmfs/volumes/4c16a0ec-2c7ebe2a-6ad5-0011s8azz71c/OpenSolaris 2009.06/OpenSolaris 2009.06.vmx" start
start() 1{/c}

List Virtual Machine Status`s

There maybe another (and easier) way of listing the virtual machine status`s if so please send it in. {c}vmware-cmd -l sed '/^$/d' | while read VMX do STATE=$(vmware-cmd "${VMX}" getstate awk print $3 ; echo "${VMX}" "${STATE}" done
{/c}

How to create a CS-MARS Inspection Rule

Tue, 06 Jul 2010 20:20:33 GMT

Within CS-MARS there are 2 types of rules. Inspection Rules and Drop Rules. Inspection Rules allow you to trigger events based on certain triggers such as keywords, source, destination etc. Drop rule is an exception rule which MARS uses to ignore a behaviour that would otherwise trigger an event.

In this example we will configure a Inspection rule. First of all we need to define when this rule will trigger an event. For this example we will create an event every time someone saves an configuration change upon your Netscreen device. The syslog message for this is :

{c}Jul 6 14:17:42 x.x.x.x ns200: NetScreen device_id=006403324004624 [Root]system-information-00767: System configuration saved by [user] via web from host x.x.x.x to x.x.x.x:443 by [user]. (2010-07-06 19:17:41){/c}

Steps

1. Click Rules Inspection Rules Add

2. This will take you through a wizard. For each stage select Any. Until you get to the Keyword section.
3. Enter the text you want CS-MARS to trigger on.

Read more...

Adaptec Storage Manager Script for ESX4

Sun, 27 Jun 2010 12:35:45 GMT

This article shows you how to script and alert (via email) for when any of your RAID disks show as offline or your Logical Drive is not showing as optimal.

In order to obtain all the stats about your Adaptec RAID card from your ESX box you can install the asm (adaptec storage manager) rpm which you can get from the adaptec website.

Once this is installed you can then run a number of commands via the shell to query you RAID card.

Due to using a script and not using its java gui i removed the gui from the startup scripts via "chkconfig --del stor_agent"
Ensure you have ssmtp installed so that you can send emails via your command line.
You will now need to add this script to your cron job. CLICK HERE FOR SCRIPT. You will need to change the email variables.

Heres a sample of the html based email thats is generated ...

What are horizontal or vertical scans ?

Thu, 24 Jun 2010 11:49:25 GMT

Horizontal Scan

A horizontal scan is descibed as scan againest a group of IPs for a single port.

Vertical Scan

A vertical scan is descibed as a single IP being scanned for multiple ports.

Box Scanning

A combination of both vertical and horizontal scans.

How do I set the hostname on CentOS ?

Mon, 21 Jun 2010 11:12:39 GMT

In order to set the hostname on CentOS you will need to change the HOSTNAME section within /etc/sysconfig/network
Your hostname will now be updated once you logout and then back in. Its also worth noting that this will survive reboots.

What is an XML Firewall ?

Thu, 17 Jun 2010 15:52:52 GMT