Increase the size of the history buffer in openBSD

Add the following lines to ./.profile

HISTSIZE=50;export HISTSIZE
HISTFILE=.ksh_history;export HISTFILE

Purge Master Logs in MySQL

If the files '/var/log/mysql/server.bin.xxx' are large, you can manage them:

log into mysql as root. this is not the systems' root user, this is a different root user that is local to mysql.

# mysql -u root -p

mysql> purge master logs before 'xxxx-mm-dd 00:00:00';

To get today's date: `date +"%Y%m%d %H:%M:%S"`

 

Adding / Removing Routes in Linux

Add or Delete the Default Route

# route add default gw 10.10.1.1
# route del default gw 10.10.1.1

Add or Delete a Route for a Host

# route add -host x.x.x.x gw x.x.x.x
# route del -host x.x.x.x gw x.x.x.x

Add or Delete a Route for a Network

# route add -net 172.18.1.0/24 gw 10.10.1.43
# route del -net 172.18.1.0/24 gw 10.10.1.43

 

SSH pubkey on a NetScaler Application Switch

I like to take a backup of all my device configurations on a regular basis. Its usually pretty straight-forward, simply add a scp command to cron, but with the NetScaler there's a little gotcha.

The default location of the authorized_keys file is in '/flash/nsconfig/ssh'. After you append your public key into the file, you'll need to copy the 'authorized_keys' file to '/root/.ssh/'.

This filecopy will need to be done after every reboot of the NetScaler because the / mount point is on volatile media.

If you want to script this action, or any other post-boot commands on a NetScaler device, create or edit the file '/flash/nsconfig/rc.netscaler', set the perms on the file to 755, and start adding commands to the file.

 

How to Span a Port on a Cisco Switch

Analyzing network traffic on network segments is an interest and goal of all Network Administrators, Network Security Engineer, or System Administrators. A switch creates virtual connections between hosts connected to the switch. In order to analyze all traffic on a Vlan, you'll need to 'mirror', or in Cisco parlance, 'SPAN' a port. What this means is that the traffic of all private virtual connections made between all ports belonging to a given Vlan is mirrored or 'span'ned to a designated port on the switch. Typically, you'd connect an IDS or system with a sniffer/traffic analyzer to the 'span'ned port.

# monitor session 1 source vlan 1
# monitor session 1 destination interface gi0/44

Show spanned ports:

# show monitor

To terminate the span:

# no monitor session 1


If you're really serious about analyzing traffic, especially in large volumes, you'd want to buy a "network tap". Here is a little more detail.

Here's a tap reseller.

 

Double-Hop SSH

Sometimes I need to access a server that's behind two or more firewalls. I use SSH tunneling to accomplish this, and in this example I show port specifics for MySQL.

First, I establish a ssh session with a local tunnel to 'Server A' that's NAT'd through a firewall. 'Server A' sits in a DMZ.

Second, I establish another ssh session with a local tunnel from 'Server A' to 'Server B' that's NAT'd through another firewall. 'Server B' sits on the INSIDE network. The local port of the tunnel in the first session on 'Server A' corresponds to the referenced port on 'Server B' in the second session. A "plumbing" of sorts has been configured.

Session 1 - Client to 'Server A'
> ssh -L 44444:localhost:9999 user@serverA

Session 2 - 'Server A' to 'Server B'
> ssh -L 9999:ServerC:3306 user@serverB

As you can see, to get to 'Server C', the client application would connect to localhost:44444, sshd would bitpump traffic from TCP:44444 on the client to TCP:9999 on 'Server A'. Then through the second ssh tunnel between 'Server A' and 'Server B', sshd would bitpump traffic arriving at port TCP:9999 on 'Server A' and bitpump traffic to TCP:3306 on 'Server C' through 'Server B'.

Be responsible, make good choices. Have fun and don't kill anybody.

Create and Self-Sign Certs on the Netscaler Application Switch

#Create CA
create ssl rsakey ops-ca.key 1024
create ssl certreq ops-ca.csr -keyfile ops-ca.key
create ssl cert ops-ca.crt ops-ca.csr ROOT_CERT -keyfile ops-ca.key

shell
echo '01' > ops-ca-serial.srl
exit

#Create a Server cert for the NetScaler (for testing, if required)
create ssl rsakey ops-vip.key 1024
create ssl certreq ops-vip.csr -keyfile ops-vip.key
create ssl cert ops-vip.crt ops-vip.csr SRVR_CERT -CAcert ops-ca.crt -CAkey ops-ca.key -CAserial serial.srl

#create key and csr on the apache web servers
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out opswebserver_01.csr

#copy the csr back to the netscaler

#sign csr's from the web servers with the CA created on the netscaler
create ssl cert /nsconfig/ssl/opswebserver_01.crt /nsconfig/ssl/opswebserver_01.csr SRVR_CERT -CAcert /nsconfig/ssl/ops-ca.crt -CAkey /nsconfig/ssl/ops-ca.key -CAserial /nsconfig/ssl/ops-ca-serial.srl

#copy the crt back to the apache server and put it in the appropriate place and edit ssl.conf

#add the in-memory cert object that holds the SSL server certificate information for SSL handshakes
add ssl certkey ops-certkey -cert ops-vip.crt -key ops-vip.key

#bind the certkey to a vserver
bind ssl certkey Ops_VIP ops-vip.key [ -vserver | -service ]

#dont forget to copy all files in /nsconfig/ssl to the second netscaler


Final Key
#create new csr
create ssl certreq opsportal.someurl.com.csr -keyfile opsportal.someurl.com.key

#copy key file to second netscaler
#passphrase: xxxxx
#Submit csr to verisign
#Copy verisign cert into text file
#Copy cert file to both netscalers

#Create certkey on netscaler
add ssl certKey portal.cert -cert ops-portal.someurl.com.crt -key opsportal.someurl.com.key

#add Verisign intermediate cert
add ssl certkey vrisgn.intmed.cert -cert /nsconfig/ssl/verisign.intermediate.cert.crt

#link intermediate cert to portal-certkey
link ssl certkey portal.cert vrisgn.intmed.cert

#bind certkey to vserver
bind ssl certkey ops_vip opsportal.someurl.com.key -vserver

Install and Configure Snort on CentOS

The following has been laying around in some text file I got tired of keeping, so I figured I put it here.

groupadd snort
useradd -g snort snort –s /sbin/nologin
passwd snort

chkconfig apmd off
chkconfig cups off
chkconfig isdn off
chkconfig netfs off
chkconfig nfslock off
chkconfig pcmcia off
chkconfig portmap off

rpm --import http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-4

yum -y update

chkconfig yum on
service yum start
yum –y install mysql mysql-bench mysql-server mysql-devel mysqlclient10 php-mysql httpd gcc pcre-devel php-gd gd mod_ssl glib2-devel gcc-c++

# In the /etc/ssh/sshd_config file change the following lines (if it is commented out remove the #):
Protocol 2
PermitRootLogin no
PermitEmptyPasswords no

service sshd restart

chkconfig httpd on
chkconfig mysqld on
service httpd start
service mysqld start

cd /var/www/html
wget http://www.internetsecurityguru.com/index.php.txt
mv ./index.php.txt ./index.php

cd /root
mkdir /root/snortinstall/
cd /root/snortinstall/
wget http://www.snort.org/dl/current/snort-2.6.1.5.tar.gz
tar xvzf snort-2.6.1.5.tar.gz
cd snort-2.6.1.5
./configure --with-mysql --enable-dynamicplugin
make
make install


mkdir /etc/snort
mkdir /etc/snort/rules
mkdir /var/log/snort
cd /root/snortinstall/snort-2.6.1.5/etc/
# (make not this is not /etc. it is the etc dir under the snort source code)
cp * /etc/snort

#Download BASE
cd ~/snortinstall/
wget http://easynews.dl.sourceforge.net/sourceforge/secureideas/base-1.2.6.tar.gz
cd /var/www/html
tar xvzf /root/snortinstall/base-1.2.6.tar.gz
mv base-1.2.6/ base/


mkdir /root/snortinstall/rules
cd /root/snortinstall/rules
wget http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/snortrules-pr-2.4.tar.gz
tar xvzf /root/snortinstall/rules/snortrules-pr-2.4.tar.gz
cd /root/snortinstall/rules/rules
cp * /etc/snort/rules

#Copy the signatures into the BASE application directory
cd ~/snortinstall/rules/
mv ./doc/signatures/ /var/www/html/base/

#Modify your snort.conf file
var HOME_NET 10.0.0.0/24 (make this what ever your internal network is, use CIDR.
var EXTERNAL_NET !$HOME_NET (this means everything that is not your home net is external to your network)
#change “var RULE_PATH ../rules” to “var RULE_PATH /etc/snort/rules”
#After the line that says “preprocessor stream4_reassemble” add a line that looks like
preprocessor stream4_reassemble: both,ports 21 23 25 53 80 110 111 139 143 445 513 1433

output database: log, mysql, user=snort password=
dbname=snort host=localhost


#Change directory to /etc/init.d and type:
cd /etc/init.d
wget http://internetsecurityguru.com/snortinit/snort
chmod 755 snort
chkconfig snort on


===========
mysql
mysql> SET PASSWORD FOR root@localhost=PASSWORD('r3m0t3c0ntr0l');
>Query OK, 0 rows affected (0.25 sec)
mysql> create database snort;
>Query OK, 1 row affected (0.01 sec)
mysql> grant INSERT,SELECT on root.* to snort@localhost;
>Query OK, 0 rows affected (0.02 sec)
mysql> SET PASSWORD FOR snort@localhost=PASSWORD('sn0rt');
>Query OK, 0 rows affected (0.25 sec)
mysql> grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort@localhost;
>Query OK, 0 rows affected (0.02 sec)
mysql> grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort;
>Query OK, 0 rows affected (0.02 sec)
mysql> exit
>Bye
===========
mysql
SET PASSWORD FOR root@localhost=PASSWORD('r3m0t3c0ntr0l');
create database snort;
grant INSERT,SELECT on root.* to snort@localhost;
SET PASSWORD FOR snort@localhost=PASSWORD('sn0rt');
grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort@localhost;
grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort;
exit



mysql -u root -p < ~/snortinstall/snort-2.6.1.5/schemas/create_mysql snort

#Hand configure the firewall:
cd /etc/sysconfig/

#edit the iptables file
#and delete the lines
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT

#change the line
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
#to
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

#change the line
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
#to
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j DROP

service iptables restart



cd /root/snortinstall
pear install Image_Graph-alpha Image_Canvas-alpha Image_Color Numbers_Roman



#Download ADODB
cd ~/snortinstall/
wget http://easynews.dl.sourceforge.net/sourceforge/adodb/adodb480.tgz
cd /var/www/
tar xvzf /root/snortinstall/adodb480.tgz


cp /var/www/html/base/base_conf.php.dist /var/www/html/base/base_conf.php

#Edit the “base_conf.php” file and insert the following perimeters
$BASE_urlpath = "/base";
$DBlib_path = "/var/www/adodb/ ";
$DBtype = "mysql";
$alert_dbname = "snort";
$alert_host = "localhost";
$alert_port = "";
$alert_user = "snort";
$alert_password = "sn0rt";

service snort start

#goto here to finish setting up the database
https://ip_address/base

#Secure BASE
mkdir /var/www/passwords
/usr/bin/htpasswd -c /var/www/passwords/passwords base

#Edit the httpd.conf (/etc/httpd/conf/httpd.conf). I put it under the section that has:

Options FollowSymLinks
AllowOverride None



AuthType Basic
AuthName "SnortIDS"
AuthUserFile /var/www/passwords/passwords
Require user base


service httpd restart

Citrix Presentation Server Basic Requirements

The pre-req's are pretty straight-forward...here they are.

Add/Remove Programs
- Terminal Services
- IIS+ASP.Net
- SNMP
- .Net 2.0 Framework

Windows Update

When starting a new ICA session make sure that the user, or a group that the user is a member of, is in the servers local group named "Remote Desktop Users"

Configuring two Netscaler Application Switches as a High Availability pair

On Primary NS (172.18.1.20):
add node 2 172.18.1.22
set interface 1/1 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/2 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/3 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/4 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/5 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/6 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/8 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED

On Secondary NS (172.18.1.22):
set node -hastatus STAYSECONDARY
add node 1 172.18.1.20
set interface 1/1 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/2 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/3 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/4 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/5 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/6 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set interface 1/8 -speed AUTO -duplex AUTO -autoneg ENABLED -hamonitor OFF -state DISABLED
set node -hastatus ENABLE

Policy-driven Content Filtering on the Netscaler Application Switch

I have a server with two separate web services on it. Both services are available through the same web application server, so port restriction isnt going to work in this case. I wanted to prevent remote users from accessing one of these load balanced services, so I used content filtering to drop any requests for this url.

> add expression e1 url == /dts
> add expression e2 url == /DTS
> add filter dts_filter -reqrule "e1||e2" -reqaction RESET

> add action dts_action Forward /dts /

> show action
> show filter
> bind lb vserver somename_vip -policyName dts_filter

How to set up a Netscaler Application Switch

The following steps are the most basic, essential steps to get a Netscaler Application Switch up and running.

#set root password
set system user nsroot newpasswd1

#add mapped ip, this is the interface for connections to servers (inside)
add ns ip x.x.x.x 255.255.255.0 -type mip

#set netscaler ip (nsip), this ip used for administration only
set ns config -ipaddress x.x.x.x -netmask 255.255.255.0

#set default gateway on nsip
add route 0.0.0.0 0.0.0.0 x.x.x.x

#save config
save ns config

reboot

#open the gui
http://nsip/

=====

Configuring NTP in Cisco IOS

ntp server 69.60.124.59
ntp server 98.172.32.171
ntp server 208.113.193.9
ntp server 216.184.20.83
ntp server 66.250.45.2
clock timezone PST -8

Configuring NTP in Windows

w32tm /config /manualpeerlist:"72.167.54.201, 74.53.76.34, 209.67.219.106, 209.132.176.4, 72.36.170.170, 67.18.208.203, 69.36.240.252, 216.14.98.234, 64.202.112.65, 65.49.42.8,0x8" /syncfromflags:MANUAL
net stop w32time
net start w32time
w32tm /resync

Configuring NTP in *nix or BSD

edit /etc/ntp.conf
---------------------------
server 0.pool.ntp.org # A stratum 1 server at ntp.org
server 1.pool.ntp.org # A stratum 1 server at ntp.org
server time.nist.gov # A stratum 2 server at nist

restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict time.nist.org mask 255.255.255.255 nomodify notrap noquery

restrict 10.10.1.0 mask 255.255.255.0 nomodify notrap

restrict 127.0.0.1
---------------------------


On linux systems that use chkconfig utility:
---------------------------
chkconfig ntpd on
service ntpd start
service ntpd stop
service ntpd restart
---------------------------


On other systems:
---------------------------
pkill -HUP -x ntpd
---------------------------


Verify that ntpd is running:
---------------------------
ps auxwww | grep ntpd
---------------------------


Syncronize

check the date: `date`
stop ntpd: `pkill -x ntpd`
run ntpdate: `ntpdate -u `
note: its possible that this command may need to be run several times.
use the offset to determine acceptable offset values.
start ntpd:
check sync: `ntpq -p`

Configuring SSH in Windows

Install Cygwin
Select additional component: openSSH
Launch cygwin prompt
Run ssh-host-config
Start sshd

An decent walkthough is here.

Configuring SSH in Cisco IOS

To Configure SSH

1. Configure AAA
2. Configure SSH
3. Configure VTY


Configure AAA
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa authorization network default local


Configure SSH
hostname
ip domain-name somedomain.com
crypto key generate rsa
ip ssh version 2
no ip ssh timeout


Configure VTY
line vty 0 4
login
transport input ssh
password 0


Check SSH Configuration

show ssh
show ip ssh
show ip ssh vty