Showing posts with label Linux. Show all posts
Showing posts with label Linux. Show all posts

Thursday, October 29, 2015

Multidomain SSL certificate CSR generation and openssl custom config to simplify this process

Bunch of CAs (Certificate authorities ) allow you to sign mutidomain SSL certificates.
Why it's very useful?

  • cheaper then wildcard (*.domain.com) when you need SSL cert  just for 2-5 domains like www.domain.com; domain.com and login.domain.com
  • cheaper and convenient when you need to have SSL certificate for wildcard domain and doman apex aka  "naked" or "root" domain (*.domain.com and domain.com)


How to make CSR fot these domains? Sure thing using OpenSSL, but you need to do a trick here: OpenSSL does not support multidomain configuration in interactive mode (when you are answering to the OpenSSL question while generating certificate).
   
What options do we have:

  • Use non-interactive mode with  long command line and specify all parameters there (really long line)
  • Create custom config and specify all there. More over this config will help you during certificate renewal next time.
Let's build our custom config :


Wildcard multidomain:

Create file wild.yourdomain.cnf:
[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
countryName = CA
stateOrProvinceName = Quebec
localityName = Montreal
organizationName = it-security.ca
organizationalUnitName  = infosec
commonName = *.yourdomain.com

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = yourdomain.com
DNS.2 = *.yourdomain.com
Generate csr:
openssl req -new -sha256 -key wild.yourdomain.com.key -out wild.yourdomain.com.csr -config wild.yourdomain.cnf

Multidomain:

Create file yourdomain.cnf:
[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
countryName = CA
stateOrProvinceName = Quebec
localityName = Montreal
organizationName = it-security.ca
organizationalUnitName  = infosec
commonName = *.yourdomain.com

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = yourdomain.com
DNS.2 = www.yourdomain.com
Generate csr:
openssl req -new -sha256 -key yourdomain.com.key -out yourdomain.com.csr -config yourdomain.cnf
And sure thing you can use it for normal domains:

Normal domain:

Create file yourdomain.cnf:
[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
prompt = no

[req_distinguished_name]
countryName = CA
stateOrProvinceName = Quebec
localityName = Montreal
organizationName = it-security.ca
organizationalUnitName  = infosec
commonName = login.yourdomain.com
Generate csr:
openssl req -new -sha256 -key yourdomain.com.key -out yourdomain.com.csr -config yourdomain.cnf

More details about working with CSR, OpenSSL certificates and etc you can find here: http://security-ingvar-ua.blogspot.ca/2012/10/ssl-certificates-commands-and-tips.html

















Posted by



at





No comments:
  

















Labels:
,
,

















          

        

          

        

Friday, October 23, 2015


          

        









Password management in CLI. Using the standard unix password manager: pass with AWS CodeCommit  and multi-environment setup














Install and configure pass utility: http://www.passwordstore.org/


yum install pass








Multi-environment setup: Work and Personal passwords in 2 different locations, gpg keys and version controls.


less ~/.bashrc 



# Switch to personal pass credentials
personal() {
    if [ -e ~/.gnupg ]; then rm ~/.gnupg ;fi 
    export PASSWORD_STORE_DIR=/run/media/my_user/DATA/Personal/credentials/.pass 
    ln -s /run/media/my_user/DATA/Personal/credentials/.gnupg ~/
}

work() {
    if [ -e ~/.gnupg ]; then rm ~/.gnupg ;fi
    export PASSWORD_STORE_DIR=/home/my_user/Big_corp/credentials/.pass
    ln -s /home/my_user/Big_corp/credentials/.gnupg ~/
}





Enable config above:



$. ~/.bashrc




Switch to personal environment:


$personal




Generate gpg keys:


gpg --gen-key




Check


gpg --list-keys




Note Key-ID anb initiate pass:


pass init 75d6793




For versions enable git feature


pass git init




Start using:


pass insert Test/test
pass ls
pass show Test/test
pass rm Test/test




Version Control



Configure remote if you need ( central git repo, github or AWS CodeCommit )



 AWS Code commit example:



Configure CodeCommit: Create repo + allow access to it for you user and add you public ssh key to the user in IAM.



Then on you machine:


    

  1. go to $PASSWORD_STORE_DIR
    2. 

  2. git remote add origin ssh://APrrfrA@git-codecommit.us-east-1.amazonaws.com/v1/repos/credentials
    3. 

  3. git remote -v
    4. 

  4. git push origin master
    5. 




And now you push your changes


pass git push














PS. pass use gpg2 if it available instead of gpg. Recently gpg2 has been updated to version 2.1 that might cause some issues with availability of you gpg keys. So, if you see your kees using gpg --list-keys but can't see them using gpg2 --list-keys, most probably automatic migration to version 2.1 fail and you need to do it manually.  



Force migration from GnuPG 1 to 2.1 



remove files:


rm pubring.kbx 
rm -rf private-keys-v1.d




force migration:


gpg2 --import ~/.gnupg/secring.gpg












Posted by



at





No comments:
  

















Labels:
,
,
,

















          

        

          

        

Monday, May 26, 2014


          

        









Amazon AWS EC2 volume encryption (LUKS) and performance for database.












One of the most obvious  recommendation for the public clouds - use encryption!

Let's talk how to do this practically for Amazon EC2 instance.



1. As encryption we will choose LUKS as kernel level block device encryption.

2. Our Amazon EC2 disk volume will be EBS (we need persistent storage )



But it leads to a many questions: what encryption algorithm and set ,  key length? Do we need EBS optimized instance and provisioned IOPS? What options will give us better performance?



Almost forget: this encrypted volume will be used by database. So, performance is key requirement for me.

By performance I mean 6 parameters: block write IO and latency, read IO and latency and CPU load during both tests.



Lets start the tests:



Encryption sets test:

To make results more predictable we need to have EBS storage  to be persistent (Have guaranteed IO)

According to CPU  flags amazon instance has aes support and I'll test only aes encryption sets.

For the IO benchmark I'm using bonnie++



Encryption on device without LVM. IOPS3000

-c aes-ecb-plain -s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399324041,14674M,,,,48625,6,24487,4,,,63744,4,2639,62,16,,,,,271,1,+++++,+++,293,0,272,1,+++++,+++,293,0,,21978ms,14659ms,,19440us,60963us,142ms,364us,47785us,16979us,37us,50287us

-c aes-ecb-null -s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399322496,14674M,,,,48815,6,24488,4,,,63679,5,2631,63,16,,,,,271,1,+++++,+++,304,0,269,1,+++++,+++,289,0,,21779ms,14606ms,,26422us,43205us,143ms,367us,52647us,34894us,10us,48557us

-c aes-ecb-benbi -s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399319920,14674M,,,,48814,6,24483,4,,,63659,5,2704,64,16,,,,,271,1,+++++,+++,291,0,272,1,+++++,+++,294,0,,21306ms,14538ms,,27702us,57492us,144ms,370us,48660us,39901us,10us,48902us

-c aes-cbc-null -s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399317092,14674M,,,,48812,6,24476,4,,,63682,5,2630,62,16,,,,,268,1,+++++,+++,291,0,272,1,+++++,+++,291,0,,21630ms,14586ms,,36893us,45752us,142ms,372us,53419us,21090us,10us,53516us

-c aes-cbc-benbi -s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399331123,14674M,,,,48815,6,24475,4,,,63680,5,2696,64,16,,,,,270,1,+++++,+++,291,0,271,1,+++++,+++,291,0,,21290ms,14656ms,,28083us,38028us,142ms,371us,52241us,29474us,10us,51325us

-c aes-cbc-plain -s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399331889,14674M,,,,48814,6,24477,4,,,63659,5,2592,61,16,,,,,269,1,+++++,+++,293,0,273,1,+++++,+++,294,0,,22076ms,14607ms,,28562us,14134us,145ms,366us,47393us,29521us,10us,48817us

-c aes -s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399330501,14674M,,,,48815,7,24480,4,,,63677,5,2714,63,16,,,,,269,1,+++++,+++,302,0,272,1,+++++,+++,292,0,,21060ms,14595ms,,23679us,13062us,142ms,396us,54966us,29954us,10us,50945us

-s 128

1.96,1.96,ip-10-14.eu-west-1.compute.internal,1,1399327477,14674M,,,,48817,6,24470,4,,,63685,5,2630,62,16,,,,,269,1,+++++,+++,289,0,269,1,+++++,+++,290,0,,17066ms,14615ms,,29639us,64800us,142ms,378us,51051us,27984us,44us,50100us



You can use bon_csv2html program to convert CSV format Bonnie++ to nice looking HTML table like following:



EBS_optimized instance and 3000IOPS encryption test_NO LVM

-c aes-ecb-plain -s 128




Version 1.96Sequential OutputSequential InputRandom
Seeks		Sequential CreateRandom Create


SizePer CharBlockRewritePer CharBlockNum FilesCreateReadDeleteCreateReadDelete


K/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU


ip-10-14.eu-west-1.compute.internal14674M488316244853637574263261162640++++++++28402631++++++++2850


Latency22188ms14602ms24751us14736usLatency143ms390us47199us24302us10us50133us





-c aes-ecb-null -s 128




Version 1.96Sequential OutputSequential InputRandom
Seeks		Sequential CreateRandom Create


SizePer CharBlockRewritePer CharBlockNum FilesCreateReadDeleteCreateReadDelete


K/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU


ip-10-14.eu-west-1.compute.internal14674M488346244694637415264962162630++++++++28502630++++++++2860


Latency22012ms14608ms36346us13559usLatency143ms379us48095us32471us10us51386us





-c aes-ecb-benbi -s 128




Version 1.96Sequential OutputSequential InputRandom
Seeks		Sequential CreateRandom Create


SizePer CharBlockRewritePer CharBlockNum FilesCreateReadDeleteCreateReadDelete


K/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU


ip-10-14.eu-west-1.compute.internal14674M488356244474636834265561162670++++++++28802621++++++++2860


Latency21447ms14568ms21341us13945usLatency141ms377us49271us19517us9us50122us









 In nutshell, tests above showed that there is almost no major difference between aes based encryption sets.We have write IO 48800 and latency about 21000 ms; for read we have IO around 64000 and latency around 21341us. 







To compare results I did a test with default encryption set and key length 128 against worst case scenario - normal EBS with non-EBS optimized instance and encryption on top of LVM. 










Version 1.96Sequential OutputSequential InputRandom
Seeks		Sequential CreateRandom Create


SizePer CharBlockRewritePer CharBlockNum FilesCreateReadDeleteCreateReadDelete


K/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPUK/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU/sec% CPU


ip-10-14.eu-west-1.compute.internal14674M325154223373760775450.64161660++++++++17801650++++++++1780


Latency28895ms24535ms229ms153msLatency170ms369us89118us54455us10us104ms







In this case write IO dropped a bit to 32515 and latency increased to 24535ms. But, surprise, read IO increased up to 76000 (unfortunately latency too: 229 ms)



Additional tests just to show the difference between encrypted and non encrypted EBS volume parameters.











Provisioned IOPS (1000) + aes-cbc 128

write

K/sec 40808

Latency 13010 ms

CPU % 8

read

K/sec 56827

Latency 59051us

CPU % 6













Provisioned IOPS (1000) Non encrypted





write

K/sec 41492

Latency 228 ms

CPU % 8

read

K/sec 56884

Latency 102ms

CPU % 7









Different tests done on non-provisioned IOPS, non EBS-optimized, encryption on top of LVM. (Another EC2 instance)









default -256

write

K/sec 26331

Latency 196563ms

CPU % 5

read

K/sec 89304

Latency 1005

CPU % 10



Default -128

write

K/sec 27494

Latency 13847ms

CPU % 5

read

K/sec 102898

Latency 306

CPU % 12



Nonencrypted

write

K/sec 23255

Latency 626 ms

CPU % 4

read

K/sec 95027

Latency 1764

CPU % 12




Bottom line:

1. Encryption heavily increase latency (hundred times).

2. Provisioning IOPS (actually only  reserve IO for your system) and switching to EBS optimized instance (kind of having dedicated network interface to SAN)   won't solve  latency problem. They will help you  only if storage resource become overload by other amazon user or if it already overloaded by others.

3. Encryption set (if as encryption algorithm you use aes) doesn't make a big difference.

4. You can decrease latency by changing a key length - but you will decrease security as well.

5. Using LUKS without LVM could decrease latency (~10 %) as well.



PS. Small bash script below will help you to test encryption sets. You can run this script for different types of  block devices (EBS, ephemeral, EBS+IOPS, LVM or non LVM ) and confirm or refute my conclusions.

Moreover this script will show how you can configure and mount LUKS device :-)



#!/bin/bash

#

#test function

function enc_test() {

while read encryption;

do

cryptsetup luksFormat --key-file '/root/keyfile' $encryption -q $TDISK || continue;

cryptsetup luksOpen --key-file '/root/keyfile' $TDISK d02_enc;

mkfs.ext4 /dev/mapper/d02_enc;

mount /dev/mapper/d02_enc /d02;

mkdir /d02/iotest;

echo $encryption >> enc_test_out.txt;

bonnie++ -d /d02/iotest  -r 3078 -u root -f -b -q >> enc_test_out.txt;

umount /d02

cryptsetup luksClose d02_enc

done <-c aes-ecb-plain -s 128

-c aes-ecb-null -s 128

-c aes-ecb-benbi -s 128

-c aes-cbc-null -s 128

-c aes-cbc-benbi -s 128

-c aes-cbc-plain -s 128

-c aes -s 128

-s 128

EOM

}

TDISK='/dev/test/d02'

echo "Encryption on top of LVM" >> enc_test_out.txt

enc_test

exit 0
















Posted by



at





No comments:
  

















Labels:
,
,
,

















          

        

          

        

Wednesday, April 2, 2014


          

        









Using CFEngine for Linux systems hardening












What is CFEngine? The best answer to this question is CFEngine website: https://cfengine.com/what-is-cfengine



In nutshell CFEngine is "is a popular open source configuration management system, written by Mark Burgess. Its primary function is to provide automated configuration and maintenance of large-scale computer systems, including the unified management ofservers, desktops, embedded networked devices, mobile smartphones, and tablet computers." Wiki



I'm using CFengine for various sysadmin and infosec tasks and it proved to be  reliable and stable configuration management system.



I would like to share with you cfengine promises (  system configuration description written on cfengine language  ) for the RH based Linux systems. These "promises" enforce system to become and stay hardened, provide centralized user management and take care of initial system configuration.



https://github.com/IhorKravchuk/cfengine





file system_setup.cf - covers system configuration and hardening.

file users.cf - user and group management

file site.cf - allows you to describe different environments or data-centers (Global variables for the system configuration ) 

file promises.cf - main file that links all components together.

file update.cf and failsafe.cf - responsible for promises update in normal operations and in case of failure.



I'll add more comments and descriptions in subsequent code release or upon your request.

IMHO the code is self-explaining and really easy to read  as soon as you become familiar with a basic CFEngine principles.










Posted by



at





1 comment:
  

















Labels:
,
,
,
,

















          

        

          

        

Saturday, March 22, 2014


          

        









Making Juniper SSL VPN network connect applet work on 64-bit Linux (Fedora)












Old Juniper SSL VPN appliances network connect Java applets not working on 64 bit systems without some additional steps. Here these steps.





1. Install older then Java "7 update 51" 32 bit version of java. 
         You can use 7.51 but you need to add your ssl vpn endpoint to the exception list:
         http://kb.juniper.net/InfoCenter/index?page=content&id=KB28704 
 You can download 32 bit JRE 7.45 from Oracle web site java archive
 I recommend you to download tar.gz archive instead of rpm. It will allow you to have multiply java  installed and switch between them using alternatives




2.  Install java and configure alternatives to use downloaded java: 



Install:



$ tar -xvzf ./jre-7u40-linux-i586.tar.gz



# mv /home/myuser/Downloads/jre1.7.0_45/ /usr/java/







configure alternatives for java 32 bit







# alternatives --install /usr/bin/java java /usr/java/jre1.7.0_40/bin/java 32



configure alternatives for java browser plugin (yes, i suggest to use alternatives to manage java plugins)



# alternatives --install /opt/google/chrome/plugins/libnpjp2.so java_chrome /usr/java/jre1.7.0_40/lib/i386/libnpjp2.so 32







switch alternatives to use installed 32bit Java:



# alternatives --config java_chrome



# alternatives --config java







3. Test if java plugins works and has correct version  in chrome or firefox



go to http://www.java.com/en/download/installed.jsp and verify Java version







4. Install xterm and some 32 bit version of libraries: 



    yum install xterm glibc.i686 zlib.i686 



    These components required to install and run network connect application







5. Go to your ssl vpn endpoint using browser, login and launch network connect.



You should now see new xterm window and sudo password request for first time network connect installation.







If not --> check network connect install log for details:



$ less ~/.juniper_networks/network_connect/installnc.log







Normally after this you should see network connect starting and working. 







If not ---> check:



 - presence of network connect aplication , file permissions and ownership:



      $ ls -la ~/.juniper_networks/network_connect/



         -rws--s--x. 1 root   root   1281164 Mar 21 22:17 ncsvc



 - if network connect application could run:  



$ ~/.juniper_networks/network_connect/ncsvc --version



Juniper Network Connect Server for Linux.



Version         : 7.1



Release Version : 7.1-16-Build26805



Build Date/time : Aug 21 2013 01:11:08 



Copyright 2001-2010 Juniper Networks



if you see any error check for the missing 32bit libraries.



  












Posted by



at





No comments:
  

















Labels:
,
,
,

















          

        

          

        

Monday, March 17, 2014


          

        










Junk Cloud POC project.












Junk Cloud is fast deploying CloudStack environment running on KVM hypervisor and using outdated equipment.



As first attempt to build Junk Cloud I have tested CloudStack baremetal support. What I expect from baremetal support?




    

  • reduce time to configure and deploy each host
    • 

  • you can add computing resources (physical hosts) to the cloud in a minutes instead of hours. 
    • 

  • fast deployment of the new private cloud
    • 

  • allow easy utilization of outdated hardware
    • 






Unfortunately CloudStack built-in baremetal support is limited: http://cloudstack.apache.org/docs/en-US/Apache_CloudStack/4.2.0/html/Installation_Guide/choosing-a-hypervisor.html






    

  • not support advanced networking
    • 

  • not support central storage (SAN)
    • 

  • not support vmotion and HA
    • 






So, it was decided to build own version of the barematal support for theCloudStack:








    

  • network boot (pxe boot)
    • 

  • network auto install of lnux + kvm + network + CloudStack
    • 

  • storage configuration 
    • 

  • upon completion auto selfprovisionng to the CloudStack as a new host (resource)
    • 




The Anaconda install script for building and configuring Centos based KVM host for CloudStack (Advanced networking support) on GitHub:  https://github.com/IhorKravchuk/cloudstack_ingvar/blob/master/Centos_6x64_kvm_cloudstack.cfg









This script is missing auto selfprovisionng to the CloudStack feature for test purpose. It will be updated after final tests.







Tested and suggested deployment architecture (for the small deployments):



















From my point of view implementation of proposed architecture will be:










    

  • core components: cloud controller + network storage installed and configured. 
    • 

  • to add new host just connect it to network and power.
    • 

  • all rest done automatically.
    • 








Private Cloud? it's that simple:



Build a Cloud Controller:





Add NFS NAS:





And finally add all your old hardware:
































Posted by



at





No comments:
  

















Labels:
,
,
,
,
,

















          

        

          

        

Thursday, May 2, 2013


          

        



















Adding security into Enterprise Linux system-wide authentication mechanism:



Some small modification to default authentication mechanism at RedHat 5/6 based system will increase system security.



First witch from md5 to sha512 hashes: it as easy as executing:



"authconfig--passalgo=sha512 --updateall"



Update your /etc/pam.d/system-auth to the more adequate to the current threats settings:



#vi /etc/pam.d/system-auth



#%PAM-1.0
# User changes will be destroyed the next time authconfig is run.

auth        required      pam_env.so
auth        required      pam_unix.so nullok try_first_pass
auth        sufficient    pam_tally2.so deny=10 onerr=fail unlock_time=1200
# lock account after 10 failed attempt. unlock automatically after 20 minutes.
auth        required      pam_deny.so

account     required      pam_tally2.so
account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    required      pam_passwdqc.so min=disabled,disabled,12,8,8 max=32 passphrase=2 match=4 similar=deny random=32 enforce=everyone retry=5
# instead of default pam_cracklib.so switch to more advanced pam_passwdqc.so 
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so








Brief explanation of  pam_passwdqc.so proposed here settings:

min=disabled,disabled,12,8,8  - disallows any length passwords from any single character class, disallows any length passwords from any two character classes, a minimum length of 12 characters for a passphrase  a minimum length of 8 characters for a password from any three character classes, and a minimum length of 8 characters from four character classes.the module will ask for a new password if the user fails to provide a sufficiently strong password

max=32 - maximum allowed password length is 32 characters.

passphrase=2 - passphrase must consist of 2 words.

match=4 -  check if 4 character substring in password will match dictionary worlds. In this case password complexity requirements will be checked against password with this substring removed.

similar=deny - deny new password to  be similar to the old one

random=32 - randomly-generated passphrases will be 32 bit (IMHO byte) long

enforce=everyone - enforce complex passwords

retry=5 - the module will ask 5 times for a new password if the user fails to provide a sufficiently strong password.




















Posted by



at





No comments:
  

















Labels:
,
,

















          

        

          

        

Monday, October 1, 2012


          

        









SSL certificates commands and tips
















Verify a SSL certificate


    

  1. By SSL verification web site: https://www.ssllabs.com/ssltest/index.html
    2. 

  2. By openssl:
    3. 



$ openssl s_client -showcerts -connect test.domain.net:443






How to create pfx file that includes private key, certificate and certification chain?


$openssl pkcs12 -export -out test.domain.net_2012.pfx -inkey test.domain.net_2012.key -in test.domain.net_2012.crt -certfile thawtesecca.crt -certfile thawteprimca.crt






]How to see information inside CSR?



Normaly CSR looks like:


$cat test.domain.net_2012.csr
-----BEGIN NEW CERTIFICATE REQUEST-----
MIIC6TCCAdECAQAwgaMxCzAJBgNVBAYTAkNBMQ8wDQYDVQQIEwZRdWViZWMxETAP
BgNVBAcTCE1vbnRyZWFsMSIwIAYDVQQKExlSYWRpYWxwb2ludCBTYWZlQ2FyZSBJ
bmMuMQwwCgYDVQQLEwNOT0MxGjAYBgNVBAMUESoucmFkaWFscG9pbnQubmV0MSIw
IAYJKoZIhvcNAQkBFhNub2NAcmFkaWFscG9pbnQuY29tMIIBIjANBgkqhkiG9w0B
OZrroiuiouorpro[pooooo[orrjjjggoipoioZY2toSHheDDEtHga35cPDJUfl1W


ITBFs9G+fji+i0GrS1WmRYUGCeI1+5+48k6rIGim2WwcxYfBofVgZUSaFTydf1nH
icCM8aMi39jWtNCLxlWfBKNNLkNj0zPEPgXmYJIQRE0dUXfCBi68o+7s2pRyCJ7V
H9D8wV9OaBugaOMuPGM8vFtVTGRuC/waFuH/0Avr8SKs4U3Io6ZiViikopgfipii
dCeW6KZzJnAlBmrEuzv0POty5NDvnr2iZYUct15dNN8CheG36pXXrjFgqF6siBXs
lVBU023hBFsCu6foF3pflEmq9zVoVdUBruoepVbaIGziYyXes85C4Iokha9Ym8hE
YG0C/Nd4vp1ICB1gXBf88JoT7c2bgJWFSWpLVHU=
-----END NEW CERTIFICATE REQUEST-----




But if you do the trick:


$ openssl req -in test.domain.net_2012.csr -noout -text

Certificate Request:
   Data:
       Version: 0 (0x0)
       Subject: C=CA, ST=Quebec, L=Montreal, O=USer Inc., OU=SOC, CN=test.domain.net/emailAddress=soc@test.domain.com
       Subject Public Key Info:
           Public Key Algorithm: rsaEncryption
               Public-Key: (2048 bit)
               Modulus:
                   00:a5:83:4e:65:96:36:b6:84:87:85:e0:c3:12:d1:
                   47:21:30:45:b3:d1:be:7e:38:be:8b:41:ab:4b:55:
                   a6:45:85:06:09:e2:35:fb:9f:b8:f2:4e:ab:20:68:
                   a6:d9:6c:1c:c5:87:c1:a1:f5:60:65:44:9a:15:3c:
                   
                   8b:53:3f:6b:64:7e:2e:50:ec:35:1c:71:0f:42:4e:
                   bd:dd
               Exponent: 65537 (0x10001)
       Attributes:
           a0:00
   Signature Algorithm: sha1WithRSAEncryption
       7a:90:48:34:cb:70:47:af:54:a2:c2:f4:5e:5a:4c:57:a3:44:
       9b:6d:04:ec:b8:11:59:fb:32:c9:86:f4:a4:2f:5c:ad:df:cb:

       9d:48:08:1d:60:5c:17:fc:f0:9a:13:ed:cd:9b:80:95:85:49:
       6a:4b:54:75




You can get whole information about CSR you going to send for signature





Check CSR if certificate corresponds to private key


$ diff <(openssl rsa -in test.domain.net_2012.key -modulus -noout) <(openssl req -in test.domain.net_2012.csr -noout -modulus) 




if you get nothing, everything is OK.





Check what inside certificate you got from CA (certificate authority)


$ openssl x509 -in test.domain.net_2012.crt -noout -text

Certificate:
   Data:
       Version: 3 (0x2)
       Serial Number:
           73:68:b7:62:11:51
       Signature Algorithm: sha1WithRSAEncryption
       Issuer: C=US, O=Thawte, Inc., CN=Thawte SSL CA
       Validity
           Not Before: Aug 20 00:00:00 2012 GMT
           Not After : Oct 19 23:59:59 2014 GMT
       Subject: C=CA, ST=Quebec, L=Montreal, O=User Inc., CN=test.domain.net
       Subject Public Key Info:
           Public Key Algorithm: rsaEncryption
               Public-Key: (2048 bit)
               Modulus:
                   00:a5:83:4e:65:96:36:b6:84:87:85:e0:c3:12:d1:
                   47:21:30:45:b3:d1:be:7e:38:be:8b:41:ab:4b:55:
                   a6:45:85:06:09:e2:35:fb:9f:b8:f2:4e:ab:20:68:
                   a6:d9:6c:1c:c5:87:c1:a1:f5:60:65:44:9a:15:3c:

                   8b:53:3f:6b:64:7e:2e:50:ec:35:1c:71:0f:42:4e:
                   bd:dd
               Exponent: 65537 (0x10001)
       X509v3 extensions:
           X509v3 Subject Alternative Name: 
               DNS test.domain.net
           X509v3 Basic Constraints: 
               CA:FALSE
           X509v3 Certificate Policies: 
               Policy: 2.16.840.1.113733.1.7.54
                 CPS: https://www.thawte.com/cps/



           X509v3 Key Usage: critical
               Digital Signature, Key Encipherment
           X509v3 Authority Key Identifier: 
               keyid:A7:A2:83:BB:34:45:40:3D:A1:01:9F:F6:DB



           X509v3 CRL Distribution Points: 



               Full Name:
                 URI:http://svr-ov-crl.thawte.com/ThawteOV.crl



           X509v3 Extended Key Usage: 
               TLS Web Server Authentication, TLS Web Client Authentication
           Authority Information Access: 
               OCSP - URI:http://ocsp.thawte.com
               CA Issuers - URI:http://svr-ov-aia.thawte.com/ThawteOV.cer



   Signature Algorithm: sha1WithRSAEncryption
       34:3f:66:4f:7b:3e:44:f6:88:d8:de:62:3f:93:34:55:fd:7e:

       20:94:60:f8:6e:99:88:73:8f:86:6b:55:38:31:a1:0a:e2:c0:
       f9:22:0f:e7






Verify if certificate you got corresponds to correct private key


diff <(openssl rsa -in test.domain.net_2012.key -modulus -noout) <(openssl x509 -in test.domain.net_2012.crt -noout -modulus) 




if you get nothing, everything is OK.












Posted by



at





No comments:
  

















Labels:
,
,

















          

        

          

        

Friday, March 23, 2012


          

        










Checking amount of packets dropped by iptables using zabbix












I really love zabbix  and I using it for monitoring almost everything. Below I describe how to use it for checking amount of packets dropped by iptables .



Why it's nice to monitor amount of dropped packets? It will show you amount of traffic blocked by host firewall and anomalies in the traffic inform you about attack (DDOS) or firewall misconfiguration.

 Sure thing, you can log all dropped packets and analyze packet's log by your SIEM solution.

 I propose simple way to get quick results and increase system protection without significant investment of money or your time.



1. Get dropped packets counters from iptables:

       - if you use default policy DROP for INPUT:

        iptables -L -n -v -x | grep "Chain INPUT" | awk {'print $7'}

      

      - if you use DROP rule:

        iptables -L -n -v -x | grep DROP | awk {'print $2'}



2.  To run iptables command you need to have root privileges, so zabbix agent (which running normally under "zabbix" user account) can't do it without following tricks:

  

Instead of setting SUID flag for whole iptables (very bad idea ),  I propose to create simple C program that will have SUID flag and able to get only amount of dropped packets:





# vi /usr/bin/iptables_drop.c





#include 

#include 

#include 

#include 





int main()

{

setuid( 0 );

        system("/sbin/iptables -L -n -v -x | grep 'Chain INPUT' | awk {'print $7'}");

   return 0;

}







compile:





 #gcc iptables_drop.c -o iptables_drop







change permissions: 



#chmod 4111 /usr/bin/iptables_drop









3. Now let's add a zabbix custom parameter in /etc/zabbix/zabbix_agentd.conf:







UserParameter=iptables.block,/usr/bin/iptables_drop







4. Now add corresponding item to zabbix checks list:













































The trick here: change "Store value" parameter to "Delta (simpe change)"

it will store difference between counters, so show you new traffic between update interval.



Use this new item to build a Graph and stay informed!










Posted by



at





No comments:
  

















Labels:
,
,
,

















          

        

          

        

Monday, November 7, 2011


          

        









ssh - Knockin' on Heaven's Door












Using both: port knocking technology and trusted networks for secure ssh access:



The key feature of this method is using ssh daemon listening on 2 diff ports:

--sshd_config--



# What ports, IPs and protocols we listen for

Port 22

Port 3054



and iptables.



1. "Normal" ssh port (22) will be available only from trusted subnets

2.  "New"ssh port (3054) will be available on demand (well known port knocking technology )



How-to:



1. Create new chain:



iptables -N SSH



2.  add it as action to our 2 ssh ports and 1 knocking port



iptables -A INPUT -p tcp -m tcp --dport 22 --syn  -j SSH

iptables -A INPUT -p tcp -m tcp --dport 3054 --syn  -j SSH

iptables -A INPUT -p tcp -m tcp --dport 3055 --syn  -j SSH







3. add rules to our SSH chain



--- add rule for trusted subnet:



iptables -A SSH  -s 184.144.0.0/13 -p tcp -m tcp --dport 22 -j ACCEPT -m comment --comment "Trusted subnet"









---add rule for knock port using recent iptables module:  add packet source to "recent" :



iptables -A SSH -p tcp -m tcp --dport 3055 --syn -m recent --set     --name ssh --rsource -j REJECT --reject-with tcp-reset







--- allow to connect to "new" ssh port within 30 second interval from the IP used to knock



iptables -A SSH -p tcp -m tcp --dport 3054 --syn -m recent --rcheck --seconds 30 --name ssh --rsource -j ACCEPT









That's it. To knock knock simple use: telnet "IP" 3055 and after that you have 30 second to connect.







It will allow you to use ssh and ssh-based tools as usual from trusted location, always be able to connect to server from any location around the world and reduce amount of alerts getting form your HIDS.



PS. Not forget about turning on SSH public key based authentication  and switching PasswordAuthentication to "no".





inspired by  http://execbit.ru/2011/05/18/portknoking/














Posted by



at





No comments:
  

















Labels:
,
,

















          

        

          

        

Friday, September 10, 2010


          

        









Multiboot USB Flash drive












Summer's over, so I'm back (Again)



Let's start from a small trick. If you are security guy (i hope you are) you definitely need to have hell of a lot different liveOS . Sure thing you can have a lot of boot CD, DVD or flash drives with you. But what about one flash disk with multiply different liveOS on it? More over they start from .iso files on flash drive! Very useful!

So, here the steps to create this flash drive.

1. Partition your flash disk. Normally you flash drive is in superfloppy mode with no partition on it.

You can't partition your flash disk by standart Windows format tool. For this purpose use HP USB Format Tool on Windows or Disk Utility on MacOS.

2. Now you have two options:

- use Multiboot USB program on windows and install everything using GUI. In this case just choose which linux you wish to install from the list of preconfigured options.

- use GRUB4DOS (Multiboot USB based on it too) project and do the same manualy.



In my case I've got BackTrack4,Ubuntu NR, Ophcrack XP,Ultimate Boot CD and Offline NT Password Remover on the 4Gb flash disk.










Posted by



at





No comments:
  

















Labels:
,
,

















        

      









Subscribe to:
Posts (Atom)