So, you have discovered in your authentication logs that an ip range explicitly blocked, denied by default or even geo-blocked is somehow still attempting to gain VPN access? Since VPN traffic is going to the FTD and not through the FTD, it is handled by the control-plane rather than the data-plane. Fortunately, a solution is available, although imperfect, through the use of FlexConfig.
Continue reading Firepower Access Control Policy not blocking VPN connections
This reference guide covering the objectives for the SY0-701 CompTIA Security+ exam is designed to act as a supplement to your course book. Using this guide, along with the acronym list, should help you save time by quickly referring to key topics within the exam objections.
Among the many techniques employed by hackers to lure users into clicking on a malicious file, the “Right-to-Left Override” or RLO attack is an interesting form of obfuscation. It is designed to masquerade the file extension in order to trick unsuspecting users. If you couple this with changing the file icon of an executable or bat file to say a pdf, it will add to the illusion of authenticity.
Continue reading Understanding Right-to-Left Override Attack
En algún momento, es posible que te encuentres en una situación en la que necesites otorgar acceso SFTP a un usuario, pero debe configurarse para evitar que naveguen por toda la estructura de directorios del sistema. Aquí es donde resulta útil la funcionalidad de chroot incorporada en sshd. Esto te permitirá restringir y aislar al usuario en un directorio específico y evitar fácilmente el acceso no autorizado. En este ejemplo, cubriremos los pasos de configuración para establecer el acceso para un usuario llamado Rafael en el departamento de contabilidad.
Como usuario root, crea la cuenta y la contraseña para Rafael. Especificaremos el directorio de inicio como /var/contabilidad. Este será el directorio chroot que vamos a configurar. La shell debe ser /bin/false para evitar inicios de sesión interactivos.
Continue reading Configuración de un Directorio SFTP en ChrootAt some point you might find yourself in a situation where you need to grant sftp access to a user but it should be configured to prevent them from traversing the entire directory structure within the system. This is where the built-in chroot functionality within sshd comes in handy. It will enable you to restrict and isolate the user to a specific directory and easily prevent unauthorized access. In this example, we will cover the configuration steps for setting up access for one user named jsmith within the Accounting department.
As the root user, create the account & password for jsmith. We will specify the home directory as /var/accounting. This will be the chrooted directory we are going to setup. The shell should be /bin/false to prevent any interactive shell logins.
Continue reading Setting Up a Chrooted SFTP Directory
Due to the ever increasing list of network compromises, securing our online presence has become more crucial than ever. One way to ensure online security is to use SSL/TLS certificates, which encrypt data transmissions between servers and clients, making them unreadable to any third-party. However, these certificates can be compromised, causing severe security breaches. This was seen back in 2011 with certificate authorities Comodo & DigiNotar. Read more here. There have been around 10 CA compromises in the last 3 – 4 years. Still a rare issue but one that needs consideration. That is where Certificate Transparency comes in, which is an open framework for monitoring SSL/TLS certificates.
Continue reading Certificate Transparency LogsMany admins inadvertently design a sinkhole by null routing unused ranges within their core in order to limit unnecessary traffic. Some may even advertise these ranges from a Linux server running zebra or quagga for advanced alerting while monitoring for the propagation of worms or enumeration scans. In this post, we will discuss a similar idea for DNS using Firepower.
Continue reading FIREPOWER DNS Sinkhole
Meraki is a pretty well known company, and has been a part of Cisco since 2012. There are a multitude of cloud based managed Wi-Fi solutions, but Meraki is one of the most prolific and has a variety of cloud managed products to suit most any size company’s needs. Several of their devices have similar setup steps, but today we will cover the initial out of the box setup of a Meraki MX64 security appliance that will have your MX appliance online and configured in your dashboard in no time.
Continue reading
The idea of using file integrity monitoring to validate your operating system and applications has been around since the late ’90s, with programs like Tripwire. Today, we have a steady stream of companies offering their own version for FIM. However, one consistent and reliable open source solution for Linux is AIDE or the Advanced Intrusion Detection Environment.
Continue reading AIDE – File Integrity Monitoring
Is it possible to get someone’s password in plaintext over ssh? Yes! Surely, this makes no sense when the purpose of ssh is to prevent such a thing. Well, I’m speaking of monitoring the session directly from the server the user is connecting to and not across the network.
Continue reading Sniffing SSH Passwords
The Network Logician 