WhiteWinterWolf Practical IT security, *nix systems & networking

Latest articles in ‘Cookbook’

9. ---

   

   • virtualization
   • lab
   • vmtools

   Common issues when using virtual machines

   Qemu issues

   Send the Ctrl-Alt-Del key sequence to the guest

   The Ctrl-Alt-Del is a special key sequence intercepted by he operating system. Windows use it as a security¹ measure to unlock its screen, but in the case of virtualized system an alternative is necessary as the key sequence would be intercepted by the host instead of being sent to the guest.

   • If you are using VNC display, press F8, you should get a menu proposing to send the Ctrl-Alt-Del sequence to the guest.

   • If accessibility tools are available, enable the on-screen keyboard, press Ctrl-Alt on your physical keyboard and click Del on the on-screen keyboard.

   • If accessibility tools are not available, on Windows systems press the Shift key at least five times in a row, you should get a pop-up allowing to enable sticky keys. Now successively press the Ctrl, the Alt …

   Continue

10. ---

    

    • windows
    • microsoft
    • lab

    How to create an Active Directory domain

    Setting-up a basic Windows Active Directory Domains allowing to centrally manage users account can be done painlessly. This guide is mainly based on Peter Kim’s guide written for his book The Hacker Playbook

    In this guide I use a minimal topology, with on one side a Windows server acting as the domain controller and on the other Windows client systems. This guide should work the same no matter the exact versions of the Windows server and clients you are using or if you are using a more complex and realistic topology.

    

    Note

    The Domain Controller must be a Windows Server edition, and for the clients to be able to join the domain they must be at least Windows Professional editions.

    See how to choose a Windows edition.

    Configure the network

    Set IP addresses

    First you need to set static IP addresses to each host.

    The quickest way to access …

    Continue

11. ---

    

    • windows
    • microsoft
    • lab

    Which Windows edition should I choose?

    Windows editions follow a naming convention which may not be the clearest and, to make things worse, change with Windows versions and cover both technical and non-technical differences (meaning that two different editions may actually be the same with just a different EULA).

    Here is a short post on main Windows editions with a focus on the version you may prefer for your lab.

    Windows client editions

    • Windows Home or Core edition is the low-budget, consumer grade version of Windows. It is enough for home uses, but is missing features necessary for corporate environments such as the ability to join an Active Directory domain.

    • Windows Professional or Business edition adds more functionalities, such as the ability to join an Active Directory domain and disk encryption (limited to the Enterprise edition and above until Windows 7 included).

    • Windows Enterprise, Education and Ultimate editions are the most complete editions. There is little …

    Continue

12. ---

    

    • cheatsheet
    • selinux
    • linux
    • *nix
    • hardening

    SELinux cheatsheet

    This page is only designed as a memory-refresher. SElinux may be a complex thing to get right, if you are not familiar with it yet I highly encourage you to read Sven Vermeulen books.

    SELinux state

    To detect whether SELinux is enabled or not:

    • From a script, selinuxenabled doesn’t produce any output and its exit code gives SELinux status.
    • From an interactive prompt, sestatus provides more information.

    SELinux main configuration file is /etc/selinux/config, it defines:

    • SELINUX=: SELinux state:

      • enforcing: Enabled and block unauthorized actions (policy violations).

      • permissive: Enabled, but only logs unauthorized actions and does not block them (useful for development and HIDS purposes).

      • disabled: SELinux is completely disabled.

        Warning

        If SELinux has been temporarily disabled (which is not recommended, there are usually cleaner ways to proceed), a global relabel will be required before re-enabling SELinux.

        More information.

    • SELINUXTYPE=: The policy currently in use, available policies depend …

    Continue

13. ---

    

    • lab
    • networking
    • cisco
    • gns3

    How to install Cisco Adaptative Security Appliance (ASA) in GNS3

    The Cisco Adaptative Security Appliance (ASA) is Cisco’s main firewall and network security product. It mainly provides firewall and VPN services, but its native features can be enhanced with the addition of FirePOWER NGIDS services on top of it.

    Note

    Even when used on top of an ASA in the same appliance, the FirePOWER NGIDS is never really merged within the ASA but stays a separate module. For instance, the ASA and the FirePOWER each have their own separate CLI shell, each with their own different syntax and logic. In fact FirePOWER is not a Cisco development but has been acquired when Cisco merged with SourceFire, hence the (personal) feeling of an “alien” product plugged into the ASA.

    For CCNA Security students, while you must know ASA and be comfortable with its usage, as for now you only need to know what FirePOWER is and why it is used …

    Continue

14. ---

    

    • lab
    • networking
    • cisco
    • gns3

    How to install Cisco Configuration Professional (CCP) in GNS3

    The Cisco Configuration Professional (CCP) is a graphical interface allowing to quickly and easily configure, monitor and troubleshoot Cisco IOS-based devices. It does exactly the same thing as one could do using IOS command-line, but using more convenient graphical tools and optional wizards for multi-steps configuration, including operations involving several devices like setting-up a tunnel.

    It comes in two versions:

    • CCP 2.x, also known as Router and Security Device Manager Software (SDM), it is the little brother of ASDM used to configure ASA firewalls. This is a desktop application, the GUI is installed locally on the user’s host.

    • CCP “Express” 3.x: this version is deployed on the Cisco devices themselves and leverage devices’ HTTP port to embed a web configuration interface. CCP Express already existed in the 2.x generation, at that time two flavors were available: the “end-user” one with reduced functionalities (the end-result was …

    Continue

15. ---

    

    • lab
    • networking
    • cisco
    • gns3

    How to install Cisco Secure Access Control System (ACS) server in GNS3

    Cisco Secure Access Control System (ACS or CSACS) server is Cisco’s Authentication, Authorization and Accounting (AAA) server, allowing to centralize network devices users permissions and auditing.

    It supports TACACS+ (Cisco proprietary) and RADIUS (open standard, usable with non-Cisco devices) protocols. It has its own users store, which is useful for lab tests, but in real life it will most likely be connected to a Microsoft Active Directory server to centralize users credential management.

    Note

    ACS is in the process of being replaced by its successor Identity Service Engine (ISE).

    For some time, the two products were to be used together, with ACS handling authentication and authorization while ISE was focusing on hosts policy-compliance checking.

    For CCNA-Security students, as for now only ACS is really covered by the curriculum. ISE is just mentioned from time to time so you know what it is and why it is used.

    Evaluation …

    Continue

16. ---

    

    • lab
    • networking
    • cisco
    • gns3
    • virtualization

    How to add Cisco IOS-based devices in GNS3

    GNS3 historical use-case was to act as a GUI around Dynamips to emulate Cisco devices. However, while stable, this emulation may not be as straightforward as it could be and has some limitations.

    To understand the negatives, we first need to understand how IOS-based Cisco hardware work.

    How real gear works

    Professional switch and router devices cannot be reduced to a general purpose small-factor computer with a few additional network interfaces.

    When using a general purpose computer with classical network adapters to build a router/firewall appliance, all the processing occurs at the software level, generally the operating system kernel.

    On specialized hardware such as Cisco switches and routers, the operating system (here IOS) works tightly with some underlying specific (and usually proprietary) hardware and delegates parts or all of the processing to dedicated chips, the Application Specific Integrated Circuits or ASICs, to allow faster processing.

    On general-purpose computers …

    Continue

17. ---

    

    • lab
    • networking
    • gns3
    • virtualization

    How to add virtual machines (end devices nodes) in GNS3

    Virtual machines can be added in GNS3 topologies as end devices nodes and can play various roles:

    • Lightweight ones are very focused for instance to provide just enough to test the network connectivity or provide a functional browser.

      They start blazingly fast and are very light on resources, meaning you can put several of them to test end-user workstation behavior at several places in your topology with little to no worry about the CPU or memory impact.

    • Dedicated appliances are designed to provide a specific service, like networking (firewall, …), applicative (proxy, email filtering, …) or administrative (monitoring, …) services.

      Resource consumption vary greatly depending on the service and the software used by the appliance. However, professional appliances are usually designed to handle a large number of simultaneous operations: some will support with no issue to see the virtual machine resources settings reduced on test environments (some may require a modification in their …

    Continue

18. ---

    

    • lab
    • virtualization
    • *nix
    • microsoft
    • pentest

    Where to find virtual machines and ISO files?

    Free software

    Virtual machines

    Several websites offer a large selection of freely downloadable virtual machines with pre-configured free software, for instance:

    • TurnKey Linux.
    • Bitnami.

    You can also check the marketplaces maintained by virtualization-related software, such as VMware and GNS3.

    ISO files

    Obviously the main place to get free software ISO files is from the projects website.

    However, FrozenCow maintains a centralized list of direct links to a fair number of Linux and BSD installation ISO files.

    Some projects host all previous versions of their system, but sometimes they are not easy to find. Search in priority on the master repository as these older versions may not be copied onto mirrors. Sometimes they are stored in a separate “archive” area. At last, WinWorld does a great job in collecting old systems installation medias, including discontinued Linux distributions.

    If you are not sure which Linux or BSD system to choose, DistroWatch might …

    Continue

Pages:  1 2 3 