The Packets, Life and everything
Encryption is sold as an unambiguous good: encrypt everything, everywhere, and you're safer. At first glance it does bring privacy — nobody in the middle can read your traffic, your disk, your backup. But privacy and security are not the same goal, and they don't always move in the same direction. Sometimes gaining one costs …
Continue reading "A Case for Privacy and Security — or Why Encryption Can Lower Your Security"
The need to contain software and systems is likened to containing diseases like Ebola and COVID due to their potential threats. Examples of security risks include repojacking, Docker malware, and cloud breaches. How do we deal with Software?Security, Safety, and PrivacySo how do we handle this with computers?Can a computer secure/defend itself?What can we do?2026 …
Continue reading "Full Containment – Do we have to treat software like Ebola?"
Entra ID OIDC-based SSOStep 1: Register the Application in Entra IDStep 2: Create a Client SecretStep 3: Configure API PermissionsStep 4: Configure Keycloak to use Entra IDStep 5: Configure Keycloak for NextcloudStep 6: Configure Nextcloud Common PitfallsEvaluating the Client IP via X-Forwarded-ForDiscovery URLsHow to Fetch the DocumentWith curlLinks Entra ID OIDC-based SSO Step 1: Register …
Zero Trust Architecture (ZTA) has become a cornerstone of modern cybersecurity. By continuously verifying access based on dynamic data — user identity, device health, threat intelligence, enterprise context — ZTA helps organizations stay resilient against evolving threats. But there's a catch: the data that makes Zero Trust work has to come from somewhere, and much …
Continue reading "The Hidden Risk in Zero Trust: Vendor Lock-In Through Proprietary Data Formats"
Notes about ZeroTrust Security Contents What is Zero Trust? History of ZT Definitions, Concepts, & Components of ZT Tenets Design Principles Pillars Components & Elements Logical Components of Zero Trust Architecture Mapping ZTA components to SDP CISA Zero Trust Maturity Model for the identity pillar CISA Zero Trust Maturity Model for the networks pillar Function: …
FreeRadiustac_plusCiscoFortinetCheckPointLinks FreeRadius /usr/local/etc/raddb/clients.conf client cisco { ipaddr = 8.8.8.8 secret = testing123 } /usr/local/etc/raddb/users cisco Cleartext-Password := "cisco" Service-Type = NAS-Prompt-User, Reply-Message := "Hello, %{User-Name}", Cisco-AVpair = "shell:priv-lvl=15" /usr/local/etc/raddb/sites-available/default # Read the 'users' file. In v3, this is located in # raddb/mods-config/files/authorize files # MAC Auth rewrite_called_station_id # Now check against the authorized_macs file authorized_macs …
Some Notes about OpenSSH configuration that comes in handy for me. This is have settings applied on Host or Domain base, use jump servers where needed, find the console for a device or use deprecated encryption when needed. Basic Options Host Hostname Port User Apply Settings per domain Host *. Protocol 2 TCPKeepAlive yes ServerAliveInterval …
My personal collection of CheckPoint Commands. Most of them work best in expert mode. [Expert@gateway:0]# CommandDescriptioncpconfigchange SIC, licenses and morecpview -tshow top style performance counterscphaprob statlist the state of the high availability cluster members. Should show active and standby devices.cphaprob -a ifdisplay status of monitored interfaces in a clustercphaprob -l listdisplay registered cluster devices and …
It is a Netscreen 5gt. So now commands maybe usefull: Cisco PIX Cisco ASA Netscreen Description show configuration get config saved get saved configuration show running-config get config get device configuration save to save changes to config show version get system gets system information, Netscreen mode get session info shows load on the firewall 85+ …
[sourcecode] crypto isakmp key supersecertkey address AAA.BBB.CCC.DDD ! crypto isakmp policy 20 encr 3des hash md5 authentication pre-share group 2 ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto map CSM_CME_FastEthernet0.831 131 ipsec-isakmp set peer AAA.BBB.CCC.DDD set transform-set ESP-3DES-SHA match address XY-TEST-CRYPTO-ACL reverse-route ! ip nat outside source static 192.168.XX.121 10.4.YYY.243 add-route ! ip access-list …
set radius enable set radius server 1 10.0.xx.y7 1812 supersecret realm any set radius server 2 10.0.xx.y8 1812 supersecret realm any on the acs Radius reply item must be Filter-ID = Enterasys:version=1:mgmt=su