The Packets, Life and everything
Encryption is sold as an unambiguous good: encrypt everything, everywhere, and you're safer. At first glance it does bring privacy — nobody in the middle can read your traffic, your disk, your backup. But privacy and security are not the same goal, and they don't always move in the same direction. Sometimes gaining one costs …
Continue reading "A Case for Privacy and Security — or Why Encryption Can Lower Your Security"
The need to contain software and systems is likened to containing diseases like Ebola and COVID due to their potential threats. Examples of security risks include repojacking, Docker malware, and cloud breaches. How do we deal with Software?Security, Safety, and PrivacySo how do we handle this with computers?Can a computer secure/defend itself?What can we do?2026 …
Continue reading "Full Containment – Do we have to treat software like Ebola?"
Some Notes about OpenSSH configuration that comes in handy for me. This is have settings applied on Host or Domain base, use jump servers where needed, find the console for a device or use deprecated encryption when needed. Basic Options Host Hostname Port User Apply Settings per domain Host *. Protocol 2 TCPKeepAlive yes ServerAliveInterval …
Tests is there someone listening netstat -an | findstr 0.0.0.0:80 TCP 0.0.0.0:80 0.0.0.0:0 LISTENING UDP 0.0.0.0:80 *:* Powershell port test Test-NetConnection -ComputerName "10.55.113.101" -Port 80 -InformationLevel "Detailed" Lookup soure interface get router info routing-table details 10.255.2.250 Lookup the policy diagnose firewall iprope lookup 10.255.2.250 30000 10.137.2.104 80 tcp port1 matches policy id: 1039431 The policy …
It is a good idea to do basic DoS Protection, even internaly. Configuring DoS policyVerificationdiagnose ips anomaly listReleasing the blocked sendersdiagnose ips anomaly clearLinks Configuring DoS policy This will configure a basic DoS Policy for Traffic with default values and block violations for 2 Minutes. config firewall DoS-policy edit 1 set name "ALL DoS-Policy" set …
Sometimes there is the need to have an forwarding only name server. named.conf/etc/resolv.confDocker enviroments named.conf controls { net 127.0.0.1 allow { localhost; } keys { "rndc-key"; }; }; key "rndc-key" { algorithm "hmac-md5"; secret "somesecret-for-rndc"; }; options { directory "/etc/named.d"; listen-on { 127.0.0.1; }; max-cache-ttl 600; max-ncache-ttl 300; forward only; forwarders { <IP of SERVER1>; …
Continue reading "Bind9 – Caching only DNS Server with Logging"
After the implementation of the AnyConnect Client to our ASA5500 is at a good state i want to have some backup until our productional hardware will delivered. 😉 So i decided to use one of our Cisco 3845 Routers to do the job. show version [sourcecode gutter="false" autolinks="false" collapse="true"] C3845#show version Load for five secs: …
Some Notes what todo http://www.block.net.au/blogs/james/pages/active-directory-vpn-authentication-with-a-cisco-asa-5510-series-appliance.aspx radius authentication für die ASA ASA 8.X: AnyConnect Start Before Logon Feature Configuration Configuration Examples and TechNotes ToDo: av-pairs ???? certificate selection process certifate import on cli / asdm  /ios set the certificate on the interface : ssl trust-point MyTrustPoint Outside Docu: Backup Gateway Piuctures: ASDM, CCP Write complete setup …
AnyConnect and Cisco ACS Radius is a bit more complected because the ASA5500 documentation states that you can not use the Same Radius for Authentication and Authorization. So things getting more complex by it self 😉 But if i see things in the right light we don't need authorization at all so we will on …
Continue reading "How to authentication AnyConnect VPN against RADIUS"
First you have to add a valid Certificate to the ASA, then change following in the configuration. [sourcecode] tunnel-group SSLClientProfile general-attributes authentication-server-group AAA-TACACS+ ! tunnel-group SSLClientProfile webvpn-attributes authentication aaa certificate [/sourcecode] Then you can connect to the asa only with username and a user certificate. Flickr : AnyConnect, Cisco, SSLVPN, Security, UMTS, VPN
How to authentication AnyConnect VPN against Tacacs+ The Authentication against Tacacs+ is quiet easy to configure. Just add the Tacacs+ Servers as described here.Than add following to the configuration: [sourcecode] tunnel-group SSLClientProfile general-attributes authentication-server-group AAA-TACACS+ [/sourcecode] If you feel this helps a bit or may be not ? Please leave a comment. Photo by fabio …
Continue reading "How to authenticate AnyConnect VPN against Tacacs+"