Uninstalling Symantec Antivirus Client 10.2 from Windows 7 64bit Without the Uninstall Password

If you attempt to install Symantec Antivirus Win64 from Win 7 without the uninstall password, you'll probably find that people suggest that you change a registry key value:

HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security\UseVPUninstallPassword from 1 to 0.

That doesn't really work for the 64 bit variant as the key locations are different. I looked around a bit and found that the key was here, instead:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security\UseVPUninstallPassword

After changing that 1 to 0, you should be able to uninstall without a password.

Blocking Outbound File Attachments In MailScanner

MailScanner is a popular anti-virus/anti-spam open source package that supports several operating systems, including Linux and FreeBSD. It can be helpful for minor compliance work.

For exmaple, Company X wants to block outbound Microsoft Word Docs (both .doc and .docx) but allow people from outside to send them in. To set this up, you'll need to create a couple of files and modify the main config, Mailsca

In order to block only, say, word docs in Mailscanner, you need to do a few things.

Steps

1. add a rule to split the filename processing. On CentOS, we'll call this /etc/MailScanner/rules/filenameconf.rules

The contents are:

From:   *@mydomain.com /etc/MailScanner/filename.mydomain.rules.conf
From:       default /etc/MailScanner/filename.rules.conf

2. copy /etc/MailScanner/filename.rules.conf to /etc/MailScanner/filename.mydomain.rules.conf

3. edit /etc/MailScanner/filename.mydomain.rules.conf and set the rules you want. To block doc/docs:

deny   \.docx?$        Windows Word Doc                                                               Word  documents may contain sensitive information or viruses

(note, the fields are tab delimited, not space delimited!)

4. modify the main config file, /etc/MailScanner/MailScanner.conf and comment out this line:

Filename Rules = %etc-dir%/filename.rules.conf

and replace it with this:

Filename Rules = %rules-dir%/filenameconf.rules

5. restart mailscanner (sudo service MailScanner restart)

Apache mod_jk to Tomcat/Jboss Connection Errors Related to Palo Alto Firewalls

I recently ran across a problem when sending mod_jk/AJP connections back to a Jboss app server running behind a Palo Alto firewall (PA500.) The error was a little mysterious as Jboss didn't really report anything interesting. I could see that traffic was passing (via tcpdump) but Apache generated 500 errors.
The only clue was the following error message in the mod_jk log:


[Wed Jan 29 17:23:44 2014][9283:16992576] [info] ajp_handle_cping_cpong::jk_ajp_common.c (876): awaited reply cpong, not received 
[Wed Jan 29 17:23:44 2014][9283:16992576] [error] ajp_connect_to_endpoint::jk_ajp_common.c (957): (WSERVICES) cping/cpong after connecting to the backend server failed (errno=104) 
[Wed Jan 29 17:23:44 2014][9283:16992576] [error] ajp_send_request::jk_ajp_common.c (1507): (WSERVICES) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=104) 
[Wed Jan 29 17:23:44 2014][9283:16992576] [info] ajp_service::jk_ajp_common.c (2447): (WSERVICES) sending request to tomcat failed (recoverable), because of error during request sending (attempt=1)

The cping/cpong message is talking about a failed keep alive.

I figured it was something related to the way the PA firewall manipulates the data via a proxy. I then created a rule defining 8009 as a service (as opposed to an application), turned off AV inspection of the traffic, and the problem went away.

Saving Acme Packet Configs using Rancid

No one has yet written a Rancid module for Acme Packet's (now Oracle) Session Border Controller/SBCs/SIP routers. I played around with it because I wanted a quick and easy way to diff Acme config revisions. This method works for me with SBCs using 6.2 of the Acme software. It produces several errors at the top of the config, since the Cisco module tries to run a lot of commands.

1. I created an SSH key as the rancid user, with no password:

/bin/su - rancid -c "ssh-keygen -b 2048 -t rsa"

2. I created an SSH key based user on the SBCs (I have a HA pair, so I did this on the primary) - and I used the public key I created in step one (i.e., ~rancid/.ssh/id_rsa.pub    - just remember that the format is very strict. You should match, more or less, the example below. The comment goes at the beginning, and not at the end like openssh)

ssh-pub-key import authorized-key rancid

IMPORTANT:

       Please paste SSH public key in the format defined in RFC 4716.
       Terminate the key with ";" to exit.......

---- BEGIN SSH2 PUBLIC KEY ----


Comment: My rancid user's public key

AAAAB3NzaC1yc2EAAAasdasdawdawdhZj07+93RKwx0RXcwaaadawdawdaefZuc6ePw+3G9jiZUcyxFb8Td9sc700HtZLN0CtezZKHsC+bJPp0oocb9ykAIzO9xs3vOs55aadwdad21d12fq==


---- END SSH2 PUBLIC KEY ----;

I usually create host file entries for rancid, as not all of the hosts are in dns, and some have multiple addresses. But, it's entirely up to you. The key format above is strict. Make sure there are no empty spaces at the end of lines. 

3. modify .cloginrc and add the following (assuming your SBC is called mysbc1.myfqdn.local

add password mysbc1.myfqdn.local noRealPasswordNecessaryJustFillThisInWithGarbage

add autoenable mysbc1.myfqdn.local 1

add user mysbc1.myfqdn.local rancid

add method mysbc1.myfqdn.local ssh


4. log into the SBC with the actual rancid user, just so the rancid user will add the host to its ssh_known_hosts file


5. add the SBC to the router.db for your particular environment:


mysbc1.myfqdn.local:cisco:up


 6. Now, you should be all set. Run Rancid as you would, normally. For instance, I have a COLO called pac1:


/bin/su - rancid -c "/usr/local/rancid/bin/rancid-run pac1

Connecting to SQL Server 2005 Using Perl and DBI on RHEL/CentOS

I wasted a good bit of time getting this to work correctly. I had done it once before, years ago, but lost the script. Basically, I'm connecting using Perl's DBI (with ODBC) and FreeTDS.

My RPMs are (as of now):

rpm -qa | egrep -i \(freetds\|odbc\)



freetds-0.91-2.el6.x86_64

perl-DBD-ODBC-1.23-1.el6.rf.x86_64

unixODBC-2.2.14-12.el6_3.x86_64


Basically:

1. install the appropriate RPMs

2. Edit /etc/freetds.conf and add each SQL Server DB server you want to connect to:

[mySQLServer1]

host = mysqlserver1s.hostname.or.ip.address

port = 1433

tds version = 7.0

[mySQLServer2]

host = mydbserver2.mydomain.com

port = 1433

tds version = 7.0

3. edit /etc/odbcinst.ini

[FreeTDS]

Driver  = /usr/lib64/libtdsodbc.so.0

Description = v7

4. Finally, edit /etc/odbc.ini and put in a stanza for each database you wish to connect to. You may have multiple DBs per database server/host

[mydb1]

Driver = FreeTDS

# ServerName corresponds to a stanza in /etc/freetds.conf - not an IP address or hostname

ServerName=mySQLServer1

# Port is optional, you can specify it in /etc/freetds.conf, instead

Port = 1433

#TDS Version is optional... you can specify it in /etc/freetds.conf, instead

Database = mydatabaseinstance

[mydb2]

Driver=FreeTDS

ServerName=mySQLServer1

Database=mydatabaseinstancetwo

# Here we have multiple DBs on the same server

[mydb3]

Driver=FreeTDS

ServerName=mySQLServer2

Database=yetanotherdbinstance

After all this, you can test your connectivity with isql:

isql -v mydb2 MYWINDOWSDOMAIN\\myuser MYPASSWORD

+---------------------------------------+

| Connected!                                          |

|                                                             |

| sql-statement                                        |

| help [tablename]                                   |

| quit                                                       |

|                                                             |

+---------------------------------------+

SQL>

As you can see, the first entry after the verbose flag corresponds to the stanza name in /etc/odbc.ini

Here's the connection info for Perl:

#!/usr/bin/perl -w

use DBI;

use strict;

my $dsn = "mydb1";

# this corresponds to the relevant stanza in /etc/odbc.ini

my $user = 'MYWINDOWSDOMAIN\user';

# single quote marks remove the need to escape the "\"

my $pass = "myBigDifficultPassword";

my $dbh = DBI->connect("dbi:ODBC:$dsn", "$user", "$pass") 

      or die "Cannot connect to DB $dsn: $DBI::errstr\n\n";

OSSEC Agent Installation on RedHat Enterprise and/or CentOS

I consider a HIDS to be one of the very most important security systems in a network. It's very important to know if someone is attempting to brute force his way into one of your servers, but if the attacker breaks in, it's even more important to know what changed. While log monitors and tools like Splunk can detect the former, they're not designed to note changes in binaries. That's where a HIDS (Host-based Intrusion Detection System) comes into play. One of the most popular is OSSEC. It's open sourced and free to deploy. It notes troublesome issues in the logs (like login failures) and can even take proactive measures, such as blocking an attacking host by manipulating the firewall.

OSSEC works on Windows, various flavors of unix and linux, as well as network devices such as switches, routers, and firewalls. It can run stand alone or report to a master server.

Agent installation on RHEL/CentOS

1. Install the Atomic Yum repo:

sudo "wget -q -O - http://www.atomicorp.com/installers/atomic | sh"

2. Install the EPEL repo (We're using 64bit Linux here)

 If RHEL 5/CentOS 5, 

sudo rpm -ivh http://download.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm

If RHEL 6/CentOS 6,

sudo rpm -ivh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm

CentOS 6

 3. Install the RPMs from yum (should be about 4 RPMs or so):

sudo yum -y install ossec-hids-client

3a. (optional) Disable the Yum repos for Atomic and EPEL:

sed -i /etc/yum.repos.d/atomic.repo -e 's/enabled = 1/enabled = 0/g'
sed -i /etc/yum.repos.d/epel.repo -e 's/enabled = 1/enabled = 0/g'

4. You'll need to set your server (if you even have a central OSSEC server) in the config file like so:

5. (optional) make an exception for the central server (again, if you even have one):

sudo iptables -A INPUT -p udp --dport 1514 -j ACCEPT

 That's basically it. It's most definitely worth reading up on the documentation and you should definitely test OSSEC out before using the active rules.

 

Cisco AP1141N (Aironet 1140 series) Access Point With 3 SSIDs and VLANs

N.B. The Cisco AP1141 access point will be end of life very soon

I had a scenario recently where I had to set up one of these access points to service three different SSIDs with one VLAN per SSID - with two SSIDs using WPA personal and the third un-encrypted.
Each SSID/VLAN was on a subnet with a DHCP server, so I did not need to use DHCP pools or DHCP relay on the access point.

Here's the config I came up with (I'm skipping the non-relevant configuration) - note that the single gigabit interface on this access point was plugged into a Dell PowerConnect 3448P PoE switch in a trunk port with 501 set to the native vlan (switchport trunk native vlan 501)

SSID1 = myssid1 running on VLAN 501 (bridge group 1)
SSID2 = myssid2 running on VLAN 601 (bridge group 60)
SSID3 = myssid3 running on VLAN 701  (bridge group 70)

! Build the first SSID on VLAN 501
dot11 ssid myssid1
   vlan 501
   authentication open
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 0 myReallyComplexKeyHere
!
! SSID 2 - this SSID has no encryption
dot11 ssid myssid2
   vlan 601
   authentication open
   mbssid guest-mode
!
dot11 ssid myssid3
   vlan 701
   authentication open
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 0 myReallyReallyComplexKey
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption vlan 501 mode ciphers aes-ccm

 !
 encryption vlan 701 mode ciphers aes-ccm
 !
 ssid myssid1
 !
 ssid myssid2
 !
 ssid myssid3
 !
 antenna gain 0

 

! We need to broadcast multiple SSIDs
mbssid
 station-role root


! now the interfaces, remember that VLAN 501 is the native VLAN on the trunk port on
! the switch

interface Dot11Radio0.501
 encapsulation dot1Q 501 native
 no ip route-cache
 bridge-group 1
!
interface Dot11Radio0.601
 encapsulation dot1Q 601
 no ip route-cache
 bridge-group 60
!
interface Dot11Radio0.701
 encapsulation dot1Q 701
 no ip route-cache
 bridge-group 70

! remember, no IP for the actual ethernet interface. Save the IP for the BVI interface
interface GigabitEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 no keepalive

 ! here's our native VLAN 501, untagged - myssid1
interface GigabitEthernet0.501
 encapsulation dot1Q 501 native
 no ip route-cache
 bridge-group 1
! and here is myssid2
interface GigabitEthernet0.601
 encapsulation dot1Q 601
 no ip route-cache
 bridge-group 60
! and now, myssid3
interface GigabitEthernet0.701
 encapsulation dot1Q 701
 no ip route-cache
 bridge-group 70

! Now, we set the management address:

interface BVI1
 ip address 10.1.1.240 255.255.255.0
no shut


That's basically it. I highly recommend testing by isolating this on a stand alone switch. Plug a DHCP server into another port, access mode, and switch VLANs on that port and see if your wireless devices get a DHCP address. Of course, you may want to enable more complex authentication methods.