The DMZ

Feeds

10:44

packs has been automatically appointed as owner of this room.

packs

12:37

Hm. That sounds like a lot of responsibility. I would like to thank you all for the opportunity to serve. As we move forward together we will build a better chat room. One that will be remembered through the ages. It will be difficult, but working together we will be VICTORIOUS!

balpha

12:50

Hear hear!

packs

13:11

Thank you, Mr. Dumke for your enthusiasm. It is people like you who shall make this chat great!

Iszi

@packs How did that just automatically happen?

packs

@Iszi I don't pretend to know. I was greeted with that when I was eating my granola.

packs

13:29

So, @Iszi, did you get your scans finished?

Iszi

@packs Dunno. Left the laptop there to finish up. Gonna check on it this morning.

packs

That rather sucks.

I'm hoping to get to the point where we can just pass some vlans and not have to travel anymore for such things. That would be nice.

Iszi

@packs We're working on getting an IPSec tunnel up for this site. But Foundstone seems to not like IPSec.

packs

That doesn't surprise me. We got a lot of comments from Tenable about similar things.

They actually have a PCI scan mode, which is cool. But it requires, that all routers and firewalls be removed between the scanner and the host.

Iszi

Another thing about Foundstone, just FYI (in case you ever come across it): The updater utility doesn't properly check your current software/signatures versions.

packs

13:32

Meaning, you'd best be able to put in a crossover cable

@Iszi Sweet!

That there's a feature if I ever heard of one.

Iszi

Yeah, it only checks some registry keys that tell when the last update was downloaded. It doesn't actually check the database or scripts folder to see if the update was applied.

packs

That is pretty....spectacular.

But does remind me that I need to update our nessus scanners. New version came out a couple of days ago.

Iszi

So, if it downloads an update but has problems connecting to the DB to apply it, near-future update checks will read the system as up-to-date even though it really isn't.

packs

Yeah.....that's kind of...uhm...broken.

Iszi

@packs Foundstone requires we disable host-based firewalls (we could probably get away with just poking some holes, but that's a work in progress) and Simple File Sharing for a credentialed scan.

packs

13:35

I'm gonna go with broken.

balpha

@Iszi new feature:

3

A: Chat clean up & owner rules

Sure. In most cases, the room owner is more or less arbitrary, because it's just the person who was first to create the (e.g.) PHP room. But of course it makes sense to have several owners, especially for rooms that are quite active and have developed their own "style", and have those owners be p...

Iszi

@balpha Thanks

packs

@Iszi That does make sense. Tenable requires ssh and an account with sudo rights, and whatever the Windows equivalent stuff to login and perform wmi calls.

We've been able to get away with applying the firewall rules, and enabling the users, on demand.

Iszi

@packs I just think it's jacked up that you should have to modify the environment just to perform a vulnerability scan.

packs

If you want to perform local checks, sure.

We also do scans without any of the extra hullabaloo. No special firewall rules, no user accounts, etc. So we can get both the views. Can be pretty interesting.

I really like running the local checks though. Coming back and telling the admins, 'Oh, you need to install this reg-key.' is pretty fun.

Iszi

13:42

@packs Yeah, we pretty much get nothing in the results if we don't do the special configurations.

packs

Hm, that kind of sucks.

Nessus will, at least, still do a port scan and banner grab. And web application checks (sql injection, etc) if you check that box.

Iszi

@packs Well, by "nothing" I mean "nothing that generally needs acting upon".

Port scan and banner grab gets done for sure. Usually there's nothing alarming there though.

packs

That can be a hard line to follow. Sure, you got the banners, but is that version number actually accurate?

Ours can be a bit more exciting.

Of course, we're a ~30k student, ~5k fac/staff campus with a history of distributed IT.

Even just a banner grab can be interesting :)

Iszi

Do your scans include the IP space that has personal equipment?

packs

"personal equipment" is a funny thing at a university. There are the dorms, so we can assume those are all personal.

But there are definitely 'haves' and 'have nots' within the working areas.

Some departments have enough cash to hire an entire IT staff and do the entire stack.

Some can't even afford to buy their faculty laptops, so they'll bring in their own.

And then there's equipment bought on grant, who that actually belongs to is unclear sometimes.

So short answer, yes, long answer, sometimes you can't tell the difference.

Iszi

13:54

@packs Ick.

packs

Pretty much.

That's why, as discussed on Moir's question on a stole laptop from around Thanksgiving, we tend to focus more on the information and less on the property.

Iszi

Well, I should get going. Gotta get a replacement badge because our prox card readers are crap, and then go to check on that scan.

packs

Lucky you :)

Enjoy

Iszi

I really hope it went through fine and all the credentials worked on all the systems. There's 39 machines in this scan, and it's a royal pain in the arse to troubleshoot through even one.

And that has gotten worse in the new version of Foundstone, too.

packs

Thanks guys.

My rule of thumb is, "If I'm scanning a Windows machine for the first time, and there aren't any 'criticals' then the scan must have failed."

Iszi

13:58

Used to be you had a console view where you could see in real-time what was going on with the scan, and when something failed. Now, you can't tell what the hell is happening until the scan is complete.

@packs Agreed.

@packs Thanks for what?

packs

Oh, general statement to Foundstone for their wonderful "feature enhancements"

You know, like removing any ability to reasonably debug a scan.

Iszi

@packs Ah, right.

So, you've worked with Foundstone then?

packs

No, but I am empathizing with you :)

Iszi

:-) Thanks. Catch ya later.

And gratz on the new room ownership.

packs

ta

Iszi

14:45

Well, this is great.

In the good news department, I've found an admin workstation I can use to remote to my desk. In bad news, that scan I left running has been going for 20 hours now.

So, this is one of those times when real-time debugging would be nice.

packs

15:03

I had a sql query take 23 hours the other day. And, of course, no results until it finished. That was exciting :)

Iszi

Well, apparently something I didn't think of was that we can check the log files before the scan is done. It's showing a lot of TCP connection closed timeouts.

@packs I know you're a Linux guy, but I figure this is something you probably have in Linux that may have been ported to Windows...

Is there a tool that can actively monitor a text file and output to screen any new lines that are written to it?

packs

Reading the log file as it's being written, you mean?

oh, yeah.

In unix it's called 'tail'

Iszi

@packs I've heard of that. It updates real-time?

packs

Well, lots of options, but basically yeah. IT will either spit out the last x number of lines (default 10) or pause and print out new lines as they happen.

example

tail -n50 file

Prints out the last 50 lines in that file.

tail -f file

Prints out the last 10 lines, and waits...prints new lines as they're written.

Iszi

Spiffy. Know if there's a version for Windows, or should I JFGI?

packs

15:13

I think there is...let me go next door and ask.

It's one of those things that probably exist, but Good Luck Finding It.

wintail or tailwin or something.

He remembered installing it at one time, but can't remember where it came from.

Iszi

Hey, there's a post on SO for it in the top 5 on Google.

packs

nice

Iszi

There's actually a few of them.

This is fantastic. A suggested solution was to force the NIC to 100Mbps Full Duplex mode. Did that, and the config dialog is hanging and the TCP/IP stack is down.

And with the TCP/IP stack down, I can't gracefully cancel the scan because the interface is web-based.

packs

What was it negotiating to?

Iszi

I ever mention how much I love Foundstone?

@packs Didn't check - it was set to Auto.

packs

15:27

We noticed problems with PIXes autonegotiating very badly. We usually ended up having to lock them in at 100/full

Left to their own devices they would sometimes do 100/full, sometimes 100/half, and sometimes 10/half

Iszi

Well, I had to force-reboot.

packs

I love the Windows network stack :)

Iszi

Got any PowerShell gurus in your group? Looks like there may be something I can use there, but I'm not well-versed in it myself yet.

packs

The systems guys are starting to get hot and heavy into it, but we don't really use it down here.

While we do run a few of our own servers, they're almost all redhat.

Iszi

15:51

Looks like Get-Content will do the job for me for now, and there's also a Microsoft "Tail" tool available in the Server 2003 Resource Kit Tools.

I just can't get the latter onto my laptop at the moment.

Anyway, I'm gonna drop off for a bit. l8r

packs

Good luck

Iszi

16:58

Well, after an hour the scan is still running. But, now that I can see the log as it happens, it appears to be running pretty smoothly.

After I expanded the horizontal buffer and window size of PowerShell, Get-Content looks a lot cleaner. Unfortunately, using the live monitoring function still requires an initial screen dump of the entire file. Annoying, but tolerable.

@packs Do you by chance know which room I should go to, to chat with diamond mods on SO? There's about three or four questions on that "tail for Windows" thing that I want to suggest merging.

packs

17:30

I actually don't know. The Teacher's Lounge is a system wide mod room, but it might be only joinable by mods.

You could always flag them and put that in the attention box

Iszi

Yay! Scan finished! Only... it turns out I missed 2 IPs when I set it up.

Good news is, it should only take 15-30 minutes now to get those.

packs

rock

Any indication yet why it was taking so long?

Iszi

@packs Yeah. Bad negotiation on network speed and duplex. Had to force the NIC to 100 Mbps Full.

Holy crap, the scan's done already for those two boxes!

packs

17:45

It's amazing what duplex issues will do to your traffic

Iszi

Yeah. Apparently the network I'm scanning is used for a lot of video streams and stuff, so all the infrastructure is locked to 100 Mbps Full - anything set to Auto just doesn't play nice.

packs

Nice.

Iszi

Well, my work here appears done for now. Time to pack up and head back to the office.

packs

So did they lock down the speeds because they had problems with systems not auto-negging well, or because they were afraid it might happen.

Hmm

Same here. Now that my lunch is over, time to leave the house and go back to the office.

Iszi

19:01

Y'know, something I've never really gotten... At what level do WiFi security mechanisms (WEP/WPA/WPA2) actually operate?

I'm thinking they're somewhere around layer 1.5? 'Cause they're definitely not Physical, but they do have to be in effect before any higher-level protocols can actually be used.

Hm. Google results don't seem to clarify things much for me. Should I post it here, or on SU/SF?

Reason this is coming up is because of this question.

0

Q: Is WPA2 WiFi protected against ARP poisoning and sniffing?

Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?

wifi

packs

19:25

This is one of the reasons I'm not all that keen on the OSI model.

Iszi

@packs I don't think the TCP/IP model does any better in this case.

packs

No, because the 4 layer model there pretty much only works on wires

As I recall the implementations, those would be part of the data link (on the 7 layer), with the physical layer being straight radio waves.

Although, now that I'm the room owner, that probably means that I'm right.

So yeah, that would be data link.

Iszi

@packs Right, but there's also "Layer 2" protocols that technically operate above them.

packs

I have decreed it.

I'm going to call it encapsulation then :)

I just read the question/answer, and see what you mean.

Not to sound like an ass, but I think he actually muddied the waters more by relying too much on the Strict Layering System

Iszi

Yeah... That's kinda why I was saying WPA2 fits more around Layer 1.5.

packs

19:32

We actually have one of those big hokin protocol maps that attempts to map all the various and sundry network fiddly bits to a "layer"

I'll check to see if the wireless stuff is on it.

Most all of the cryptographic tunnels are

Iszi

@packs Ooh, where can I get one?

packs

I'll see if there's a url on it.

Most likely it just came off a webpage

Javvin, and no, it's an actual poster.

It placed it in layer 1, maybe drifting into 2

Iszi

19:51

@packs Interesting

Transcript for