Heartbleed test the server for CVE-2014-0160

Use the  below  link to find  if your server is vulnerable to Heartbleed.

Link

Products based advisory.

Cisco

F5

Fix For Ubuntu
 
Read About this Bug

 Link

Account Login recording in Linux & Windows System with Zenoss

Recording the SSH Logins success and failure
For Linux Servers
Setting to be done on the Linux side
Edit the linux /etc/syslog.conf file and add the following line
authpriv.* @zenossserver ip or hostname
Restart the syslog daemon.
On the zenoss side make sure these things
1. The machine IP and Hostname should be correct so syslog logs are correctly inserted to the correct device.
2. You can define SSHD event component to be as critical so the current alert system will work OR.
3. You can create a new alert only for sshd reporting , See the below screenshot

This alert generates below alerts , we can also try only to send
On Authentication Success
a. session opened for user
b. Accepted password for root from port ssh
On Authentication Failure
a. Failed password for illegal user from port ssh
b. Illegal user from
On Session Logout
Session closed for  

For Windows Servers
 
All the servers where Wmi monitoring is enabled we just need to increase the zWinEventlogMinSeverity to 5 Which is by default 2.

Alerts Creation
For Successful Logins:
eventClassKey -- Security_552
For Failed Logins
eventClassKey -- Security_680

More details  for security code can be found here from technet.http://technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx

Result looks like this
Device:
Component: Security
Severity: Info
Time: 2014/03/21 00:05:11.000
Message:
Logon attempt using explicit credentials:
Logged on user:
User Name: $
Domain: WORKGROUP or DOMAINNAME
Logon ID: (0x0,0x3E7)

Logon GUID: -

User whose credentials were used:

Target User Name:

Target Domain: System Name

Target Logon GUID: -


Target Server Name: localhost

Target Server Info: localhost

Caller Process ID: 5060

Source Network Address:

Source Port: 2211

Hide tomcat Web Server Version Information

Hide tomcat Web Server Version Information

Replace the server version string from HTTP headers in server responses, by adding the server keyword in your Connectors in CATALINA_HOME/conf/server.xml

            server="Apache" /> 

Remove version string from HTTP error messages by repacking CATALINA_HOME/server/lib/catalina.jar with an updated ServerInfo.properties file.

Unpack catalina.jar

cd CATALINA_HOME/server/lib
jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties

Update ServerInfo.properties by changing server.info line to server.info=Apache Tomcat

Repackage catalina.jar

jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties

Remove CATALINA_HOME/server/lib/org (created when extracting the ServerInfo.properties file)

Restart the tomcat server.

Hide Apache Information from Intruders

Hide Apache Information

To hide the information, add the following two apache directives in Apache Configuration file httpd.conf

ServerTokens ProductOnly
ServerSignature Off

Now you need to restart your web server using the following command

#/etc/init.d/httpd  restart

Now the output for apache header looks like below
# Curl -I  http://localhost
Server: Apache

Enhancing Linux & Solaris Security

Enhancing Linux & Solaris Security

Password lockout after 3 failed Login attempts


Follow these process


# make the log file for faillog reporting
touch /var/log/faillog

# allowing only the root to read the faillog account
chown root:root /var/log/faillog #

# set the permission
chmod 600 /var/log/faillog

make the changes to the following files
#/etc/pam.d/system-auth


Accounts are locked out after 3 failed login attempts. Twice an hour, the failed login counter is reset. The failed login counter is also reset with each successful authentication .


auth required /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root

account required /lib/security/$ISA/pam_tally.so deny=3 no_magic_root reset




Password Length and Complexity




Require a minimum password length of 10 characters, with at least 1 lowercase character, 1 uppercase character, and 1 digit.


Make changes to the following files
/etc/pam.d/system-auth:



password requisite /lib/security/$ISA/pam_cracklib.so retry=3 minlen=10 lcredit=1 ucredit=1 dcredit=1 ocredit=0




Password History

To avoid using the same password Create these files



touch /etc/security/opasswd

chown root:root /etc/security/opasswd

chmod 600 /etc/security/opasswd




Make changes to the following files
/etc/pam.d/system-auth



password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow remember=12


--------------------------------------------------------------------------------
Solaris 5.8 Settings


Password History



/etc/pam.conf



other password requisite pam_history.so.1 history=24 func=$1$


Account Lockout

/etc/pam.conf



login auth required pam_login_limit.so.1 count_limit=5 timeout_account=1800

other auth required pam_login_limit.so.1 count_limit=5 timeout_account=1800

other account required pam_login_limit.so.1 count_limit=5 timeout_account=1800


Password Length and Complexity


/etc/default/passwd


NAMECHECK=NO

HISTORY=5

MINDIFF=3

MINALPHA=2

MINNONALPHA=1

MINUPPER=0

MINLOWER=0

MAXREPEATS=0

MINSPECIAL=0

MINDIGIT=0

Nipper -- Audit and Analyze network devices

Network infrastructure configuration parse

If you are security administrator you may need to find vulnerabilities and configuration flaws in the configuration of your network devices.

Network Infrastructure Parser software that can assist during firewall and router security configuration reviews and Documentation. The software will identify security weaknesses in device configurations and highlight configuration settings and create a report in HTML providing a detail overview of the flaws and whats the best practice suggest.

Attending the need for industry standards and compliance controls such as PCI, HIPAA, ISO and BITS, and the best part of using Nipper is the fact that this tool is absolutely free.

Nipper supports a wide range of Devices like Cisco,Juniper,Nokia,Nortel,Sonicwall,3com,HP,Brocade,CheckPoint Etc..

Download Nipper from Here.

Using Nipper

1. Download Nipper and extract it to a folder.
2. Copy Device config to a text file.
3. Based on the device use the correct switch and use the following command syntax.
c:\>nipper.exe --ios-switch= –input=devieconfig.txt –output=devicename.html

Active Directory Documentation

Active Directory Documentation

I was doing a audit and need to get a Visio architecture for the Active Directory Architecture to understand the overall design and implementation and it was a painful by looking into location segmented AD architecture ( if you are a network administrator or Security Administrator you can really understand my pain) , i came across this tool from Microsoft called Active Directory Topology Diagrammer which did a awesome job for documenting Active directory and I ran the tool first on a Active Directory Vmware workstation image on my laptop and WOH it does what needs to be presented ( my work has become easy now just write up & add details)

This tool automates Microsoft Office Visio to draw a diagram of the Active Directory Domain topology, your Active Directory Site topology, your OU structure or your current Exchange 200X Server Organization. With the Active Directory Topology Diagrammer tool, you can also draw partial Information from your Active Directory, like only one Domain or one site. The objects are linked together, and arranged in a reasonable layout that you can later interactively work with the objects in Microsoft Office Visio.

You can download the tool from Here.