Inexpensive Cisco Network Log Analysis

I saw a reference to an article titled Inexpensive Cisco Network Log Analysis by Mark Lachniet over at LinuxSecurity.com this morning. The log analysis article is well written and describes setting up Kiwi Syslog, configuring a PIX Firewall for syslog; and then configuring Sawmill log analyzer to provide reports based on the logged data.

Reading through the article the PIX configuration had one issue: the author omitted the "logging on" command that enables the logging process on the PIX.

If you are thinking of running Kiwi and the Sawmill analyzer I'd suggest starting out with a PIX Firewall that is at the same location as the syslog server. The PIX can generate quite a lot of log data and I'd suggest learning what your PIX will log given your network, users, and applications before trying to setup logging from a remote location.

How to configure your PIX Firewall for SSH

This (or click on the title above) is a paper I wrote on how to configure the PIX for SSH. It's really very easy to do.

What Model & Version of Linksys Hardware?

If you are trying to upgrade the firmware on your Linksys router and you are not sure which version of the hardware you have make sure to look at the label on the bottom of the router. The version number of the router is right next to the model number.

Good Disclosure...

I think that Konstantin Gavrilenko from Arhont Ltd.- Information Security did an outstanding job of documenting a Cisco PIX TCP Connection Prevention vulnerability. Cisco's response to this vulnerability announcement is here. He has documented what could be termed a resource attack on the PIX; forcing the Firewall to expend unnecessary resources reacting to a scripted packet. This attack could potentially slow user connections through the Firewall and in the extreme worst case possibly cause the Firewall to reload but does not expose the protected network. Gavrilenko has done an excellent job of communicating this issue that his work uncovered. I think even novice PIX Admins will be able to understand his findings.

I'd strongly suggest that all PIX Admins read the report and also go over the Cisco response. This is the first response that I've seen since PIX OS v7 came out. Cisco PSIRT present work arounds for both the v6.x and v7.x PIX operating systems. The vulnerability can best be exploited by an attacker on a inside interface.

One caution after reading the Cisco response; the first work around suggests that issuing a "clear xlate" or "clear local-host " will allow the PIX to pass connections again. I hope that most PIX Admins will appreciate that "clear xlate" will affect all connections going through the PIX were "clear local-host ..." only clears a single connection. Admins should use the "clear xlate" with caution on production networks.

Updated SANS top Twenty Vulnerabilities

The folks over at SANS.org released version 6 of their Top Twenty List of Critical Security Vulnerabilities today. When SANS started publishing their lists I always advised security analysts and in particular Firewall admins to strongly consider these vulnerabilities when creating and maintaining Firewall rules. Some time back the folks that compile the list started breaking out Windows vulnerabilities from others. Something that is new to the list this year is that the SANS team has further structured the list so as to look at Windows, networking, and cross platform ( or web application) vulnerabilities.

Black Hat no more?

I don't know if anyone saw this coming; Black Hat was acquired by CMP Media for about $10 million dollars. I know that when you look at the web site Black Hat lists consulting services available but I had never actually read anything about work they might have done. The Black Hat conference is the premiere annual security event. I think everyone is asking the question will Black Hat be able to maintain it's edge as part of a much larger (and seemingly much more conservative) media company? What's next, Ozzie Osbourne's music library being acquired by the Osmonds?

Linksys Default Number of IP Addresses

When setting up a Linksys router; and by that I mean any Linksys router you may notice that by default the setup program turns on DHCP and allows the DHCP server to allocate up to 253 IP addresses. For many folks this number should be in the range of 1 to 3. I have 8 PCs, two network printers, two wireless access points, and a network storage device and I manage to use only 8 IP addresses (OK, some of those devices are behind another Firewall and others are behind a VPN router). Things to think about here are if you have any non PC type devices that might attach to the Linksys. For example I have the family Tivo box set up with a wireless network interface and that uses an address. IP phones might also fall into this category.

About Resetting that Linksys Router

If you find that you have to reset your Linksys router on a weekly basis you really need to check to make sure that it is running the latest firmware.

Using your web browser enter "www.linksys.com". (Note to Linksys) Be patient as sometimes this page takes up to a minute to load even on the fastest broadband connections. Look under the "Support" drop menu and select "Downloads". There you will find a drop down menu were you select the type of Linksys router you have and then click on "View Downloads". Once completed you'll be looking at the support page for your model of router. Select "Firmware" to view the specific firmware files that are available. If there is a version of firmware that is more recent than that running on your router, select and download it. Be careful as sometimes the different options on these pages look like different versions of firmware (each says "Download Firmware" below the item). I noticed for my router that the 3 files were #1 - the firmware, #2 - a firmware install utility, and #3 - the release notes for that version of firmware.

You can install the firmware on your router from a PC that is connected to the Linksys device. If you use the install utility from the Linksys website you can push the new firmware onto the device. You can also use the "Firmware Upgrade" choice off of the Linksys Administration menu to pull the new firmware file from that same connected PC.