Tag Archives: Authentication

Why should I run own NTP Servers?

2019-01-16Internet of Things (IoT), NTP, SecurityAuthentication, Availability, IoT, Man-in-the-Middle, Meinberg LANTIME, NTP, NTP Pool Project, Raspberry Pi, reliable, Spoof, Sync, UDPJohannes Weber

… since we all can use “pool.ntp.org”? Easy answer: Many modern (security) techniques rely on accurate time. Certificate validation, two-factor authentication, backup auto-deletion, logs generation, and many more. Meanwhile, we use an unauthenticated protocol (via stateless UDP) from unauthenticated sources (NTP pool) to rely on! Really?

TL;DR: If you want to operate a secure environment you should use your own on-site stratum 1 NTP servers along with authentication. This is the only way to eliminate time spoofing attacks from the outside. Don’t reduce your overall security to a stateless and unauthenticated (read: easy-to-spoof) network protocol!

If you are using a couple of different NTP sources it might be not that easy for an attacker to spoof your time – though not unfeasible at all. And think about small routers with VPN endpoints and DNSSEC resolving enabled, or IoT devices such as cameras or door openers – they don’t even have a real-time clock with a battery inside. They fully rely on NTP.

This is what this blogpost series is all about. Let’s dig into it. ;)

Continue reading Why should I run own NTP Servers? →

My CCNP TSHOOT Lab: The Overall Picture

2018-11-12Cisco Systems, IPv6, RoutingAuthentication, CCNP, Cisco Router, Cisco Switch, Dynamic Routing, EEM, FHRP, GLBP, GRE, IPv6, MD5, NTP, prefix-list, route-map, VRRPJohannes Weber

During the last few weeks I published a couple of blogposts concerning routing protocols such as BGP, OSPFv3, and EIGRP. (Use the “Cisco Router” tag on my blog to list all of them.) They are all part of my current Cisco lab that I am using for my CCNP TSHOOT exam preparation. While I depicted only the details of the routing protocols in those blogposts, I am showing my overall lab with all of its Cisco IOS configs here. Just to have the complete picture. There are a couple of not-yet-blogged configs such as VRRP, GLBP, NTP authentication, embedded event manager (EEM), or route-maps and distribute/prefix lists though.

Continue reading My CCNP TSHOOT Lab: The Overall Picture →

EIGRP Capture

2018-11-01Cisco Systems, IPv6, RoutingAuthentication, CCNP, Cisco Router, Dynamic Routing, EIGRP, IPv6, MD5, pcap, ProfiShark, Profitap, WiresharkJohannes Weber

And again: Here comes a pcapng capture taken for the dynamic routing protocol EIGRP. If you want to dig into EIGRP messages, download the trace file and browse around it with Wireshark. Since I used both Internet Protocols (IPv6 and legacy IP), MD5 authentication, route redistribution, etc., you can find many different messages in it.

Continue reading EIGRP Capture →

Dual-Stack EIGRP Lab

2018-10-24Authentication, Cisco Systems, IPv6, RoutingAuthentication, CCNP, Cisco Router, Dynamic Routing, EIGRP, IPv6, key-chain, MD5, Redistribution, SummarizationJohannes Weber

Yet another routing protocol I played with in my lab. ;) This time: EIGRP, Enhanced Interior Gateway Routing Protocol, the ~~proprietary~~ distance-vector routing protocol developed by Cisco, which is now public available (RFC 7868). However, no third-party products in here but only Cisco routers. I am using named EIGRP for both Internet Protocols, IPv6 and legacy IP, along with MD5 authentication and redistribution from OSPF.

Continue reading Dual-Stack EIGRP Lab →

OSPFv3 with IPsec Authentication

2018-10-19Authentication, Cisco Systems, IPsec/VPN, IPv6, RoutingAH, Authentication, CCNP, Cisco Router, Dynamic Routing, IPsec, IPv6, OSPFv3, pcap, ProfiShark, Profitap, Redistribution, Security Association, SHA-1, Summarization, WiresharkJohannes Weber

Here comes a small lab consisting of three Cisco routers in which I used OSPFv3 for IPv6 with IPsec authentication. I am listing the configuration commands and some show commands. Furthermore, I am publishing a pcapng file so that you can have a look at it with Wireshark by yourself.

Continue reading OSPFv3 with IPsec Authentication →

OSPFv2 Capture

2018-10-11Authentication, Cisco Systems, RoutingAuthentication, CCNP, Cisco Router, Dynamic Routing, MD5, OSPF, pcap, ProfiShark, Profitap, Redistribution, SummarizationJohannes Weber

I already had an OSPFv2 for IPv4 lab on my blog. However, I missed capturing a pcap file in order to publish it. So, here it is. Feel free to have a look at another small lab with three Cisco routers and OSPFv2. Just another pcapng file to practise some protocol and Wireshark skills.

Continue reading OSPFv2 Capture →

MP-BGP Capture

2018-10-03IPv6, RoutingAuthentication, BGP, CCNP, Cisco Router, Dynamic Routing, Follow TCP Stream, FortiGate, Fortinet, IPv6, MD5, MP-BGP, Palo Alto Networks, pcap, WiresharkJohannes Weber

For those who are interested in analyzing basic BGP messages: I have a trace file for you. ;) It consists of two session establishments as I cleared the complete BGP session on two involved routers for it. Refer to my previous blog post for details about the lab, that is: MP-BGP with IPv6 and legacy IP, neighbouring via both protocols as well, with and without password. The involved routers were 2x Cisco routers, one Palo Alto Networks firewall, and one Fortinet FortiGate firewall.

Continue reading MP-BGP Capture →

Basic MP-BGP Lab: Cisco Router, Palo Alto, Fortinet

2018-09-24Authentication, Cisco Systems, Fortinet, IPv6, Palo Alto Networks, RoutingAuthentication, BGP, CCNP, Cisco Router, Dynamic Routing, FortiGate, Fortinet, IPv6, Loopback, MD5, MP-BGP, Palo Alto Networks, Password, RedistributionJohannes Weber

While playing around in my lab learning BGP I configured iBGP with Multiprotocol Extensions (exchanging routing information for IPv6 and legacy IP) between two Cisco routers, a Palo Alto Networks firewall, and a Fortinet FortiGate firewall. Following are all configuration steps from their GUI (Palo) as well as their CLIs (Cisco, Fortinet). It’s just a “basic” lab because I did not configure any possible parameter such as local preference or MED but left almost all to its defaults, except neighboring from loopbacks, password authentication and next-hop-self.

Continue reading Basic MP-BGP Lab: Cisco Router, Palo Alto, Fortinet →

Passwords vs. Private Keys

2018-08-01Authentication, Crypto, Password, SSHAuthentication, Brute-Force, Certificate, Crypto, Entropy, IPsec, Login, Password, Pre-Shared Key, PSK, Public KeyJohannes Weber

It is widely believed that public/private keys or certificates are “more secure” than passwords. E.g., an SSH login via key rather than using a password. Or a site-to-site VPN with certificate authentication rather than a pre-shared key (PSK). However, even certificates and private keys are not unlimited secure. They can be compromised, too, since the public-key cryptography only implies that private keys won’t be exposed if a brute-force attack is nearly impossible.

So, what’s the real security level of passwords compared to public keys/certificates?

Continue reading Passwords vs. Private Keys →

Lastline SSH Key-Based Authentication for “monitoring” User

2017-03-16Authentication, Lastline, SSHAuthentication, Key-Based Authentication, Lastline, SSHJohannes Weber

If you are using a Lastline device (Manager, Engine, Sensor or Pinbox) you can reach the machine via SSH after you activated it via monitoring_user_password . However, per default this uses only a password for authentication. If you want to use the key-based authentication for this “monitoring” user account you can add the public key to the authorized_keys file for that user.

This is a small record on how to add a public key to the Lastline device. However, it is quite general since the Lastline appliance is built upon a standard Ubuntu server.

Continue reading Lastline SSH Key-Based Authentication for “monitoring” User →

SSHFP: Authenticate SSH Fingerprints via DNSSEC

2016-11-01Authentication, DNS/DNSSEC, SSH, Tutorial/HowtoAuthentication, BIND, DNSSEC, Fingerprint, Hash, Man-in-the-Middle, PuTTY, SSH, ssh-keygen, SSHFPJohannes Weber

This is really cool. After DNSSEC is used to sign a complete zone, SSH connections can be authenticated via checking the SSH fingerprint against the SSHFP resource record on the DNS server. With this way, administrators will never get the well-known “The authenticity of host ‘xyz’ can’t be established.” message again. Here we go:

Continue reading SSHFP: Authenticate SSH Fingerprints via DNSSEC →

FTP Proxy Authentication Format “Check Point”

2014-01-13Authentication, Network, TemplateAuthentication, Check Point, Cisco WSA, FileZilla, FTP, ProxyJohannes Weber

Short memo: This is the FTP proxy authentication format of “Check Point” for the FileZilla FTP Client. I needed it for my Cisco WSA (Web Security Appliance) laboratory in the case of an enabled proxy authentication.

1 2	USER %u@%s@%h PASS %p@%w

Continue reading FTP Proxy Authentication Format “Check Point” →

Weberblog.net

IT-Security, Networks, IPv6, VPN, DNSSEC, NTP