Thursday, January 31, 2008

NFS howto with static ports

First I'm going to edit the /etc/sysconfig/nfs to specify the ports I want to run on.

STATD_PORT=4000
STATD_OUTGOING_PORT=4004

LOCKD_TCPPORT=4001
LOCKD_UDPPORT=4001
MOUNTD_PORT=4002


Next I want to edit the /etc/hosts.allow to only allow specific hosts to access the resource.

nfs:192.168.1.

Finally lets allow some stuff to come in through our IP tables rules at /etc/sysconfig/iptables

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 137:139 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 4000:4004 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 55443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-port-unreachable
COMMIT

Labels: ,

posted by Stephen Reese at 0 Comments

Wednesday, October 03, 2007

Digital Forensic Tools

Here is a small list of tools I have used at least once for various data analysis and carving.

Norton's Diskedit - Pretty old school but it still sometimes useful.
eRunt
BinText
PEiD
regshot
procmon
tepview
OllyDbg
import REConstructor 1.6
HxD - Hex editor that works quite well.
FTK Forenic Tool Kit, Registry Viewer & Imager
X-Ways Forenics and WinHex
Alien Registry Viewer
Advanced ZIP Password Recovery
Nessus
Process Monitor & Explorer
rawwritewin
WinMD5
Sleuthkit & Autopsy
Foremost
xxd makes hex dumps on linux/unix systems
dd (built into most linux/unix distributions)
dcfldd
VmWare Workstation or Server
Wireshark
MANDIANT Web Historian
Nessus Network Scanner
Easy Recovery Professional

Useful online tools:
http://www.virustotal.com/
http://www.cwsandbox.org/?page=home

Labels: ,

posted by Stephen Reese at 0 Comments

Thursday, February 08, 2007

Running Terminal Server on Windows 2003 Server

Vista has been a great Operating System so far but there are still a large number of software vendors who were not prepared for the OS. A number of statistical software packages are at this point not supported so I decided to implement a Terminal Server for users to access. The terminal server is not being deployed only as a quick fix to manufacturers short comings in software development. I have made the server available on a VPN for users to work from home where they don't have access to applications that cost thousands of dollars. Maintenance, licensing, and performance are some of the other benefits.



The first trick to setting up the terminal server was licensing. Since we are not running a cluster of terminal servers the license model was simple. I was able to set the terminal server to be a license server for its self which saved me from having to setup another machine to be a license server. Next was a journey over to cdwg.com to purchase some terminal server licenses. When setting up the server there are two license modes, per device and per user. I went with per user because I wanted several hundred users to be able to login without having several hundred licenses.



Next was to setup security on the server so that only the groups I wanted would be able to login. Group policy's were also implemented so that folder redirection and additional security features could be employed. The users must login through a vpn from remote locations though with most of our users have fast Internet connections so the vpn didn't really affect speed much. Documentation was the final product to be constructed. As with any documentation I have gotten feedback to help write enough information so that all of the users are able to be instructed how to connect to our server and run applications remotely.

Labels:

posted by Stephen Reese at 0 Comments

Using an Email address for AIM (Instant Messenger)

FYI

For those who are using some whack screen name from forever ago (as I was) you can cruise over to aim.com and register your email address to contact your friends. This will probably be more respectful in the work place then your current screen name of 'wildchild69' or something else along those lines.

Labels:

posted by Stephen Reese at 0 Comments

Monday, December 11, 2006

Microsoft Vista and Office 2007 - Initial Review

I recently got my hands on a copy of Microsoft’s latest offering in the form of desktop software, Vista and Office 2007. I have also acquired some new 64 bit Core 2 Duo Dell computers in order to test the new software for deployment though I have also been testing the new offerings on older hardware in order to determine which machines will need to be depreciated in the next year or two.



First I went ahead installed Office 2007 on my Windows XP desktop. As with most Office installs I was able to customize an install file so that I can skip on the license agreements, serial number and all of the other annoying stuff. I’m pretty impressed overall with the office install. The look of Office has been improved to use a ‘ribbon’ interface which is to improve productivity. Many users have already had issues using the “Office Button” which incorporates many of the functions that “file” button previously did. This is a common hang up with major releases from a software vendor; end-users will have to take time to become acclimated with the new functions. A trick feature I just picked up on recently was just hitting the “alt” key will highlight the shortcut’s to all of the current functions on the “ribbon” toolbar.



Vista was next on the list for testing. From the start I figured the install would be large since we had to rip the ISO image to a DVD. We started off with a 1.8 AMD with 512 MB of system memory. I knew running a video card with 64 MB of memory would limit the operating systems’ capability graphics wise but I needed a real world baseline in which Vista could run without aggrevating end-users with slowly responding applications. The install was very simple although I did provide a answer file so I wouldn’t have to bother with serial numbers and whatnot. Once Vista was up and running I was happy with the performance overall for the base install. Next I added a beta version of McAfee antivirus for Vista, Office 2007, and some statistical software such as SAS, Gams, Guass, and Limdep. The machine did slowdown somewhat mainly due to background services and the lack of memory didn’t help things much but this did give me a baseline for which machines would be able to handle Vista performance wise.



Next was the 64 bit Vista install on 2.4 GHz Core 2 Duo chips, 1 gigabyte of memory, and 512 MB of video memory. These machines are amazing, Vista of course allows for the full blown user interface including Aero which provides for some pretty cool eye candy. I was able to load this machine down and it wasn’t phased at all. For a $1000 dollars (not including monitor) these machines are going to be the way to go for user’s that want the full Vista experience.



The final test to make Vista useable was to add it to the domain. I was able to add the machines to the domain without a hiccup. Setting up Outlook with the Exchange server was even easier since it picked up the domain credentials from the currently logged in user. That is where the fun ended. Vista employs User Access Controls (UAC) so the domain policy’s made software installation rather annoying at least. The lab computers were even worse because we log users in as guests so profiles are not stored eating up drive space. Vista applies the group policies to all accounts, even accounts that are not on the domain so the only fix was to move a computer out of the organizational unit (OU) before installing software so the restrictions aren’t there and then moving it back in when done.



In summary I am impressed with Vista (with the right hardware) but have a lot of tooling to do in order to find all of the benefits. I figure a desktop computer with a 2 GHz processor, 512 Mb system memory, and 128 Mb video memory should be the baseline for us.

Labels: ,

posted by Stephen Reese at 0 Comments

Thursday, October 19, 2006

IE (Internet Explorer) 7 Released

Microsoft's latest and *greatest* browser IE 7 has been released. Several people I know have been running beta versions of the software for some time but I'm not a big fan of running beta software in a production environment.



Upon initial review of the browser it seems like a rip off from the Mozilla Firefox browser that has been out for a while but digging deeper reveals some pretty trick features. Tabbed windows have been added to minimize the number of windows that need to be open on a desktop which is a huge plus for single screen systems (I have three monitors on my computer at work =). A search function has been added but your not stuck with Microsoft/msn's search. From the start you may select a multitude of other search providers including the almighty Google search engine. You may add multiple search providers also allowing you to search from any page which is a nice feature and will eventually allow smaller sites to drop ugly search boxes altogether. Site maintainers such as myself can use opensearch functionality so users may search a site's content from the search bar using google or several other providers but I would imagine it's going to take some time for end users to become accustomed to this new feature.



Microsoft's new browser also allows for adding various syndicated feeds directly to it's browser almost eliminating the need for 3rd party rss readers. Usability features have been added such as auto magnification of text on pages that need it. An anti-phishing feature has been added though I have already shut this sucker off because it was just slightly annoying in my opinion. Other security features have been added but I will leave it up to you if you want to learn more about that kind of geek stuff.

Labels: ,

posted by Stephen Reese at 0 Comments

Monday, February 20, 2006

Pod Slurping!

A article on CNET describes how Abe Usher has written an application that can be loaded on a IPOD to steal sensitive information from a corporate network. The process works by scanning the network and grabbing document files such as acrobat and word files.

Labels: , ,

posted by Stephen Reese at 0 Comments