Cisco PIX Firewall Config 1 - GNS3 LAB

New to PIX Firewall, so these are Elementary LABS.

LAB 1.001

I have made a LAB using GNS3 and PIX 8.02

My setup is below:

LAN ---- ETHERNET ---- PIX ------------- OUTSIDE NETWORK

and here's my config, incase I need it.


pixfirewall# sh run
: Saved
:
PIX Version 8.0(2)
!
hostname pixfirewall
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0
nameif inside
security-level 100
ip address 192.168.254.254 255.255.255.0
!
interface Ethernet1
nameif outside
security-level 0
ip address 192.200.200.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list in_nameif_outside remark "This is acl going in to outside interface"
access-list in_nameif_outside extended permit icmp any any echo
access-list in_nameif_outside extended permit icmp any any echo-reply
access-list in_nameif_outside extended permit icmp any any time-exceeded
pager lines 24
logging enable
logging buffered informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.254.0 255.255.255.0 tcp 4000 0
access-group in_nameif_outside in interface outside
route outside 192.100.100.0 255.255.255.0 192.200.200.2 1
route outside 192.168.100.0 255.255.255.0 192.200.200.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
ssl encryption rc4-sha1
prompt hostname context
Cryptochecksum:162b16acec82534b3fab51c345340f06
: end
pixfirewall#



My PC loopback address is 192.168.254.1

I have an ip address outside which is 192.100.100.1

On my pc, I made a static route for the following address


route add 192.100.100.0 mask 255.255.255.0 192.168.254.254

and

route add 192.200.200.0 mask 255.255.255.0 192.168.254.254


This way, I can ping thus IP on GNS3 LAB


Pinging 192.200.200.2 with 32 bytes of data:

Reply from 192.200.200.2: bytes=32 time=11ms TTL=255
Reply from 192.200.200.2: bytes=32 time=10ms TTL=255
Reply from 192.200.200.2: bytes=32 time=10ms TTL=255
Reply from 192.200.200.2: bytes=32 time=10ms TTL=255

Ping statistics for 192.200.200.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 10ms, Maximum = 11ms, Average = 10ms

and

Pinging 192.100.100.1 with 32 bytes of data:

Reply from 192.100.100.1: bytes=32 time=13ms TTL=255
Reply from 192.100.100.1: bytes=32 time=12ms TTL=255
Reply from 192.100.100.1: bytes=32 time=12ms TTL=255
Reply from 192.100.100.1: bytes=32 time=12ms TTL=255

Ping statistics for 192.100.100.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 12ms, Maximum = 13ms, Average = 12ms


and can even telnet on the router at LAB behind PIX with ip 192.100.100.1

more later...

Horde config on setting default identity mail domain

Horde Config not to forget

- I want to have my default email domain inplace, so that when I login, then create an email, I have automatically a from of user@mydomain.com on my Identity.

Files need to edit.

{horde-root-dir}/imp/config/servers.php

Orig entry of horde-webmail-1.1.1, assuming you only have a singe domain


$servers['_prompt'] = array(
'name' => _("Choose a mail server:")
);

/* Example configurations: */


$servers['imap'] = array(
'name' => 'IMAP Server',
'server' => 'localhost',
'hordeauth' => false,
'protocol' => 'imap/notls',
'port' => 143,
);



and here's the entry with quota monitor

$servers['imap'] = array(
'name' => 'IMAP Server',
'server' => 'localhost',
'hordeauth' => false,
'protocol' => 'imap/notls',
'port' => 143,
'folders' => '',
'namespace' => '',
'maildomain' => 'mydomain.com', //change this to whatever your domain is
'smtphost' => 'localhost',
'smtpport' => 25,
'realm' => '',
'preferred' => '',
'quota' => array(
'driver' => 'command',
'params' => array(
'host' => 'localhost',
'port' => 12345
)
),
'dotfiles' => false,
'hierarchies' => array()
);


Need to Edit the only Allowed programs via GP

I encountered a problem today, I need to allow msimn.exe (exe of Outlook Express) as it is being needed by the web applications that we used on the operations. ( Its a call center, yeah)

It was by default denied to be accessed by a certain team or groups. It took me an hour to search, find at Group Policy Properties. Wow, so here, I'll leave a mark here for next time. Server is Windows 2003 and Clients are Windows XP.

Process is..

Open Active Directory Users and Computers on the Administrative Tools

-> Click on the Particular OU and Right Click on it and Select Properties
-> Group Policy
-> Click Edit a Particular Group Policy
-> User Configuratoin
-> Administrative Templates
-> Systems
-> Then Double Click on Don't Run Specified Windows Applications
-> If the specific exe file has been listed there, remove it.
-> If Run Only Allowed Windows Applications has been enabled, then make sure that it's been added on its list of Exe files.


And DOnt forget to Run gpupdate, let the user to re-login.


Wow, its a microsoft windows.

Limiting access to your Linux Machine via PAM

I need to limit access to some of services on my Linux box. I'm going to do it via PAM.
I'm using CentOS, so PAM I think installed by default. if not, yum install pam should do.

Limiting SSH Users. Since I have hundreds of users on this box.
>You should be able to edit /etc/pam.d/sshd (meaning, you should be root here). Below is the original file.

#%PAM-1.0
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
session required pam_loginuid.so

then just append the line below on that file.

#%PAM-1.0
auth required pam_listfile.so item=user sense=allow file=/etc/listfile/sshusers onerr=fail

Note: the /etc/listfile/sshusers is the file that contains the users list, those whom allowed to access ssh service on the host machine.

If you cant avoid to use telnet service. then append the entry below:

auth required pam_listfile.so item=user sense=allow file=/etc/listfile/loginusers onerr=fail

to the /etc/pam.d/remote file, which the original contents are below:

auth required pam_securetty.so
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_stack.so service=system-auth
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should be the last session rule
session required pam_selinux.so open

and as usual, the file

/etc/listfile/loginusers

are the ones allowed.

As so with other service, its almost the same entry that you should add, just on different file for different service.

Just to remember when doing it again....

IPTABLES script used for chillispot

Got here a backup of iptables for chillispot. Also included and allowed acces to tftp port



#!/bin/bash
IPTABLES="/sbin/iptables"
EXTIF="eth0"
INTIF="eth1"

#Flush all rules
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle

#Set default behaviour
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

#Allow related and established on all interfaces (input)
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 20 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 69 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp --dport 69 -j ACCEPT


#Allow releated, established and ssh on $EXTIF. Reject everything else.
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 1812 --syn -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p tcp -m tcp --dport 1813 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -i eth0 -p udp -m udp --dport 1813 -j ACCEPT

$IPTABLES -A INPUT -i $EXTIF -j REJECT

#Allow related and established from $INTIF. Drop everything else.
$IPTABLES -A INPUT -i $INTIF -j DROP

#Allow http and https on other interfaces (input).
#This is only needed if authentication server is on same server as chilli
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT

#Allow 3990 on other interfaces (input).
$IPTABLES -A INPUT -p tcp -m tcp --dport 3990 --syn -j ACCEPT

#Allow ICMP echo on other interfaces (input).
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#Allow everything on loopback interface.
#$IPTABLES -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG

$IPTABLES -A INPUT -i lo -j ACCEPT

# Drop everything to and from $INTIF (forward)
# This means that access points can only be managed from ChilliSpot
$IPTABLES -A FORWARD -p TCP --sport 80 -i $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -j DROP
$IPTABLES -A FORWARD -o $INTIF -j DROP

#Enable NAT on output device
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE


Installing Horde Webmail on CENTOS

My configurations used on the Horde Webmail I set up on Centos 4.5

Minimum requirement for the Horde to Work.

-LAMP + Pear

Pear packages at least installed.


Package Version State
Archive_Tar 1.3.2 stable
Auth 1.5.4 stable
Console_Getopt 1.2.3 stable
DB 1.7.12 stable
File 1.3.0 stable
Log 1.9.11 stable
Net_FTP 1.3.2 stable
Net_SMTP 1.2.10 stable
Net_Socket 1.0.8 stable
PEAR 1.6.2 stable
Structures_Graph 1.0.2 stable
XML_Parser 1.2.8 stable
XML_RPC 1.5.1 stable

PHP Packages Installed (of course, these are on my system)


PHP Packages installed:
php-5.1.6-3.el4s1.7
php-mcrypt-5.1.6-1.el4.centos
php-pdo-5.1.6-3.el4s1.7
php-imap-5.1.6-3.el4s1.7
php-cli-5.1.6-3.el4s1.7
php-pear-1.4.11-1.el4s1.1
php-ldap-5.1.6-3.el4s1.7
php-mysql-5.1.6-3.el4s1.7
php-xml-5.1.6-3.el4s1.7
php-common-5.1.6-3.el4s1.7
php-eaccelerator-5.1.6_0.9.5-1.el4.centos


Of course, the latest Horde which can be downloaded from Horde Website



Below are the changes on Horde configurations files to fit the need:

1. To enable the Vacation, Forward, and Password (Change Password) on the menu account. Need to change some entries at config/registry.php file. See below for some changes.


for the Password to appear at My Account menu.

$this->applications['passwd'] = array(
'fileroot' => dirname(__FILE__) . '/../passwd',
'webroot' => $this->applications['horde']['webroot'] . '/passwd',
'name' => _("Password"),
'status' => 'active',
'menu_parent' => 'myaccount'

For Vacation...

$this->applications['vacation'] = array(
'fileroot' => dirname(__FILE__) . '/../vacation',
'webroot' => $this->applications['horde']['webroot'] . '/vacation',
'name' => _("Vacation"),
'status' => 'active',
'provides' => 'vacation',
'menu_parent' => 'myaccount'

and for the Forward...

$this->applications['forwards'] = array(
'fileroot' => dirname(__FILE__) . '/../forwards',
'webroot' => $this->applications['horde']['webroot'] . '/forwards',
'name' => _("Forwards"),
'status' => 'active',
'provides' => 'forwards',
'menu_parent' => 'myaccount',

Note1: For those to work, the ff: modules should be present:

Forward
Password
Accounts
Vacation

Note2: For the Vacation module, an ftp server should be installed on the Host running the mail server.


Note3: For the Password module, if using the system account, poppassd should be installed as requirement.

----To be continued...

Linux

Linux is just great.