From: Matthew MacAulay (matthew.macaulay@cobweb.co.uk)
Date: Fri Aug 19 2005 - 09:51:12 EDT
Hello,
In addition to Ola and Volker suggestions.
You could pass the syslog message of the Nokia boxes to an IDS box to
alert to any valid or non valid log attempts. www.prelude-ids.org is
fairly simple to setup. At least this would give you a log independent
of the Nokia boxes for log on's valid or not.
But as Ola suggested locking down where ssh and https can initiate
connection to the Nokia boxes should be done first. I normally have
these rules (management rules) defined as the first couple followed by
an any any drop (to the FW them selves) so no connections can be made to
the firewalls directly for non allowed services or source of connection.
I also don't allow access to manage the firewalls from a remote
location. Risky but I have some fault tolerance built it...
If you have the facility to tap into the external traffic you could pass
it to Snort and look for ssh connection attempts. Again Prelude provides
a nice front end. (Prewikka) But that is prob a bit OTT.
Regards,
Mat.
-----Original Message-----
From: Volker Tanger [mailto:vtlists@wyae.de]
Sent: 18 August 2005 22:56
To: pen-test@securityfocus.com
Subject: Re: IPSO/Secure Platform audit
Greetings!
On Thu, 18 Aug 2005 13:00:50 +0100
Dan Rogers <pentestguy@gmail.com> wrote:
> I'm currently reviewing a Check point/Nokia box and a Secure Platform
> manager. The settings in Voyager are all good, and likewise the Web
> GUI of the SPLAT manager is fine, they're both patched and the policy
> is also clean - but I want to ensure the o/s themselves are ok.
I assume you already checked the rulebase e.g. for SSH-Allow from
outside and VPN- or SecureClient rules, did you?
Unless you have the possibility to check that all binaries (esp. SSH and
other listening servers) are 100% genuine there is no way to ensure
that. IPSO and SPLAT are just plain BSD and Linux after all, so creating
custom binaries is not that much of a problem.
> I am concerned that a previous administrator may have left himself
> access by the back-door somehow - but am not in a position to rebuild
> them to be sure. What else would you lot check for?
Are you *concerned* or do you have no reason to worry and just do "a
proper handover". If you have reason to torry, you really should do a
reinstall and do a thorough audit of the ruleset.
If management does not allow that, let them give you that order in
writing ("We have received your warning of DATE about a possible
compromise of the firewall system(s) by the former administrator NAME,
but decided against your proposal...") to cover your butt.
Bye
Volker
-- Volker Tanger http://www.wyae.de/volker.tanger/ -------------------------------------------------- vtlists@wyae.de PGP Fingerprint 378A 7DA7 4F20 C2F3 5BCC 8340 7424 6122 BB83 B8CB ------------------------------------------------------------------------ ------ FREE WHITE PAPER - Wireless LAN Security: What Hackers Know That You Don't Learn the hacker's secrets that compromise wireless LANs. Secure your WLAN by understanding these threats, available hacking tools and proven countermeasures. Defend your WLAN against man-in-the-Middle attacks and session hijacking, denial-of-service, rogue access points, identity thefts and MAC spoofing. Request your complimentary white paper at: http://www.securityfocus.com/sponsor/AirDefense_pen-test_050801 ------------------------------------------------------------------------ ------- ---------------------------------------------------------------- The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you have received this communication in error please return it to the sender, then delete and destroy any copies of it. ---------------------------------------------------------------- ------------------------------------------------------------------------------ FREE WHITE PAPER - Wireless LAN Security: What Hackers Know That You Don't Learn the hacker's secrets that compromise wireless LANs. Secure your WLAN by understanding these threats, available hacking tools and proven countermeasures. Defend your WLAN against man-in-the-Middle attacks and session hijacking, denial-of-service, rogue access points, identity thefts and MAC spoofing. Request your complimentary white paper at: http://www.securityfocus.com/sponsor/AirDefense_pen-test_050801 -------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:45 EDT