Switch to Router-on-a-Stick Communication

In January I described how I configured my Cisco 2651XM router to pass traffic between two VLANs on my Cisco 2950T-24 switch. I never assigned an IP for management purposes to the switch, since I always reached it via console cable. Today I decided to try upgrading the switch IOS, but that required applying a management IP to the switch.

My router had this configuration on the interface facing the switch:

interface FastEthernet0/1
 description Connection to gruden, Cisco switch
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/1.1
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
!
interface FastEthernet0/1.2
 encapsulation dot1Q 20
 ip address 172.27.20.1 255.255.255.0

I assumed that if I assigned a management IP to my switch with either a 10.10.10.0/24 or 172.27.20.0/24 address, the switch would be able to speak to the router. I assigned 10.10.10.100/24 to the switch. Because switches do not receive IPs on individual ports, I applied the IP to VLAN 1:

gruden(config)#int vlan1
gruden(config-if)#ip address 10.10.10.100 255.255.255.0
gruden(config-if)#no shutdown
gruden(config-if)#exit
gruden(config)#ip default-gateway 10.10.10.1
gruden(config-if)#end

Unfortunately, this did not work. I could not reach the router from the switch and vice-versa.

I decided to try assigned a new IP address directly to router interface fa0/1, and give the switch an IP in the same netblock:

gill(config)#int fa0/1
gill(config-if)#ip address 192.168.168.1 255.255.255.0
gill(config-if)#no shutdown 
gill(config-if)#end

Here's how I configured the switch:

gruden(config)#int vlan1
gruden(config-if)#ip address 192.168.168.2 255.255.255.0
gruden(config-if)#no shutdown
gruden(config-if)#exit
gruden(config)#ip default-gateway 192.168.168.1
gruden(config-if)#end

That did it. Now I can reach both devices. Apparently the switch can only communicate with the router when the address on the switch is outside of the VLANs in use. I believe Todd Lammle refers to this sort of setup as a management overlay network, where certain IPs are used solely for device management.

If anyone can comment on this design or suggest an alternative, I welcome feedback. I think the wrinkle in my setup involves the router having to pass traffic between VLANs 10 and 20.

Read More

Review of Cisco Routers for the Desperate Posted

Amazon.com just posted my four star review of Cisco Routers for the Desperate. From the review:

"Cisco Routers for the Desperate (CRFTD) is the book Cisco should package with their routers -- assuming author Michael Lucas makes a few tweaks. I've always been amazed by Michael's uncanny ability to include details that matter to administrators, especially in his earlier books Absolute BSD and Absolute OpenBSD. CRFTD is no exception; the book is chock full of life-saving Cisco tips. I suggest you buy one to keep by your router, just as the author recommends."

Michael's book is the reason I decided to replace telnet with SSH on my router per the earlier blog entry.

Read More

Using SSH version 2 on Cisco Routers

My CCNA class did not cover this, but I think it is important to enable SSH version 2 on Cisco gear that supports it. You can use the Cisco Software Advisor to find IOS images that support the Secure Shell Server version 2 feature. Once you have an appropriate image loaded, follow these instructions to get your SSH v2 server running. Here's what I did:

gill(config)#hostname gill
gill(config)#ip domain-name taosecurity.com
gill(config)#crypto key generate rsa
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys ...[OK]
gill(config)#ip ssh time-out 60
gill(config)#ip ssh authentication-retries 3
gill(config)#ip ssh version 2
gill(config-line)#login local
gill(config-line)#transport input ssh
gill(config-line)#exit
gill(config)#username me privilege 15 password mypassword
gill(config)#end

Here are a few notes. First, choose a key bigger than 512 bits. When I tried this the first time and accepted the default, I got this error message from my FreeBSD OpenSSH client:

ssh_rsa_verify: RSA modulus too small: 512 < minimum 768 bits
key_verify failed for server_host_key

Second, you'll see I specified 'login local'. This means I have to create a user (here, 'me') to allow connection to the SSH daemon. If I just said 'login', I'd have to enter the console password.

Third, I did not really need to specify a hostname in this example, since it was already set. I did so to show how to do it.

Last, Cisco's documentation recommends 'ip ssh timeout 60' when the real syntax is 'ip ssh time-out 60'.

I recommend running SSH v2 as SSH v1 is susceptible to various attacks.

When you connect to the server, your client will see this:

debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: no match: Cisco-1.25
debug1: Enabling compatibility mode for protocol 2.0

On the router, try the 'show ssh' command to see active sessions:

gill#sh ssh
Connection Version Mode Encryption  Hmac         State                 Username
0          2.0     IN   aes128-cbc  hmac-md5     Session started       me
0          2.0     OUT  aes128-cbc  hmac-md5     Session started       me
%No SSHv1 server connections running.

Read More

Pre-Reviews: On Bejtlich's Bookshelf, Part II

Last month I provided brief descriptions of books in my possession that I'm definitely planning to read and review at Amazon.com. This morning I'd like to mention books I use as references, but will not review. I only review books that I read, and at the moment I don't plan to read these books cover-to-cover. I do want to give credit to publishers who made many of these titles available by letting you know that they appear to be good books.

Since I'm studying for my CCNA certification, I decided to start this blog entry with Cisco Field Manual: Router Configuration by David Hucaby and Steve McQuarry, published by Cisco Press. This is an older book published in late 2001 which uses IOS 12.2 as its reference version. I like this book because each chapter covers topics which face router admins, like security, or access lists, or QoS. The chapter then walks the reader through commands and examples. Although IOS is a beast, the book seems to cover most of the commands normal admins would encounter.

The natural companion to a router book is Cisco Field Manual: Switch Configuration by David Hucaby and Steve McQuarry, published by Cisco Press. This book is slightly newer, published in late 2002. It uses both IOS 12.2 and CatOS 7.2, as was found in older Catalyst 6500 switches, for example. I like this book for the same reasons I liked its router counterpart -- rational organziation and plenty of examples.

Continuing with our networking theme we come to Computer Networks, 4th Ed by Andrew S. Tanenbaum, published by Prentice Hall PTR. I really liked his Modern Operating Systems, 2nd Ed which got mixed reviews at Amazon.com. I like to use this book to check details of TCP features or related protocol issues. I don't plan to read this book cover-to-cover as it addresses too many familiar topics, so I just look at sections of interest.

I transition now from networking to operating systems. My next book is Introducing Microsoft Windows Server 2003 by Jerry Honeycutt, published by Microsoft Press. Why would I have this book in my possession? First, I don't plan to read it. Second, I got it free from Microsoft as part of some past promotion. Third -- and the best reason -- it ships with a 180-day trial version of Windows Server 2003. I have used this software to test Windows Server 2003 in my lab, so that makes having the book worthwhile. As a book, it's just a product overview; you won't find any configuration syntax, only lists of features.

This book has clearly been on my bookshelf for a while, since Solaris 10 is now available. Solaris 8: The Complete Reference was written by Sriranga Veeraraghavan and Paul Watters, and published by McGraw-Hill/Osborne. I got this book to help me administer an UltraSparc 30 in my lab. It's running Solaris 8 now, which is not uncommon in the computing industry. This book and its later editions have been somewhat slammed by Amazon.com reviewers. I believe a book advertised as a "complete reference" creates high expectations. Don't despair, however...

Amazon.com reviewers universally like Solaris Operating Environment Boot Camp by David Rhodes and Dominic Butler, published by Prentice Hall PTR. This book appeared in late 2002, but it covers Solaris 8 and 9. This book seems very thorough, and it doesn't waste time showing screen shots of CDE sessions or other material irrelevant to server use. I do not see a Solaris 10 version in production. Solaris 10 has enough new features to warrant a new edition.

Our system administration journey continues with AIX 5L Administration by Randal Michael, published by McGraw-Hill/Osborne. The latest AIX version is 5.3. The book uses AIX 5.1 and mentions 4.3.3 as well. My 7043-150 IBM RS/6000 Model 150 375 MHz RISC workstation runs AIX 5.1, which seems common in the industry. This book is one of the few available on AIX. I don't see much future in AIX, with the support IBM is giving to Linux. The lack of new books on AIX reflects this situation.

Continuing with the dying OS theme we come to HP-UX 11i Systems Administration Handbook and Toolkit, 2nd Edition by Marty Poniatowski, published by Prentice Hall PTR. I got this book to help administer my HP Visualize B2000 400 MHz PA-RISC workstation. Prentice Hall has continued to publish books on HP-UX, with titles on internals, tuning, and performance. This book contains a lot of material, including a removable tip cheat and a CD-ROM with tools and additional documentation. I'm not confident in HP-UX's future, especially given the turmoil at HP.

We now transition briefly to books on hardware with Upgrading and Repairing PCs, 16th Ed by Scott Mueller, published by Que. I actually don't have this edition; the 15th is on my bookshelf. Scott has sold over 2 million of these titles, which is absolutely staggering. The book is definitely worth it. I've used it to troubleshoot hardware issues, select products, and understand disk details in forensic cases. If you like to tinker with computers, you'll love just thumbing through this book and stopping where you find an interesting detail. The book ships with a DVD that has video of Scott explaining certain hardware tasks, plus chapters that didn't make the print cut. Every computer shop should have a copy of this book. My only complaint is the book is very Microsoft-centric when operating systems are mentioned.

In late 2003 Que published the first edition of Scott Mueller's Upgrading and Repairing Laptops. It ships with a CD-ROM of tools and video like the DVD in the PC book. Some people criticized the laptop book for duplicating material in the PC book. I think Scott's only alternative would have been to publish a "laptop addendum" to accompany his PC book, which is clumsy.

Browsing Amazon.com I see that the first edition of Upgrading and Repairing Servers should arrive this summer. I am looking forward to this new book since the description references Sun servers. That indicates Scott is branching beyond the Microsoft world. However, later this summer we should also see Upgrading and Repairing Microsoft Windows, so it appears Scott is being dragged back to Microsoft land!

Leaving the hardware world we come to The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, 2nd Ed by Ronald L. Krutz and Russell Dean Vines, published by Wiley. I used an earlier version of this book to pass my CISSP test in late 2001. This book was published in early 2004. If I ever need to take the test again, or if you are experienced and need a quick refresher, I would probably try the CISSP Practice Questions Exam Cram 2 by Michael C. Gregg. I have not seen that book, but I referenced the earlier Exam Cram the night before my CISSP test.

Continuing our security theme we arrive at Internet Site Security by Erik Schetina, Ken Green, Jacob Carlson, published by Addision-Wesley. I referenced this title in my first book, calling it a good "security 101" book. It was published in 2002 but it still remains relevant. I use it to lead my Digital Security Weapons and Tactics Amazon.com Listmania List. There may be other introductions to security available, but I like this book's concise form and its sound explanations.

At the other end of the security spectrum we have Matt Bishop's magnum opus Computer Security: Art and Science, published by Addison-Wesley. This is a classic textbook if I have ever seen one. This book is nothing like the security texts you're used to reading, like Hacking Exposed. I recommend this book if you are a graduate student or you are pursuing your PhD. I plan to read it before pursuing an advanced security degree, but not before! There is a "lite" version of this book called Introduction to Computer Security that is supposed to be less math-intensive.

If you need to know about open source firewalls, try Troubleshooting Linux Firewalls by Michael Shinn and Scott Shinn, published by Addison-Wesley. This book uses Red Hat Linux and SuSE as its reference platforms. This seems like a very niche book, as it focuses on troubleshooting netfiler/iptables. In case you want to know what those terms mean:

"netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.

iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists out of a number of classifiers (iptables matches) and one connected action (iptables target)."

This is the typically strong, clear introduction one expects to find on the front page of a Linux project. :) I shouldn't complain too much. Anyone who's read the FreeBSD netgraph man pages realizes that documentation for non-developers can be tough to find.

Our visit to Addison-Wesley's "animal line" of books brings us to Slamming Spam: A Guide for System Administrators by Robert Haskins and Dale Nielsen. This book addresses a variety of anti-spam measures. It is definitely written for administrators, as it provides plenty of example command syntax and configuration guidance. It is cross-platform, with advice on UNIX and Microsoft mail clients, as well as server products.

If you use Sendmail you might want to read a different anti-spam book called sendmail Milters: A Guide for Fighting Spam by Bryan Costales and Marcia Flynt, published by Addison-Wesley. Milter is short for "mail filter;" it's a C extension to Sendmail. You might find this introductory article helpful.

We're in the home stretch now, with several titles on various subjects. The first book is UNIX System Programming, 2nd Ed by Keith Haviland, Dina Gray, and Ben Salama, published by Addison-Wesley in late 1998. I got this book to acquire a brief introduction to UNIX system programming, but I am not sure I will read it. The book looks good, but I have several titles waiting on my reading list that may contain equivalent knowledge. If you're looking for a succinct introduction to the subject, however, try this book.

Assembly Language for Intel-Based Computers, 4th Ed by Kip R. Irvine, published by Prentice Hall, is next. This was the first book I got to try to learn assembly programming. I am going to use it as a reference, but I will not start learning assembly with it. The reason is its use of Microsoft MASM, which is included on the CD-ROM with the book. I prefer to use open source alternatives. This 4th ed of this book is getting much better reviews that previous versions, according to Amazon.com.

Next is The Book of Webmin: Or How I Learned to Stop Worrying and Love UNIX by Joe Cooper, published by No Starch. Webmin is a very powerful open source, cross-platform, Perl-implemented, Web-based system and application configuration and operations management product. I played with it on a variety of hardware and operating system options. Joe's book is well written and covers the issues one needs to understand to install and use Webmin.

If you want to go to the source, try Managing Linux Systems with Webmin: System Administration and Module Development by Jamie Cameron, published by Prentice Hall. Jamie wrote Webmin, and he spends more time on extending and customizing the product. His book is more more complete when compared with Joe's. I recommend Jamie's work if you are looking to create your own Webmin modules for in-house or commercial use.

Finally we have Implementing CIFS: The Common Internet File System by Christopher Hertel, published by Prentice Hall. CIFS is the Common Internet File System, otherwise known as Server Message Block or SMB. I got this book to get a better understanding of SMB traffic on the wire, for network security monitoring purposes. If you really need to understand CIFS/SMB, this is the best book available.

Read More

Notes from CCNA Class

I'll be leaving for my CCNA class shortly. Yesterday we discussed changes brought about by the introduction of the ip subnet-zero feature. This allows a subnet like 172.16.0.0/19 to be valid. According to Cisco:

"It should be noted that even though it was discouraged, the entire address space including subnet zero and the all-ones subnet have always been usable. The use of the all-ones subnet was explicitly allowed and the use of subnet zero is explicitly allowed since Cisco IOS Software Release 12.0. Even prior to Cisco IOS Software Release 12.0, subnet zero could be used by entering the ip subnet-zero global configuration command."

Apparently the CCNA objectives now recognize the use of subnet zero, and Cisco expect students to calculate hosts and subnets appropriately. Previous CCNA objectives did not recognize subnet zero.

I also learned that material on OSPF, previously found mainly in the CCNP exam, is now part of the CCNA objectives. This would seem to make the CCNA test more difficult. I am not overly concerned, since the CCNA objectives no longer force students to learn IPX, AppleTalk, and other seldom-seen protocols.

Read More

New License for Snort Rules Announced, Not Yet Published

Yesterday Snort developer Marty Roesch announced that the license governing Snort rule usage will be changing. Marty said:

"Recently, we have become increasing aware of companies who are commercially redistributing rules written by the Sourcefire VRT without contributing to the considerable resources required to develop high quality rules in such a timely fashion.

In order to enable us to continue supporting the open source model and dedicate these various resources to ensuring users have access to the best possible detection capabilities, we will begin distributing new "Sourcefire VRT Certified Rules" under a new license that restricts commercial redistribution. For developers building open source applications using Snort rules or Snort end users in general, the change in the licensing policy has no effect. The changes in the license apply specifically to organizations that are commercially redistributing the rules for either a product or a service offering."

Marty has not yet published the new license itself, although he posted a follow-up message with additional notes. The new rules will be distributed starting 7 March under the new license.

These two messages appear to have been prompted by this post by Demarc. Demarc was known for its Puresecure interface to Snort, a version of which was available to the public under a convoluted license. Now they sell a Snort appliance called Sentaurus, which they bought from the now-defunct Silicon Defense company. In their message Demarc announced their new Snort community portal, where they claim to offer Demarc Certified Open Signatures. These rules are currently published without their copyright notices, as can be seen in this example. I gave Demarc notice that they need to provide proper copyright attribution.

The other center for Snort rule development is Bleeding Snort. Yesterday Matt Jonkman announced the following:

"I'm happy to be able to announce that Snort.org/Sourcefire and Bleeding Snort are now working together to build a single community that will be the premier source for Snort signatures, along with a more mature and still completely open signature and research group."

Marty must have decided to work with Bleeding Snort to prevent publication of poor rules, and perhaps provide a viable alternative to Demarc.

Speaking of Demarc, they also announced this:

"Our community portal will also become the new home for the SPADE statistical packet anomaly detection project and SnortSnarf, two projects originally managed by SiliconDefense and subsequently transferred to Demarc."

Demarc appears to be countering Simon Bile's SPADE resurrection, which he began in September 2004. Simon just published a new paper (.pdf) and presentation (.pdf) explaining SPADE.

Stay tuned for more details. I will look closely at the new Snort rules license when it is published.

Read More

Exploit in ASP.net State Service?

Today I saw a scan for port 42424 TCP from 205.179.74.190. Port 42424 TCP is apparently used by the ASP.net State Service. There was a vulnerability announced (MS02-026) last year, but I don't remember seeing anyone scan for port 42424 TCP before. Is anyone else seeing this, or do you have an idea what this is? More info on the service appears in this Securing Your ASP.NET Application article.

Read More