A Site of Information and Ideas
My log server was collecting loads of Schannel errors every day, so I decided to hunt them down.
It turned out that a Group Policy Object controlling Internet Options was misconfigured to allow SSL 3.0 traffic.
Disable SSL 3.0 as shown below, either with a GPO or on each machine. That stopped the log spam. For step-by-step instructions, see disabling SSL 3.0 with Group Policy or Internet Explorer, and for an earlier Schannel fix, see Schannel fatal alert 40 and 70.
I went down an interesting rabbit hole after finding securityheaders.com and hstspreload.org. To get an A+ rating for my blog, I worked through all of their suggestions. I won’t detail each one, but below is the set of HTTP security headers I’ve landed on that works for my WordPress site.
Add the following to the .htaccess file on your Apache web server (the mod_headers module must be enabled). Replace yoursite.com with your own domain.
Header set Content-Security-Policy "upgrade-insecure-requests"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-Xss-Protection "1; mode=block"
Header set Referrer-Policy "strict-origin"
Header set Permissions-Policy "geolocation=self"
Header set Access-Control-Allow-Origin "https://*yoursite.com*"
Header set Cross-Origin-Embedder-Policy "unsafe-none"
Header set Cross-Origin-Opener-Policy "unsafe-none"
Header set Cross-Origin-Resource-Policy "same-site"After saving the file, rescan your site at securityheaders.com to confirm the grade. Related: Apache reverse proxy configuration and configuring Apache mod_rewrite.
I can’t stress enough how important it is to stay vigilant over the next few months. Holiday events and social engagements will keep you distracted, and scammers count on that.
If it hasn’t started already, you’ll be bombarded with scam phone calls and emails. Please, do not respond to them. Mark them as spam or phishing, and delete them.
The latest phone scams are after your Social Security number, Medicaid information and credit card details. The caller usually gives a common, friendly first name like “Robin” or “John.” Hang up immediately.
A common email scam looks like someone “replying” to a message and BCC’ing you with a short note like “what’s this?” or “what is this?”, with an invoice below asking for payment. Mark it as spam and delete it.
There are many variations on this theme, but they all want the same thing: your money and your personal information, which they then use to trick other people out of theirs.
If you use a password manager like LastPass, I strongly urge you to change all of your passwords and keep them in a different password manager, or in a notebook stored somewhere safe in your home.
Hacking is serious business, with serious consequences for anyone who isn’t careful. It’s up to every one of us to keep our organization safe.
A vulnerability in SSL 3.0 could allow information disclosure. The fix is to turn off SSL 3.0 and use TLS instead. Here are two ways to do that on Windows clients: centrally with Group Policy, or per machine in Internet Explorer. To disable SSL 3.0 on the server side, see how to disable SSL 3.0 on Microsoft IIS.
Use the Turn off Encryption Support setting to disable SSL 3.0 and enable TLS 1.0, TLS 1.1 and TLS 1.2 across the domain.
To change the protocol versions Internet Explorer uses for HTTPS on a single computer:
Want to check whether a server still accepts SSLv3? Here’s a quick way to test for SSLv3.
While testing Sophos UTM 9.2’s one-time password (OTP) feature with Google Authenticator, I locked myself out of WebAdmin. Here’s how to turn OTP off for WebAdmin from the console using the cc configuration tool.
1. Log in to the firewall console as root and start the configuration tool:
cc2. Type auth and press Enter. It lists:
ad_sso
auto_add_to_facility@
auto_add_users$
block
cache_lifetime$
edir_sso
otp
servers@3. Type otp and press Enter. It lists:
auto_create_token$
default_timestep$
facilities@
require_all_users$
required_users@
status$4. Type facilities@ and press Enter. It shows which services require OTP:
0 webadmin
1 portal
2 ipsec
3 openvpn5. Type -0 and press Enter to remove webadmin from the list. It now shows:
0 portal
1 ipsec
3 openvpn6. Log in to WebAdmin as admin with just your password. Once you’re back in, you can reconfigure OTP properly.
ntop is a network traffic monitoring tool that shows who is using your bandwidth and how. This guide walks through building ntop from source on CentOS, along with its RRDtool and GeoIP dependencies, opening the firewall, starting it at boot, and turning on the NetFlow collector.
yum install gcc gcc-c++ make libpcap libpcap-devel gdbm-devel libpng-devel libtool libtool-libs rrdtool rrdtool-devel
yum install cairo-devel libxml2-devel pango-devel pango libpng-devel -y
yum install freetype freetype-devel libart_lgpl-devel wget gcc make -y
yum install perl-ExtUtils-MakeMaker -y
yum install graphviz -y
yum install subversion openssl-devel -y
cd /opt
wget http://oss.oetiker.ch/rrdtool/pub/rrdtool-1.4.5.tar.gz
tar -zxvf rrdtool-1.4.5.tar.gz
cd rrdtool-1.4.5
./configure --prefix=/usr/local/rrdtool
make && make installyum install libpcap libpcap-devel gdbm gdbm-devel -y
yum install libevent libevent-devel -y
cd /opt
wget http://geolite.maxmind.com/download/geoip/api/c/GeoIP-1.4.8.tar.gz
tar -zxvf GeoIP-1.4.8.tar.gz
cd GeoIP-1.4.8
./configure
make && make installDownload either ntop 5.0.1 (stable) or 4.1.0 (prior stable). The example below uses 4.1.0.
yum install libtool automake autoconf -y
cd /opt
wget http://downloads.sourceforge.net/project/ntop/ntop/Stable/ntop-5.0.1.tar.gz
# or
wget http://downloads.sourceforge.net/project/ntop/ntop/Prior%20Stable/ntop-4.1.0.tar.gz
tar zxvf ntop-4.1.0.tar.gz
cd ntop-4.1.0
./autogen.sh -prefix=/usr/local/ntop
make && make install
make install-selinux-policyAdd /usr/local/ntop/share/man to /etc/man.config, then create the ntop service user and set ownership:
useradd -M -s /sbin/nologin -r ntop
chown ntop:root /usr/local/ntop
chown ntop:ntop /usr/local/ntop/share/ntopSet the admin password on first run:
cd /usr/local/ntop/bin/
./ntop -u ntop -P /usr/local/ntop -AThe web interface runs on TCP port 3000, and NetFlow traffic arrives on UDP port 9996. Edit /etc/sysconfig/iptables and add these rules before the final INPUT REJECT line:
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 9996 -j ACCEPTservice iptables restart/usr/local/ntop/bin/ntop -P /usr/local/ntop -u ntop -d -w 3000 -i eth0Test it by browsing to http://your-server:3000. To start ntop on boot, add the same command to /etc/rc.local.
The first time you open the ntop web interface:
eth#-collector, where # is the interface receiving the data.dot.path to /usr/bin/dot.google_maps.key in the same Preferences screen.killall ntop, reboot the server, and confirm ntop starts on boot.