The pfSense Store

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - mrtom

Pages: [1]
1
IDS/IPS / Re: Barnyard2 error with Suricata inline mode
« on: October 23, 2017, 01:31:49 pm »
Thanks. I was able to fix this by setting the Pass List option to none. Inline mode was not working with my NICs until the latest update so I think the Pass List setting carried over when I made the switch from legacy to inline.

2
IDS/IPS / Barnyard2 error with Suricata inline mode
« on: October 21, 2017, 05:33:54 am »
Suricata and barnyard2 have been working very well for me until switching to inline mode. When I start barnyard2 in inline mode I get the following error:

FATAL ERROR: [ParseSidMapLine()], File [/usr/local/etc/suricata/suricata_3702_em3/sid-msg.map], Error in map definition [1 || 1000001 ||  || NOCLASS || 0 || Pass List Entry - allow all traffic from/to 65.19.96.252/32] for value []


Any thoughts on how I can fix this?

3
General Questions / Re: Enable/disabling services remotely without GUI
« on: October 14, 2017, 05:57:09 pm »
Thanks, I'll experiment with this tonight.

4
General Questions / Enable/disabling services remotely without GUI
« on: October 13, 2017, 03:46:24 am »
I'm looking for a way to enable or disable a service remotely without using the web GUI. For example, I'd like to stop Snort when I start a vulnerability scan and turn it back on when the scan is finished. Ideally the command to stop snort would be issued as part of a script from the server performing the vulnerability scans. Anyone have any ideas how I might accomplish this?

5
Cache/Proxy / Squid fatal error with SSL interception
« on: August 19, 2017, 07:10:04 am »
The transparent SSL proxy was working and I'm not sure when it stopped exactly but I cannot get it to work again. When I start the Squid service it stops immediately.  If I disable SSL filtering Squid works just fine. To figure out what might be going on I ran "squid -k parse" to test the config and I get:

2017/08/19 07:53:43| Processing: adaptation_access service_avi_resp allow all
2017/08/19 07:53:43| Initializing https proxy context
2017/08/19 07:53:43| Initializing http_port 192.168.200.1:3128 SSL context
2017/08/19 07:53:43| Using certificate in /usr/local/etc/squid/serverkey.pem
2017/08/19 07:53:43| WARNING: X509_check_private_key() failed to verify signing cert
FATAL: No valid signing SSL certificate configured for HTTP_port 192.168.200.1:3128
Squid Cache (Version 3.5.26): Terminated abnormally.


I don't understand why it's trying to configure an SSL certificate for the HTTP port, shouldn't that only be needed for the HTTPS port? The configuration generated after enabling SSL interception is:


# This file is automatically generated by pfSense
# Do not edit manually !

http_port 192.168.200.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

icp_port 0
digest_generation off
dns_v4_first off
pid_filename /var/run/squid/squid.pid
cache_effective_user squid
cache_effective_group proxy
error_default_language en
icon_directory /usr/local/etc/squid/icons
visible_hostname localhost
cache_mgr admin@localhost
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable on
pinger_program /usr/local/libexec/squid/pinger
sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
sslcrtd_children 5
sslproxy_capath /usr/local/share/certs/
sslproxy_options NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS

logfile_rotate 0
debug_options rotate=0
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src  192.168.200.0/24
forwarded_for truncate
httpd_suppress_version_string on
uri_whitespace strip

acl dynamic urlpath_regex cgi-bin \?
cache deny dynamic

cache_mem 64 MB
maximum_object_size_in_memory 256 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
minimum_object_size 0 KB
maximum_object_size 4 MB
cache_dir ufs /var/squid/cache 100 16 256
offline_mode off
cache_swap_low 90
cache_swap_high 95
cache allow all
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:    1440  20%  10080
refresh_pattern ^gopher:  1440  0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
refresh_pattern .    0  20%  4320


#Remote proxies


# Setup some default acls
# ACLs all, manager, localhost, and to_localhost are predefined.
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535
acl sslports port 443 563 

acl purge method PURGE
acl connect method CONNECT

# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS

# SslBump Peek and Splice
# http://wiki.squid-cache.org/Features/SslPeekAndSplice
# http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
# Match against the current step during ssl_bump evaluation [fast]
# Never matches and should not be used outside the ssl_bump context.
#
# At each SslBump step, Squid evaluates ssl_bump directives to find
# the next bumping action (e.g., peek or splice). Valid SslBump step
# values and the corresponding ssl_bump evaluation moments are:
#   SslBump1: After getting TCP-level and HTTP CONNECT info.
#   SslBump2: After getting TLS Client Hello info.
#   SslBump3: After getting TLS Server Hello info.
# These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
# they can be used there for custom configuration.
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
acl allowed_subnets src 192.168.1.0/24
acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings


# Package Integration
url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
url_rewrite_bypass off
url_rewrite_children 16 startup=8 idle=4 concurrency=0

# Custom options before auth
access_log syslog:local8.info;

# Always allow access to whitelist domains
http_access allow whitelist
acl sglog url_regex -i sgr=ACCESSDENIED
http_access deny sglog
ssl_bump peek step1
ssl_bump splice whitelist
ssl_bump bump all
# Setup allowed ACLs
# Allow local network(s) on interface(s)
http_access allow allowed_subnets
http_access allow localnet
# Default block all to be sure
http_access deny allsrc

icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_encode off
icap_client_username_header X-Authenticated-User
icap_preview_enable on
icap_preview_size 1024

icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squid_clamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squid_clamav bypass=on
adaptation_access service_avi_resp allow all
[/size]

6
IDS/IPS / Re: Barnyard2 with MySQL over SSL issue
« on: August 17, 2017, 06:05:58 am »
Thanks for responding.  I created a pass-through entry for mysql output. Since the GUI MySQL settings don't really make it possible to do this and a logging option must be enabled, I enabled logging via Syslog and then added the following entry to the barnyard2 pass-through options:
[output database: log, mysql, user=test2 password=password dbname=snort host=192.168.1.17 sensor_name=OPT2 disable_signature_reference_table ssl_key=/etc/ssl/client-key.pem ssl_ca=/etc/ssl/ca.pem ssl_cert=/etc/ssl/client-cert.pem ssl_ca_path=/etc/ssl ssl_cipher=DHE-RSA-AES256-SHA

Every time I start barnyard2 it fails because of the following error: database mysql_error: SSL connection error: Unable to get private key

Since barnyard2 runs as root, I figured the private key should be owned by root. I can login with the key manually in the pfsense shell, but it doesn't work with barnyard2. I thought maybe it had something to do with daemon so I tried changing the owner to deamon which also didn't work.  I just can't figure out how to get a secure MySQL connection to work over barnyard2. Any advice?

7
IDS/IPS / Barnyard2 with MySQL over SSL issue
« on: August 11, 2017, 12:01:52 pm »
Barnyard2 has been working well for me but I want a secure connection to the mysql server. I setup my mysql server to use SSL, created a test user with the REQUIRE SSL option and it works great on everything except pfsense.  I can connect to the remote mysql as the test user on my client machines, but when I try to connect to it from pfsense I get denied access with the following error:

ERROR 1045 (28000): Access denied for user 'testremote'@'pfSense.localdomain' (using password: YES)

I'm assuming this is from SSL since it works fine with remote users that aren't required to use SSL. Is there something I need to setup on pfsense to allow mysql client connections to use SSL?


UPDATE: So I got the SSL working, turns out I just needed to create a my.cnf file with the certificate information but now I can't get barnyard2 to use it. I added the SSL information to the Barnyard2 output setting:
output database: log, mysql, user=test2 password=password dbname=snort host=192.168.1.17 sensor_name=OPT2 disable_signature_reference_table ssl_key=/usr/local/etc/snort/snort_40391_em3/client-key.pem ssl_ca=/usr/local/etc/snort/snort_40391_em3/ca.pem ssl_cert=/usr/local/etc/snort/snort_40391_em3/client-cert.pem ssl_ca_path=/usr/local/etc/snort/snort_40391_em3 ssl_cipher=DHE-RSA-AES256-SHA

I get the following error when starting barnyard:
Aug 11 20:24:43 pfsense.localdomain barnyard2[85206]: Initializing daemon mode
Aug 11 20:24:43 pfsense.localdomain barnyard2[85298]: Daemon initialized, signaled parent pid: 85206
Aug 11 20:24:43 pfsense.localdomain barnyard2[85206]: Daemon parent exiting
Aug 11 20:24:43 pfsense.localdomain barnyard2[85298]: PID path stat checked out ok, PID path set to /var/run
Aug 11 20:24:43 pfsense.localdomain barnyard2[85298]: Writing PID "85298" to file "/var/run/barnyard2_em340391.pid"
Aug 11 20:24:43 pfsense.localdomain barnyard2[85298]: database mysql_error: SSL connection error: Unable to get private key
Aug 11 20:24:43 pfsense.localdomain barnyard2[85298]: Barnyard2 exiting
Aug 11 20:24:43 pfsense.localdomain barnyard2[85298]: database: Closing connection to database "snort"

I can't figure out why barnyard2 can't get the private key. Does anyone know what the permissions need to be set on the key file or what I need to do to allow barnyard2 to use the key? The key works if I try connecting to mysql from the shell so I'm kind of baffled.

Pages: [1]