Hackermedia.org

Well I was getting up2date on my podcast listening and viewing and I saw on Hack5 they interviewed the founder of Hackermedia.org I highly recommend the site I found podcast that I never heard of plus downloaded the audio from the HOPE conference.

Time Synchronization

I'm very surprise that almost all of the clients I have worked at do not implement time synchronization of their servers and network equipment. This makes analyzing logs in an incident response and even for troubleshooting a headache. Many times what I recommend is using the Cisco router at each site as the time server for the site and have those sync with a central router. In virtual environments this becomes even more important since in heavy load the time in virtual machines will shift this why many times the DC with the PDC Master role is not virtualized or the virtualization tools on the VM's is set to force time synchronization.

VMWare ESX Virtual Switch Security

One of the things I like about VMWare ESX is the security in their Layer 2 Virtual Swicthes. They will not permit them be joined together so loops is not an issue and they let you apply 3 policy settings to secure the vSwitches this are:

• Promiscuous Mode
• MAC Address Changes
• Forged Transmit

This settings will prevent the virtual machines that use the switch from acting as a sniffer, changing their mac address or forging traffic with fake mac address thous protecting the rest of the virtual machines in the case of a compromise of a VM from it being used to conduct Man In the Middle Attacks, ARP Poison Attacks or being used to sniff traffic. To set the Policy on Reject on a virtual switch it can be done both from the Service Console or thru the VI Client. On the VI Client:

1. Log into the VMware VI Client and select the server from the inventory panel.The hardware configuration page for this server appears.
2. Click the Configuration tab, and click Networking.
3. Click Properties for the vSwitch whose Layer 2 Security policy you want to edit.
4. In the Properties dialog box for the vSwitch, click the Ports tab.
5. Select the vSwitch item and click Edit.
6. In the Properties dialog box for the vSwitch, click the Security tab.
7. Select reject on the drpdown boxes for all 3 Policy Exceptions.
8. Click OK

From the CLI just SSH into the Server and su to have root privilege and run

• vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-macchange=false
• vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-forgedxmit=false

Promiscuous is already set to reject by default.

Checking VMWare ESX 3.x Security

One of the main reasons for most of my recent travels and projects is virtualization. Many clients are going the virtual way to save costs on energy, space and cooling, plus it lets them get the most out of their existing hardware. But many VMWare implementations I have seen are your typical next > next > next .... reboot, very few people take the time to secure their VMware ESX infrastructure and that is when I recomend to them to get started a great little pice of freeware called Configcheck from Tripwire. The only thing missing in it is report generation in a PDF or HTML format but other than that if you have a VMWare ESX 3.x infrastructre use this great tool to give it a quick check.

Ruby in Ubuntu 8.10 Broken for Metasploit use

I recently decided to build a virtual machine with Ubuntu 8.10 to test most of the tools I use before upgrading my main laptop with it, and what do I find? that it is using Ruby 1.8.7 without the patch provided by HD to Ruby to fix an error on the use of Shortnamed Variables. So guys I recommend if you use Metasploit not to upgrade to Ubuntu 8.10 just yet, I'm also getting errors with Nessus.

HD has posted a bug to Canonical and it appears they are working on it for more info

https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/282302