WEBSITE test and optimizations checks

I'm working with web-devlopers who always seem to have issue.


A few online   sites exist that provided great site checks

1st up,

webpagetest. It's a must for validation of your public site &  if it's reachable. As a pro, you can also  selected various regions and browser types  to simulate browser or movil-types.

http://www.webpagetest.org/


2nd,
google has a simple developer tester with suggestion. It's gear'd for optimization and fix very common & simple problems

https://developers.google.com/speed/pagespeed/insights/?url=


3rd,

Why no  padlock, this should simple to understand and explains simple https-web security issues & with suggestions.

https://www.whynopadlock.com

or

 SSLchecker

https://www.sslchecker.com/insecuresources


KenFelix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

juniper SRX cli benefits over Fortinet FortiOS

In this blog, I will hash out a few  cool functions in junos  that the SRX offers  &  when compared to the Fortinet FortiGate.


1st up  the fortiOS paging  is set from  the config sys console  setting  and  is not per-user-session. Junos allows for you to turn the  paging on per-user-session and not globally.


2nd,  system  junos is really unix ( bsd )  & we actually have  a history cmd option so we can quickly find and repeat previous commands

3rd, the kron scheduler is also native unix. So execution of  a task(s) and or function can be completed with ease and at a schedule date in the future.

4th, if have you have to  delete numerous  firewall.address.objects in fortiOS? Will  if your objects are  similar,  you could do a wildcard delete

5th, show commit detail before you commit. Commits in junos are like IOS-XR, you can actually  review all commit-changes &  before committal

6th, you  can display the  cli configuration in  various outputs that are formatted better or  for parsers
examples json  xml set

show configuration | display xml    
show configuration | display set
show configuration | display json

7th, you  can string match multi-expressions

kfelix@srxappliance> show system services dhcp pool 10.0.0.0/23 detail | grep Add | grep ssign
    Addresses assigned         49/482


next,  you can use  the interface-ranges if you need cover a range of interfaces. This is great if you need to mass-blast  configurations to  range of interfaces or look at a range of interface


I still think the fortigate is one of the best firewall on the market btw. The cli cmd options are slightly  less intuitive imho.

Ken

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

CN and Subject Alternative Names in SSL/TLS certificates

In this post I will show you why the  CN is not very import if you are using  SubjectAltNames.

Most browsers ( chrome, Opera, vivaldi ,  FF ) do NOT  care about the subject line CN if the certificate is a SAN certificate

Take this SelfSigned  certificate for various web  1plus1eq2.com. It has the following alt.Names installed in the certificate.











  Take note of the duplicate  alternate btw  ;) 

This  certificate when load against a web_site,  and once enabled will load with no  certificate error when using any one of the alternate which is all good and normal.

The CN for the certificate was simply labeled as " tstupidcname"

Alt.Name

chrome

firefox

vivaldi

Safari

If you  try to load the site and use the CN & with firefox for example, it will throw a error and even tell you want the certificate protects the sites listed in the Alt.Name sections.

cool ;)

So what you need to understand,  that any issued  x.509v3  certificate that has the Alt.Name extensions, " the web browser will ignore the  CN field in the subject line and will NOT fallback to that CN "

Chrome also  exhibits a error also if you try to use the CN;

But look here; Safari10.1.2 loads the sites with no error when using the CN

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

MACOSX fortigate dialup proposal

Here's a few screenshot of  the dialup proposal that macosx 10.10.x needs in order to use the builtin-cisco client

and here's the wizards details;

AES256 hash; sha1 SHA256 or md5

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

ssh passwordless login FortiOS

In this example, I will show you  how to setup  a ssh  password-less logins the forortiOS.  In fortiOS you can craft  up to 3each  ssh-pub-keys  per admin users.


Any one the keys can be called up,  and used for  ssh access.


1st

      you need to generate a  rsa key

       ssh-keygen -t rsa -b 2048 -f mysshkey

Next, COPY OUT JUST THE PUBkey information. It should start withe ssh-rsa

example


ssh-rsa AAAAB3NzaC1yc2EAAAADAQBBAAABAQCpEk1+5wsYkdFQ1huDWybkJhjbhQkymfaY+4yRy69PyAlp682NYM5emjgpPPtq1UpDWHdg65lGFo68nAyv2ersoitgI7Qe/sxe100wWqBZGuK5NzxQPropYN1r8kYKWeNbjryPJXsbd93/PHCDmXJaiyIPIb5mWkDbWifNl9dREFYI3uCdvmemshcDsVcRz+VXSTYbNPapFyBZYl17hPKwt5/tUBf9Gak0AxqjltUMrijltiMymULK3F95gf8vThOf7rvwhfmONmkE4j/xeagaz7kRbHTpfEu9IPEFTTUNQzGZPbmTHJh9UPQwNeG3xwN8JjhmuPpr5Jv5M7baiV8x kfelix@macattack.localdomain

This will be applied into the configuration via the  cli;

Here's a directory of my ssh rsa keys

Now we call the ssh-priv-key when we want to login. If  you have a passpharse on the priv-key ( that will be prompt )

And  another example;

ssh keygen has a max size you can use, but  I 've never seen issues on  the fortigate  with using keys  larger than 2048 bits modulus keys.

 

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Juniper SRX zonetoglobal address tool

Within  Junos & the SRX, you can defined firewall.adr,objects aka addressbook zone or globally. Previous OS version usedd the zone concept but the default now is the global method.

advantages with global method;

•  you can reduce any  duplicates
•  use address in ANY zone
•  and in  any direction
•  less maintenance when you need to change or update a address

The following link  has a tool for conversion of  address to global

https://github.com/scottdware/zone2global/blob/master/zone2global.go

YMMV

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

HOWTO do passwordless login juniperSRX

In this blog I will show you how the JuniperSRX  admin can enabled  ssh login with no passwords.

1:  First require the admin users to  send you a copy of the  rsa_pub.id key ( public ssh key )

2:  from within  the   Junos cli and the shell,  vi a new filename and paste the  ssh key in that file.








3: paste in the key and save the file so you can use it later in the cli configuration.


4: Now set the user login authentication to be  authentication load-key and specify the previous saved file.









5: The full configuration would look similar  to the following;

  
 The beauty of this approach, you can use  enc-password or  ssh-key. So if your user  keys are lost or changed,  you can  still login , but with a password.

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \