maildomain checker tool

Openssl is used for webserver and websites for analyzing  SSL/TLS. But luxsci is used for mail systems. Here's a few  screenshots for  maildomain socpuppets  that's hosted by  godaddy


https://luxsci.com/smtp-tls-checker

This online tool is great for when you need simple to understand results and need to  analyze TLS/SSL issues regarding mail.

Other tools that I have mention a few years back are also  great

http://socpuppet.blogspot.com/2016/11/tls-for-smtp-how-do-we-check-if-our.html

NOTE: They { luxsci } has  a HIPAA  secure email  solution that works great. This allows for selective delivery of  email  and mets HIPAA compliance.

https://luxsci.com/hipaa-compliant-email-encryption

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

DSN check-name and how to analze

Here's a quick burb about  dns and names and syntax.  A work  associate ran into this issue today and I figure I would explain a few items.


With most  bind  deployments if you have a "underscore" in the name and do not specifically set   check-names ignore ,  the bind daemon will balk and failed to load the domain zone.

Bind is user friendly and will tell why and where in the file the error is located at . Here it's line #13 and on line #13 I have the following entry that I crafted for this example.

So  that's a quick means for finding  the error and now in order to get the domain load, you need to  enable check-names ignore  (  the other options are fail and warn )

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

sidewinder download alternative

Howto build a sidewinder 8.3 repository. This can be useful in a fenced environment &  where the  firewall has no internet access to the forcepoint download site.

1st you need to retrieves the pkgs from the real  sidewinder-download site and reconstruct the  site,  and ensure the pkglist.txt is present in your  serving directory.

https://pkg.sidewinder.downloads.forcepoint.com/packages/sidewinder/8.3/

In my setup I'm  using the lite  ftp-server ftpdmin. I’ve  only installed  the   packages for hotfix P10 and P11 in the  ftp user_directory . It probably best to  md5sum or sha1sum check the files  to ensure no  corruptiom.

 After you have set the base directory  and installed the package(s) and pkglist.txt you can change the sidewinder appliance to download the pkgs. This will allow the appliance to call out to the ftp-server and  download/install the pkgs.

You can monitor the ftpmin process to determine if any transfers exist or failures.

After the installation and reboot, you might have to wait for any aux-updates/upgrades for the console

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Forcepoint NGFW TLS inspection review

Forcepoint NGFW supports both client and server side  TLS decryption. A few things to  be aware of when you compare it to other  systems like FortiOS and PANOS

1st:  You can't  use multiple client-side TLS decryption profiles at  the same time on the same firewall engine

2nd: You have to  set the  certificate issuer  CA-root cert as a trustedCA if you import a PKI-CA-cert into the  SMC

3rd:   they take a totally  different approach and define a certificate lifetime in duration for the MiTM forged certificate. This value seems to be defaulted to 120min regardless of the CA root life time value which defaults to  1 year

4th; you don't have  the means like in PANOS to opt-out of TLS inspection or provide a notice to the  end-user


And lastly, you have to use a HTTPS   with decryption service in the policy access.rule


e.g

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

PCNSE certification

The PCNSE  exam was taken the  verification has been done .

PANW  provides a  certification  verification that you can use for validation of the end-user certificates

What I discovered during this certification;



1: explore the answers
2: looks for the obvious wrong answers
3: eliminate the wrong answers which will typically leave you with 2 or 3 correct answers
4: Now  analyze the question and answers for the best and correct answer
5:  it best to  prep for the exam by studying the  actions you do take on day-2-day function


keep in mind that the  new certifications process is only good for only 2 years.

And good luck !

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

PANOS remote-admin authentication with JumpCloud

Here's a simple & basic design setup for the authentication of PANOS administrators using a authentication profile . We are using LDAP-aaS within jumpcloud.

https://www.jumpcloud.com


My jumpcloud user has been defined as ken.felix and he has enrolled. This user will be enabled as a panos admin in the firewall.




PANOS  requires you to define the  adminuser and attached a authentication-profile. I also have a service-route due to the fact that I'm using my public-interface and dataplane to gain access to jumpcloud's LDAP-aaS  LDAPS server

The PANOS test cmd allows us to  validate  the user and connectivity to jumpcloud. It will also confirm base and bind DN values




We can  review systems admin and logs for  details.


 

NOTE: In  the  Jumpcloud admin portal to disable the  remote-user, remove the account name from the LDAP-group

You can combine  Jumpcloud RADIUS-aaS with Duo and   provide simple MFA authentication similar to this approach


http://socpuppet.blogspot.com/2017/04/securing-fortigate-sslvpn-with-mfa-by.html

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

What's going in the forcepoint SMC

Socpuppets has been playing around with the latest  6.3.7  build from  Forcepoint.  Forcepoint as in the name has been around for less than  5 years  but the  parent stonesoft has been known for some time.

https://en.wikipedia.org/wiki/Forcepoint

Improvement have been in the  various  software for the NGFW  and SMC components.

The installation of the SMC is one of the main items that needs to be done before you can manage any aspect of the  NGFW solution.

The SMC interface is managed by a management-client that is lite-weight and quick if the server resources are not tied up.

Forcepoint is making a strong march to be within  the top 5 for enterprise  NGFW   and  to compete  against the major players.

Other  newcomers  to look at are  huawei and sangfor.  Both of these  vendors cater mainly in the  Asia   and Africa markets.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \