Close to home!

Dnsmasq configuration

To set Dnsmasq to resolve all quesries to one ip address add

address=/#/127.0.0.1

in dnsmasq.conf

ZoneRanger product

http://www.tavve.com/index.php/products/zoneranger

Need to re-look at this product, been about a year since the last demo.

Symantec

Symantec likes to distinguish itself by saying it’s the world’s largest security software company, but CEO Enrique Salem says more of the company’s solutions will come on purpose-built appliances.

At the Symantec Partner Connect conference in Orlando yesterday, Salem announced that a joint venture with China-based hardware manufacturer Huawei will produce appliance-based versions of many of the company’s security protection products, such as network-based antivirus security, data loss prevention and e-mail security.

Daemonlogger settings

Daemonlogger Soft Tap

1. 1)It sniffs packets and spools them straight to the disk and can daemonize itself for background packet logging. By default the file rolls over when 1 GB of data is logged.
   

2. 2)It sniffs packets and rewrites them to a second interface, essentially acting as a soft tap. It can also do this in daemon mode.

For ubuntu, installation is simply a matter of

- apt-get install daemonlogger

Config for capturing all packets to log file of format of time-date for reference

daemonlogger -i interface_name -l path_to_write_pcaps_to -u user_to_run_as_after_starting -n `date +"%H%M-%d%m%Y"` -S 0 -s 50000000

-S 0 captures all packets

-s 50000000 limits files written to approx 50Mb

Windows Security Articles

• Top 10 Windows Security Configurations: Where and How! (Part 1)
• Top 10 Windows Security Configurations: Where and How! (Part 2)
• Top 10 Windows Security Configurations: Where and How! (Part 3)

DNS Monitoring Script

Script to monitor dns requests on an interface, can be behind tap and then forward result to syslog for collection. Scripts a bit dirty and probably not very well constructed but appears to do enough.

Main bulk of script unashamedly ripped from

An Ajax-Enhanced Web-Based Ethernet Analyzer

Main Ruby script

dns-watcher.rb

------------------------------------------------------------
#! /usr/bin/ruby -w


# following packages required on ubuntu
# apt-get install rubygems
# gem install net-dns - no longer works as version updated to 0.6 use 0.5.2 from http://rubyforge.org/frs/?group_id=721&release_id=35799
# apt-get install libpcap-ruby*

require 'rubygems'


require 'net/dns/resolver'


require 'syslog'



require 'pcap'

require 'net/dns/packet'

capture = Pcap::Capture.open_live( 'bond0', 1500 )

capture.setfilter( 'udp port 53' )

# NUMPACKETS = 5000

puts "#{Time.now} - BEGIN run."

$log = Syslog.open('dns_logging', Syslog::LOG_PID, Syslog::LOG_LOCAL1)

capture.loop do |packet|

dns_data = Net::DNS::Packet.parse(packet.udp_data)

dns_header = dns_data.header

if dns_header.query? then

print "Device #{packet.ip_src} "
print "(to #{packet.ip_dst}) "
print "at #{Time.now} looking for "
question = dns_data.question
question.inspect =~ /^\[(.+)\s+IN/
puts $1
if $1 != nil
$log.info("dns queried for " + $1)
end

STDOUT.flush

end

end

capture.close

puts "#{Time.now} - END run."

---------------------------------------------------------------

Bash wrapper to start the script

dns-watcher

---------------------------------------------------------------

/bin/bash

case $1 in
start)
echo $$ > /var/run/dns-watcher.pid;
exec 2>&1 ruby /home/dns/dns-watcher.rb 1>/tmp/dns-watcher.out
;;
stop)
kill `cat /var/run/dns-watcher.pid` ;;
*)
echo "usage: dns-watcher {start|stop}" ;;
esac
exit 0

------------------------------------------------------------

Script can be started with

dns-watcher start &

and stopped with

dns-watcher stop &

Sometimes the script unexpected and my lack of coding skills stop me from understanding why so I use Monit to monitor the process and restart it if need be.

Monit config - follow normal rules for getting Monit to work and then add the lines below specifically for the dns-watcher script

--------------------------------------------------------------

# Monitor Ruby process for dns-watcher

check process dns-watcher with pidfile /var/run/dns-watcher.pid


start program = "/home/dns/dns-watcher start &"
stop program = "/home/dns/dns-watcher stop &"

---------------------------------------------------------------

Can use something like phpLogCon to monitor syslog output