collect server config files via rsync and commit them to a CVS with svn

I really like what RANCID does for routers and switches and wanted the same thing for my mail server configs. Here's what I put together with some help from the folks at freenode's #bash IRC channel. I hope someone else can find it a useful starting point. If you have any suggestions on how to improve it, I'd be grateful.

#!/bin/bash
#
# TODO:
#       *)make removing the working directories optional?
#

servers=("server-01" "server-02" "server-03" "server-04")
working_dir=/var/rancid/svn-temp/
rm -fr $working_dir/servers-cvs.mail
rm -fr $working_dir/servers-cvs2.mail

for i in "${servers[@]}"
 do
  echo '#########################################################' >>  $working_dir/servers-cvs.mail
  echo "$i: clearing working directories." >>  $working_dir/servers-cvs.mail
#  rm -rf $working_dir$i/\.*
#  rm -rf $working_dir$i/*
  cd /var/rancid/svn-servers/$i/
  echo "$i: checking out files from the repo." >>  $working_dir/servers-cvs.mail
  svn  checkout file:///var/rancid/svn-servers/$i $working_dir$i/
  echo "$i: copying files from $i into working directory." >>  $working_dir/servers-cvs.mail
  rsync  -q --no-motd --checksum -rptgoDLK --compress --recursive --delete  --relative --cvs-exclude  --exclude '/var/log/*'  root@$i:/etc/postfix :/etc/dovecot :/etc/mail :/var/www/html :/etc/snmp :/etc/mail :/etc/policyd :/etc/policyd-weight.conf  :/etc/fail2ban :/etc/amavisd.conf :/etc/clamd.conf :/mnt/lustre $working_dir$i/
  echo "$i: svn status:" >>  $working_dir/servers-cvs.mail
  svn status $working_dir$i   >>  $working_dir/servers-cvs.mail
  echo "$i: svn diff:"  >>  $working_dir/servers-cvs.mail
  svn diff $working_dir$i   >>  $working_dir/servers-cvs.mail
  echo "$i: committing changes to svn repo, if any."  >>  $working_dir/servers-cvs.mail
  IFS=$'\n'
  for new_line in $(svn status $working_dir$i); do
    file_svn_status=$(echo $new_line | cut -c1)         #get svn status of the file
    new_file=$(echo $new_line | cut -c2-)       #get the name of the file
    new_file="${new_file#"${new_file%%[![:space:]]*}"}" 
    echo '----------------------------------------------------------'
        case $file_svn_status in
        D)
                echo "this appears to be a DELETED file:$new_file.  Removing file from repo SVN" >>  $working_dir/servers-cvs2.mail
                svn remove /$new_file
                ;;
        M)
                echo "this appears to be a MODIFIED file:$new_file.  Committing changes to SVN" >>  $working_dir/servers-cvs2.mail
                ;;
        !)
                echo "this appears to have been removed from the working copy: $new_file .  Removing from repo SVN"  >>  $working_dir/servers-cvs2.mail
                svn remove /$new_file
                ;;
        ?)
                echo "this appears to be a new file: $new_file.  Committing new file to SVN"  >>  $working_dir/servers-cvs2.mail
                svn add /$new_file     
                ;;
        *)
                echo "Unknown fruit - sure it isn't toxic?"  >>  $working_dir/servers-cvs2.mail
        esac

  done  # done with 'for new_line  in $(svn status $working_dir$i)' loop
  svn commit $working_dir$i  -m 'auto-commit'
done     # done with 'for i in "${servers[@]}"' loop

#mail logic repurposed from RANCID
MAILHEADERS=""
    if [ -s $working_dir/servers-cvs2.mail ]  ; then
         echo "Today's date is $(date)" >> $working_dir/servers-cvs.mail
         echo "Today's date is $(date)" >> $working_dir/servers-cvs2.mail
        (
          echo "To: me@example.com"
          echo "Subject: changes in servers"
          echo "$MAILHEADERS" | awk '{L = "";LN = $0;while (LN ~ /\\n/) { I = index(LN,"\\n");L = L substr(LN,0,I-1) "\n";LN = substr(LN,I+2,length(LN)-I-1);}print L LN;}'
          echo ""
          cat $working_dir/servers-cvs.mail
          cat $working_dir/servers-cvs2.mail
        ) | /usr/sbin/sendmail -t
    fi

Blocking DNS requests with iptables

iptables -I INPUT 1 -p udp -m udp --dport 53 -m string --hex-string "|333032353904696e666f|" --algo kmp --from 30  --to 65535 -m comment --comment "drop 30259.info" -j DROP

Unfortunately that string is in hex, so you'll need to run a tcpdump to extract the hex-encoded domain name like so:

[bob@host01 ~]# tcpdump -nnX -c 10 -s 0 -l port 53 
05:18:53.307390 IP nnn.nnn.nnn.nnn.32825 > xxx.xxx.xxx.xxx.53:  7117+ [1au] ANY? 30259.info. (51)
        0x0000:  4500 004f 0000 4000 3f11 df23 cd86 d638  E..O..@.?..#...8
        0x0010:  d8b1 e009 8039 0035 003b 34c9 1bcd 0100  .....9.5.;4.....
        0x0020:  0001 0000 0000 0001 0533 3032 3539 0469  .........30259.i
        0x0030:  6e66 6f00 00ff 0001 0000 2910 0000 0000  nfo.......).....
        0x0040:  0000 0c50 fa00 0800 0120 000b 5dfb ed    ...P........]..

Notice that this happens to be a QTYPE 255: A request for all records (all cached records, not an AXFR which is type 252. I dunno if this QTYPE is useful in the real world or just a vector for attack. You can view all queries with QTYPE=255 with

tcpdump -c 10 -s 0 -l port 53 and ether[len - 3] == 0xff

find your public IP from behind a NAT device in linux

[me@host ~]# curl http://checkip.dyndns.org/

Current IP Address: 4.2.2.2

username, hostname and IP address have been changed to protect the innocent.

changes in CentOS logrotate archive naming convention

It looks like the archive naming scheme used by logrotated has changed from CentOS5 to CentOS6.  For any one doing any CentOS scripting, this may affect you.  The CentOS5 logrotated simply added a ".n" to the filename, where "n" is a number.  For example:

[root@mail01-01 ~]# ls -latrh /var/log/messages*
-rw------- 1 root root 4.5M Dec 23 04:11 /var/log/messages.5.gz
-rw------- 1 root root 4.8M Dec 24 04:10 /var/log/messages.4.gz
-rw------- 1 root root 4.4M Dec 25 04:09 /var/log/messages.3.gz
-rw------- 1 root root 4.4M Dec 26 04:08 /var/log/messages.2.gz
-rw------- 1 root root 4.5M Dec 27 04:09 /var/log/messages.1.gz
-rw------- 1 root root  17M Dec 27 08:50 /var/log/messages

In CentOS6, the file name is appended with the date it was rotated.  For example:

[root@radius1 radius]# ls -latrh /var/log/messages*
-rw-------. 1 root root 2.1K Dec  4 03:45 /var/log/messages-20111204
-rw-------. 1 root root 1.8K Dec 11 03:11 /var/log/messages-20111211
-rw-------. 1 root root  33K Dec 18 03:23 /var/log/messages-20111218
-rw-------. 1 root root  438 Dec 25 03:29 /var/log/messages-20111225
-rw-------. 1 root root  281 Dec 25 21:50 /var/log/messages

This is more efficient, to be sure, as the old method would rename all the archived files to make room for the newest one, changing messages.1.gz to messages.2.gz, messages.2.gz to messages.3.gz, etc.  This may however mess up some scripts if they're looking for the ".n" pattern.

Displaying Interface descriptions in SNMP traps using SNMPTT's PREXEC funtion

I collect snmp traps via snmptrapd which then hands them off to snmptt. Upon receipt of an interface down/up trap (.1.3.6.1.6.3.1.1.5.3, for example) snmptt then runs a quick snmpget request (unfortunately using SNMPv1 at the moment) to the reporting host to pull the description for the given interface like so:

EVENT ciscoConfigManEventDN .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal
# use snmpget to fetch the interface description and save it as $p1, to be used it the FORMAT line.
PREEXEC /usr/bin/snmpget -v 1 -t 2 -Ovq -c snmptt $aA ifAlias.$1
FORMAT Link DOWN $2 - $p1
# OPTIONAL: do not process this event for VI interfaces (like PPPoE interfaces)
MATCH $2:!(Virtual-Access)
MATCH $2:!(Multilink)
MATCH MODE=and
#
EXEC /root/bin/sendemail.sh high traps@mydomain.com "ALERT-$s-$R-$Fz" "Agent $A at $aA reports $Fz$FnTrap $e:$D$Fn"

Note that I've created a special SNMP VIEW and community one our routers which allow access only to the ifAlias.* OID tree like so:

snmp-server view snmptt ifXEntry.* included
! note that ACL99 includes my snmp NMS only!
snmp-server community snmptt view snmptt RO 99

BackupPC client quickstart with improved security

To embellish and improve upon http://backuppc.sourceforge.net/faq/ssh.html#how_can_client_access_as_root_be_avoided I've been using the following procedure:

1.  Add the 'mybackuppc' user to the machine that is being backed up.  I try to avoid using "backuppc" as the username in case a common dictionary attack occurs. Then,  create a SSH key pair on the client as the 'mybackuppc' user (do not enter a password):
   

   useradd mybackuppc -c "Backup User"
   su - mybackuppc
   ssh-keygen -t rsa
   exit

2. 
   
3. Add the 'mybackuppc' user to the client's sudoers file using visudo to give the user sudo rights as follows:
   

   mybackuppc ALL=(ALL) NOPASSWD: /usr/bin/rsync --server *
   Defaults:mybackuppc !requiretty






4. Copy 'backuppc' users public key from the backup server:
   

   /var/lib/backuppc/.ssh/id_rsa.pub) to the mybackuppc's auth keys file on the client (/home/mybackuppc/.ssh/authorized_keys




5. SSH from the BackuPC server to the client once as the backuppc user (su - backuppc; ssh -l mybackuppc $host) to get the RSA fingerprint into the backup server's /var/lib/backuppc/.ssh/known_hosts file:
   

   bash-3.2$ /usr/bin/ssh -l mybackuppc client-host
   The authenticity of host 'client-host (x.x.x.x)' can't be established.
   RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added 'client-host, x.x.x.x' (RSA) to the list of known hosts.
   [mybackuppc@client-host ~]$ exit
   logout
   
   Connection to client-host closed.




6. Use the BackupPC web interface to add a new host. Notice in the comments at the bottom of the page that you can easily copy an existing host, or just add one from scratch with the defaults. You don't have to use an valid name available via DNS if you make sure the name is in /etc/hosts on the backup server. Alternatively, you could create a config file on the Backup Server in /etc/BackupPC/pc/ and then add them to /etc/BackupPC/hosts file.



7. Use the BackupPC server's web interface to initiate a full backup of the new client machine.

Site to Site VPN Worksheet

Periodically I find myself working with another party to establish a LAN to LAN, or Site to Site, IPSEC VPN tunnel and there are various parameters which must be agreed upon.  I have found that exchanging a VPN worksheet ahead of time helps both parties think through the process better and speeds up the VPN configuration.  This is preferable under all scenarios, but especially when one or more parties are paying by the hour to have someone configure it for them.  Feel free to download, alter and use it as you see fit:

https://docs.google.com/leaf?id=0Bw0IToZ5AnXTMjAzMzJiYmEtOWRjOC00OTY0LTg4ZjUtYzk4ZTk4MjViNTEx&hl=en_US&authkey=CMbmnecO

Cisco ASA Remote Access VPN for IPSEC client

Here's a basic template for Remote Access VPN using the Cisco IPSEC VPN client. It includes a pool for address assignment, and an ACL to provide remote clients access to a few RDP servers. This also features PPPoE dialer for the WAN interface.

interface Vlan1
 description LAN
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0
!
interface Vlan2
 description OUTSIDE
 nameif outside
 security-level 0
 ip address pppoe setroute
!
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
!
object-group network remoteVPNGroup
 network-object 172.16.0.0 255.255.255.0
object-group network insideNetworks
 network-object 10.0.0.0 255.255.255.0
object-group network RDP-Servers
 network-object host 10.0.0.6
 network-object host 10.0.0.14
 !
access-list inside_nat0_outbound extended permit ip object-group RDP-Servers object-group remoteVPNGroup
!
ip local pool RAGenPool 172.16.0.2-172.16.0.30 mask 255.255.255.0
!
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.0.0.0 255.255.255.0
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
!
crypto isakmp policy n
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 43200
!
group-policy RAGeneral internal
group-policy RAGeneral attributes
 vpn-tunnel-protocol IPSec
 group-lock value RAGeneral
 split-tunnel-policy tunnelall
 address-pools value RAGenPool
 !
username testuser password ************** encrypted
username testuser attributes
 vpn-group-policy RAGeneral
 group-lock value RAGeneral
username superadmin password ********** encrypted privilege 15
!
tunnel-group RAGeneral type ipsec-ra
tunnel-group RAGeneral general-attributes
 address-pool RAGenPool
 default-group-policy RAGeneral
tunnel-group RAGeneral ipsec-attributes
 pre-shared-key * 

!

vpdn group PPPOE-WAN request dialout pppoe
vpdn group PPPOE-WAN localname my_ppp_username
vpdn group PPPOE-WAN ppp authentication pap
vpdn username my_ppp_username password *********
 

My Thunderbird Plugins

• DisplayQuota
• Enigmail
• Lightning
• Provider for Google Calendar
• Sieve

Handy BASH one-liners

Please excuse the mess:

• remove blanks and comments: egrep -v "#|^$" filename
• for f in *.dist; do cp $f `basename $f .dist`; done
• tcpdump -c 20 -i br0.52 'tcp port 3389 and host 216.177.x.x'
• tcpdump -n host 192.168.5.9 and port 53 -c 10
• ls /backup/*`date -d '-3 day' + '%G-%m-%d'
• find -type f -print0 | xargs -0 grep -liwZ "search_string" | xargs -0 rm -f
• arp -n |tail +2 | awk '{printf "arp -d %s\n",$1}'|sh
• recursive FTP mget: wget -r -nH ftp://ftp.remotehost.example.com
• iptables -t nat -I POSTROUTING 8 -s 192.168.112.0/255.255.255.0 -o eth0 -j SNAT --to-source 10.10.224.6
• iptables -L -n -t nat --line-numbers
• feed XARGS variables for more complex statements : grep -o -e '[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*' /var/log/maillog| sort | uniq | sort -nr | xargs -I '{}' grep '{}' /var/log/fail2ban.log
• grep 'cat\|dog' ## find file matches lines containing the word "cat" or the word "dog"
• find top email addresses in logs: tail -n 10000 /var/log/maillog | grep 'postfix\/smtp' | grep from= | awk '/from=/{for (i=1;i<=NF;i++) {if ( $i ~ /[[:alpha:]]@[[:alpha:]]/ ) {print tolower($i)}}}' | sed -n 's/from\=//p' | sort | uniq -c | sort -nr
• awk '{print $2 ":" (strftime("%D-%T", $2)) " " $4}'
• awk '{print substr($1,4),"@",$2,$3}' ./times.txt
• awk -F, '{if ($5 > 0 || $13=1) print $(NF-1)}' ## if fifth field is >0 OR thirteenth field equal to 1 then print second-to-last field
• awk '/Monday/{print substr($1,4),"@",$2,$3}' ./times.txt
• find /home/ -name '.snapshot' -prune -o -name '\*' -type d -fprintf ./fprint.txt '%U\t%G\t%p\n'
• find . -name nopo\* #finds files in current directory that begin in "nopo"
• find files modified w/in the last 24 hours but skip the rra directory or any file containing rra in the name: find ./ -name 'rra' -prune -o -mtime 0 -ls
• find /data/backup/ -mtime +10 -and -name tccu-server-\*.tar.gz\* -exec rm {} ;
• find . -path './mail/\*' -prune -o -mtime +120 -ls
• find /var/log/ -name maillog* | xargs ls -tr | xargs zgrep -h mydomainname
• postqueue -p |grep -P '^[0-9A-F]+' | sed 's/*//g' | awk '{print $1}' | postsuper -d -

Log cron output to syslog

# With this method, script output is logged to syslog, but errors go to mail
* * * * * root /root/bin/cron-test  2>&1 >> /var/log/messages
# this sends both to syslog
* * * * * root /root/bin/cron-test  >> /var/log/messages 2>&1

Hard = wrong

sometimes, when things seem harder than they should be, it's because I'm doing it wrong.

Dear AOL user: be brave

Dear AOL user,
     Please don't use the Internet to do your dirty work.  If you don't want email from someone you know, then please simply contact them and tell them so.  Don't use the Internet to do your dirty work for you.  There are two reasons you should take direct action:

1. It doesn't work.  When you mark an item as spam in your AOL inbox, it sends a message to the ISP of the person who sent that message.  In the case of actual Unsolicited Bulk Email, this might be the appropriate thing to do, but when it's from an actual person who really put your address in the "TO:" field, it is definitely the wrong thing to do.  This subjects ISP technicians the world over to reading the pithy, lolcats-laden, sentimental stuff you didn't want in the first place.  COME ON!  It will not block that person from sending to you; they never find out.  In addition, AOL redacts your email address from the original message so we cannot even tell our customer who it is that doesn't want their email.  In the end, it's a waste of everyone's time.  But more importantly:
2. It's the right thing to do.  Ethically, I think email should be treated like regular postal mail or notes passed in class; you should acknowledge receipt.  If you don't want that type of email, just let the sender know.  With any luck, they're adults and will accept it.  If not, then what have you really lost?

 Please, please, please do the human thing.  You know those tee-shirts that nerds wear that say "I read your Email"?  Well, this is one of the few things that actually makes us do that and, trust me, we have better things to do.  Thank you.

Signed,
The Management

Cisco ASA 7.2 PPPoE Lan-to-LAN IPSEC with conditional NAT Template

This is a pretty standard config, except for the conditional NAT.  So in this case, only certain local IP addresses (host in network-object LocalHostsToNATtoVendor01) will match the VPN tunnel, and will be NATted before hitting the tunnel.

!ASA Version 7.2(4)
!
enable password ********** encrypted
passwd ********** encrypted
names
!
interface Vlan1
description LAN
nameif inside
security-level 100
ip address 10.10.10.1 255.255.255.0
!
interface Vlan2
description OUTSIDE
nameif outside
security-level 0
pppoe client vpdn group MyPPPUserName
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
!
object-group network RemoteVendor01
network-object 192.168.64.0 255.255.248.0
! 
object-group network LocalHostsToNATtoVendor01
network-object host 10.10.10.150
network-object host 10.10.10.151
network-object host 10.10.10.152
network-object host 10.10.10.153
network-object host 10.10.10.154
network-object host 10.10.10.155
network-object host 10.10.10.156
network-object host 10.10.10.157
! 
access-list outside_1_cryptomap extended permit ip 172.16.6.24 255.255.255.248 192.168.64.0 255.255.248.0
access-list inside_nat0_outbound extended permit ip 172.16.6.24 255.255.255.248 192.168.64.0 255.255.248.0
! 
access-list LocalHostsToNATtoVendor01 remark conditional NAT
access-list LocalHostsToNATtoVendor01 extended permit ip object-group LocalHostsToNATtoVendor01 object-group RemoteVendor01
!
!define two NAT pools, one pool of IPs, the other the outside interface address
global (outside) 1 172.16.6.24-172.16.6.31
global (outside) 2 interface
!don't nat some hosts
nat (inside) 0 access-list inside_nat0_outbound
!do NAT this ACL
nat (inside) 1 access-list LocalHostsToNATtoVendor01
nat (inside) 2 10.10.10.0 255.255.255.0
!
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 192.152.45.12
crypto map outside_map 1 set transform-set ESP-AES-192-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-192
hash sha
group 5
lifetime 28800
!
vpdn group MyPPPUserName request dialout pppoe
vpdn group MyPPPUserName localname MyPPPUserName
vpdn group MyPPPUserName ppp authentication pap
vpdn username MyPPPUserName password *********
!
tunnel-group 192.152.45.12 type ipsec-l2l
tunnel-group 192.152.45.12 ipsec-attributes
pre-shared-key *
!
! here's an interesting feature
smtp-server 10.45.26.2
prompt hostname context

blocking opportunists with Fail2ban

Fail2ban is a great package, and I've been using it a lot lately.  It's extremely simple, flexible and effective.  Out of the box it comes with some nice filters for scraping web server logs for those IPs looking for exploits on your web server.  My web server has basic password authentication enforced, so most folks wouldn't even get to those pages if they tried, but I still don't like the idea of folks trying to brute force their way in. So I recently added a new filter for banning IPs who get a number of HTTP 401 401, access denied, Unauthorized errors (I might expand this to include 403 or 404 errors as well).  It was easy:


1) define a new filter:

[root@noc tacacs]# cat /etc/fail2ban/filter.d/apache-badURLs.conf

[Definition]

# adapted from apache-auth.conf

# Option: failregex

# Notes.: regex to match jerks trolling for exploits.

# The host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT

#examples:
#115.168.71.85 - - [25/Jul/2010:09:48:04 -0700] "GET /websql/scripts/setup.php HTTP/1.1" 401 479 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6"
#209.168.161.229 - - [25/Jul/2010:21:32:03 -0700] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 401 479 "-" "ZmEu"
#unknown.ord.scnet.net - - [28/Jul/2010:14:35:05 -0700] "GET /mysql/scripts/setup.php HTTP/1.0" 401 482 "-" "Wget/1.11.4 Red Hat modified"

failregex = .*\"GET.*HTTP.*\" 401 \d{3}
# end apache-badURLs

2)  make a new jail in /etc/fail2ban/jail.conf:

[apache-badURLs]

enabled = true

#name of the file in /etc/fail2ban/filter.d/ which will define the match criteria

filter = apache-badURLs

action = hostsdeny

#ban IP address outright

action = iptables-allports

#send email to the WHOIS contact in charge of the IP address, for abuse tracking and follow-up

sendmail-whois[name=badURLs, dest=me@example.com, sender=fail2ban@example.com]

#define which logs to search.  This string would include both "access_log" and "ssl_access_log"

logpath = /var/log/httpd/*access_log

# how many times will you put up with it before running the action?

maxretry = 3

#end apache-badURLs section

That's pretty much it.  The actions are additive and can include emailing the contact, yourself, banning only certain ports etc.  The action could also include adding the IP to your perimiter firewall's ACL via ssh (I haven't tested this but probably will) or just about any scriptable function.

A few notes:  This was designed for a private site.  If you run a public site which you want well marketed, you may end up blocking Google, Yahoo etc when their spiders crawl your site.  I'm not sure how that would work. 

How to disable speed and duplex auto-negotiation on Cisco 2960

If you're having trouble finding the "speed" and "duplex" options for the Gigabit Ethernet ports in the interface configuration of your Cisco 2960, try manually setting the interface type.

swith01#sh run int gi0/1
Building configuration...

Current configuration : 126 bytes
!
interface GigabitEthernet0/1
switchport mode trunk
end

swith01#conf term
Enter configuration commands, one per line. End with CNTL/Z.
swith01(config)#int g0/1
swith01(config-if)#speed ?
% Unrecognized command
swith01(config-if)#media-type ?
auto-select Use whichever connector is attached
rj45 Use RJ45 connector
sfp Use SFP connector

swith01(config-if)#media-type rj45
swith01(config-if)#speed ?
10 Force 10 Mbps operation
100 Force 100 Mbps operation
1000 Force 1000 Mbps operation
auto Enable AUTO speed configuration

swith01(config-if)#speed 100
swith01(config-if)#dupl
swith01(config-if)#duplex ?
auto Enable AUTO duplex configuration
full Force full duplex operation
half Force half-duplex operation

swith01(config-if)#duplex full
swith01(config-if)#end
swith01#sh run int
*Mar 1 00:04:04.318: %SYS-5-CONFIG_I: Configured from console by localuser on consolegi0/1
Building configuration...

Current configuration : 167 bytes
!
interface GigabitEthernet0/1
switchport mode trunk
media-type rj45
speed 100
duplex full
end

Quick and easy LAN-to-LAN VPN for Cisco ASA

The Scenario:
You want your workstation at H.Q. at your.local.subnet.15 to be able to Remote Desktop (TCP3389) to you server at your.remote.subnet.34. Your remote branch has a WAN IP address of your.remote.wan.29:

!
! Define "interesting" traffic to determine which traffic gets encrypted.
! In this case it's any packet from the local box with a destination address of the remote server, TCP port 3389 and ICMP traffic.
! Note that THIS ACL must be exacly the same, with source and destination addresses reversed, on the IPSEC peer at the other end.
! If you don't control both peers then it may be advisable to use simple host-based ACLs and leave off the ports.
! Naturally, this is less secure that specifying the ports here.  You can always add an additional ACL (which doesn't have to match at the far end)
! on the tunnel-group with the "vpn-group-policy" option.
!
access-list outside_60_cryptomap extended permit tcp host your.local.subnet.15 host your.remote.subnet.34 eq 3389
access-list outside_60_cryptomap extended permit icmp host your.local.subnet.15 host your.remote.subnet.34
!
! Define IKE Phase I Parameters
! IKE Phase I authenticates IPSec peers and negotiates IKE SAs during this phase.
! This sets up a secure channel for negotiating IPSec SAs in phase 2.
!
crypto isakmp policy 20
authentication pre-share
encryption aes-256
hash md5
group 5
lifetime 14400
!
! Define IKE Phase II IPSEC transformations
! IKE Phase II negotiates IPSec SA parameters and sets up matching IPSec SAs in the peers.
!
crypto ipsec transform-set esp-aes-md5 esp-aes-256 esp-md5-hmac
!
!
! NAT considerations
! You may want to disable NAT across the IPSEC tunnel.  In a SMB environment, there is probably no need or desire to source NAT.
! So, add and additional line to your existing nat exception ACL or create one.  Here, we add a line to the existing inside_nat0_outbound ACL.
! This bit is a bet beyond the scope of this article
access-list inside_nat0_outbound extended permit ip host your.local.subnet.15 host your.remote.subnet.34
!
! Define the IPSEC peer and its IKE Phase II.  PFS is optional
crypto map outside_map 60 match address outside_60_cryptomap
crypto map outside_map 60 set peer your.remote.wan.29
crypto map outside_map 60 set transform-set esp-aes-md5
! optionally enable Perfect Forwarding Secrecy.  Disabled by default.  It's more secure, but requires more processor.
crypto map outside_map 60 set pfs group5
! optionally enable aggressive mode (off by default and not encouraged).  Aggressive mode is faster to setup but less secure.
crypto map outside_map 60 set phase1-mode aggressive
!

! Define the tunnel-group peer address and Pre-Shared Key.  This is also where you configure address-pool, deafult-group-policy
tunnel-group your.remote.wan.29 type ipsec-l2l
tunnel-group your.remote.wan.29 ipsec-attributes
pre-shared-key #your.complex.key.here#
!
! Attach it to the outside interface.  Note that you'll use your outside intefaces "ifname" and it IS case sensitive.
! If you already have IPSEC running then this is already done.
crypto map outside_map interface Outside
crypto isakmp enable Outside
!

limiting access for Remote Access IPSec clients on a Cisco ASA

So you have a Cisco ASA and you want to limit a particular user's access.  It's a common scenario and one that's pretty simple to deal with.  This works for 7.2(3) and I believe the commands are the same for 8.x

!! Create the user normally
username BobDobbs password *****

!! Assign the user a static IP.  I use one that is in the same network as the Group's ip pool, but not in the pool.
!! For example if the pool is 192.168.4.2/24 - 192.168.4.60/24, I'd assign this user 192.168.4.61.
username BobDobbs attributes
 vpn-group-policy RA-Client-Policy
 vpn-framed-ip-address x.x.x.x 255.255.255.0

!! Create an ACL which permits the new user's address to do what you want, block them from doing anything else, then allow everyone else (or whatever you deem appropriate)
access-list RA-Client-ACL-01 extended permit ip host x.x.x.x host y.y.y.y
access-list RA-Client-ACL-01 extended deny ip host x.x.x.x any
access-list RA-Client-ACL-01 extended permit ip any any


!! Finally, apply that ACL to the group-policy
group-policy RA-Client-Policy attributes
  vpn-filter value RA-Client-ACL-01
end

Hex to Decimal

Many thanks to Chris Bryant (CCIE #12933) for finally making the decimal to hex conversion easier to understand. Put simply, it's base-16, DUH... It seems obvious, but for some reason this simple fact just didn't sink in until 6:30 this morning.

For example, the hexidecimal number 4A simply means 4 units of 16 plus 10 units of 1, or ((4 * 16)+(10 *1)) which equals 64 + 10 which equals 74.

comments in Vi

Assuming you use a hash mark as a comment delimiter:

comment next 5 lines:  .,+4s/^/#/
comment each line from current line to end of file:  .,$s/^/#/