General Security

This category contains 65 posts


BackTracking an Email address.

If you are curious to know where your email came from you can check the headers of the email message and usually trace it to the origin.

In outlook or outlook express, right-click the message and click on properties or options.

Cisco MARS End of Life News

Another disappointing news from Cisco when they announced the end of life for Cisco Security Monitoring, Analysis, and Response System (MARS) without an alternative solution.

Cisco ref. here

Per the announcement

Product Migration Options

There is no replacement available for the Cisco Security Monitoring, Analysis, and Response System at this time.

Customers are encouraged to migrate to the Cisco Security Manager and to the Security Information and Event Management ecosystem partners for their security management needs. For security managed services, customers are encouraged to evaluate Cisco Remote Management Services.
With Cisco Security Agent EOL announcement earlier this year and this now its hard to believe if Cisco is committed towards enhancing network security.

——————————–

Command to reset IPtables firewall in Ubuntu

The following command would reset the firewall rules to allow everyone

iptables -F

or could create a script with the following lines

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

To set default allow rule using ufw:

sudo ufw default allow

To disable ufw completely:

sudo ufw disable

ModSecurity A Free open source Web Application Firewall (WAF)

Traditional firewalls filter traffic  based on protocols and ports, there is some level of protocol inspection as well however we still hear attacks occurring by the attacker using a browser. Unlike the traditional firewall, a web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation.

ModSecurity is a web application firewall that can work either embedded or as a reverse proxy. It provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.