Wednesday, May 31, 2017

What will @HPE_Labs reveal at #HPEDiscover in Las Vegas this June

Tuesday, May 30, 2017

Monday, May 29, 2017

Sunday, May 28, 2017

Friday, May 26, 2017

Adding services to VMware firewall

These are some of the notes i'd collected from vmware kb site

Creating custom firewall rules in VMware ESXi 5.x

There is a defined set of firewall rules for ESXi 5.x for Incoming and Outgoing connections on either TCP, UDP, or both.

You may be required to open the firewall for the defined port on TCP or UDP that is not defined by default in Firewall Properties under Configuration > Security Profile on the vSphere Client.

This article provides instructions on creating custom firewall rules in ESXi 5.x via the command line.

Note: Custom firewall rules can be created only for those ports that are defined by default in the Firewall Properties under Security Profile on the vSphere Client.

By default, there is a set of predefined firewall rules that can be enabled/disabled for the ESXi host from the vSphere Client.

These firewall services can be enabled/disabled for the defined ports (UDP/TCP) from the vSphere Client. However, if you need to enable the service on a protocol that is not defined, you must create new firewall rules from the command line.

For example, the DNS Client service can be enabled/disabled only on UDP port 53.

To enable DNS for TCP:
1. Open an SSH connection to the host.
2. List the firewall rules by running the command:

# esxcli network firewall ruleset list

Name            Enabled
--------------  -----------------
sshServer       true
sshClient       false
nfsClient       true
dhcp            true
dns             true
snmp            true
ntpClient       false
CIMHttpServer   true
CIMHttpsServer  true
CIMSLP          true
iSCSI           true

Note: On the vSphere Client, the DNS service is open on port 53 for UDP only.

To enable the DNS service on port 53 for TCP:

1. Back up the /etc/vmware/firewall/service.xml file by running the command:

# cp /etc/vmware/firewall/service.xml /etc/vmware/firewall/service.xml.bak

2. Modify the access permissions of the service.xml file to allow writes by running the chmod command:

To allow writes:

# chmod 644 /etc/vmware/firewall/service.xml

To toggle the sticky bit flag:

# chmod +t /etc/vmware/firewall/service.xml

3. Open the service.xml file in a text editor.
4. Add this rule to the service.xml file:

<service id="0032">
<id>DNSTCPOut</id>
<rule id='0000'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<porttype>dst</porttype>
<port>53</port>
</rule>
<enabled>true</enabled>
<required>false</required>
</service>

Rule set configuration file example:

<ConfigRoot>
<service id='0000'>
<id>serviceName</id>
<rule id = '0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<porttype>dst</porttype>
<port>80</port>
</rule>
<rule id='0001'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<porttype>src</porttype>
<port>
<begin>1020</begin>
<end>1050</end>
</port>
</rule>
<enabled>true</enabled>
<required>false</required>
</service>
</ConfigRoot>


5. Revert the access permissions of the service.xml file to the read-only default by running the command:

# chmod 444 /etc/vmware/firewall/service.xml

6. Refresh the firewall rules for the changes to take effect by running the command:

# esxcli network firewall refresh

or

# localcli network firewall refresh

With ESXi 5.1.x, changes to the existing service.xml file is persistent after reboot.

7. List the rules again to confirm by running the command:

# esxcli network firewall ruleset list

Name            Enabled
--------------  -----------------
sshServer       true
sshClient       false
nfsClient       true
dhcp            true
dns             true
snmp            true
ntpClient       false
CIMHttpServer   true
CIMHttpsServer  true
CIMSLP          true
iSCSI           true
DNSTCPOut       true
Notes:
• The new DNSTCPOut firewall rule allows outgoing connections on TCP port 53. New firewall rules and services are also viewable under the Host Configuration section in Security Profile using the vSphere Client.
• ESXi 5.0 Update 1 (build 623860) has a built-in outbound DNS Client running on port 53 (TCP/UDP), which is enabled by default. No action is required to configure DNS client if you are using ESXi 5.0 Update 1.

Extra resources from VMware kb site:

~Sujith Emmanuel

Thursday, May 25, 2017

Disabling vmware firewall

~ # esxcli network firewall get
   Default Action: DROP
   Enabled: true
   Loaded: true
~ # esxcli network firewall set --enabled false
~ # esxcli network firewall get
   Default Action: DROP
   Enabled: false
   Loaded: true
~ # esxcli network firewall unload
~ # esxcli network firewall get
   Default Action: PASS
   Enabled: false
   Loaded: false

~ #

~Sujith Emmanuel

Wednesday, May 24, 2017

Installing SSLyze

Ideally SSLyze should install without much issues.

Command:
pip3 install sslyze

If you get errors regarding cryptography or some certificate errors, try the following
Error: fatal error: openssl/opensslv.h: No such file or directory

pip3 uninstall sslyze
pip3 uninstall cyptography

sudo apt-get update && sudo apt-get install libssl-dev

pip3 install sslyze


Now sslyze commands should work fine if the errors were the ones above.

~Sujith Emmanuel

Tuesday, May 23, 2017

Curl with proxy

How to use curl with proxy:


  1. Method 1:
    1. Use export to set the env variable:
    2. export http_proxy=http://your.proxy.server:port/
    3. export https_proxy=https://your.proxy.server:port/
    4. Now curl should take the proxy from env variable
  2. Method 2:
    1. Use command line option
    2. -x, --proxy <[protocol://][user:password@]proxyhost[:port]>
    3. "-x, --proxy" means that either one can be used
    4. Example: curl -x http://proxy_server:proxy_port --proxy-user username:password -L http://url

~Sujith Emmanuel

Monday, May 22, 2017

Sunday, May 21, 2017

Saturday, May 20, 2017

Friday, May 19, 2017

Thursday, May 18, 2017

A nice video on The Machine from HPE!


The next phase in compute!

Wednesday, May 17, 2017

Tuesday, May 16, 2017

Sunday, May 14, 2017

Saturday, May 13, 2017

Friday, May 12, 2017

Thursday, May 11, 2017

Wednesday, May 10, 2017

Monday, May 08, 2017

Sunday, May 07, 2017

Friday, May 05, 2017

Thursday, May 04, 2017

Wednesday, May 03, 2017

Tuesday, May 02, 2017

Installing SSLyze

SSLyze is a Python tool that can analyze the SSL configuration of a server by connecting to it. It is designed to be fast and comprehensive,...