Verify Operating Port on IPtables

Verify IPtables service status

[root@paranoid ~]# service iptables
Usage: /etc/init.d/iptables {start|stop|restart|condrestart|status|panic|save}
[root@paranoid ~]# service iptables status Firewall is stopped.

Operating port status verification

[root@paranoid ~]# cat /etc/services | grep 3260
iscsi-target 3260/tcp # iSCSI port
iscsi-target 3260/udp # iSCSI port

OR

[root@paranoid ~]# lsof -i -n -P | grep 3260
fsiscsid 6011 root 4u IPv4 3121761 TCP *:3260 (LISTEN)

Adding IPtables firewall policy to Open port

# vi /etc/sysconfig/iptables
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3260 -j ACCEPT

# service iptables restart @ # /etc/init.d/iptables restart

Commands to manage Novell eDirectory, iManager and UserApplication

Objective : Using command line to manage eDirectory/iManager/UserApplication
Enviroment : SLES10 | eDir 8.83 | iMan 2.72 | IDM 3.6 | UserApp 3.61

Directory Tree : ABC-IDV
O : users, services
CN : abc....

To start/stop eDirectory

/etc/init.d/ndsd start/stop/restart

To start/stop iManager

/etc/init.d/novell-tomcat5 start/stop/restart

To start UserApplication

- Login as admin with default password
- Run /home/admin/userapp/mysql/start-mysql.sh
- Run /home/admin/userapp/start-jboss.sh &

To stop UserApplication

Run /home/admin/userapp/stop-jboss.sh

Additional Commands

/etc/init.d/slpuasa start/stop

WebAccess

iManager : https://x.x.x.x:8443/nps
IDM : http://x.x.x.x:8080/IDM

Websense 6.3 Standalone Installation

Hardware Requirement
500 users and below
- P4 2 GHz
- GB RAM
- 40 GB harddisk and above
- 2 NIC
- win 2000/2003 server
- MSDE or SQL

1000 users
- P4 2.6 GHz
- 2 GB RAM
- 40-80 GB harddisk and above
- 2 NIC
- win 2000/2003 server
- MSDE or SQL

up to 3000 users
- DUAL CPU Xeon 2.6 GHz
- 2 GB RAM
- 80 GB harddisk and above
- 2 NIC
- win 2000/2003 server
- MSDE or SQL

3000 to 5000 users
- DUAL CPU dual core Xeon 3 GHz and above
- 2-3 GB RAM
- 160 GB harddisk and above
- 2 NIC
- win 2000/2003 server
- MSDE or SQL

5000 to 10k users (2 Servers)
- DUAL CPU dual core Xeon 3 GHz and above

- 2-4 GB RAM
- 160 GB harddisk and above (RAID 0 or 5)
- 2 NIC
- win 2000/2003 server
- SQL

Prerequisites and Installation Check list

- Decide - INTEGRATION or STANDALONE MODE?
- MUST set FIXED IP and HOSTNAME
- Install MSDE or SQL2000/2005
- Test access to internet from WS server - MUST have HTTP and DNS access (do nslookup)
- If using STANDALONE MODE, test if port mirroring/hub/network tap is functioning properly. - Use Ethereal or Wireshark to do sniffing and check if you can see all internal IPs appearing.
- Install Websense :Filtering components/Logging and reporting components
- During installation select all relevant Websense components to be installed. DON'T insert license key during installation. Do it after installation.

MSDE

- Must set sa account/password
- Inside setup location locate and configure SETUP.ini file
- Type in: [Options] SAPWD=sa
- Set authentication mode to MIXED MODE
- After installation, go to START--> RUN--> regedit
- Then do a search for 'loginmode'
- Once found, double click login mode, and change entry from 1 to 2

• 0 - native mode
• 1 - windows mode
• 2 - mixed mode

- REBOOT SERVER after installing MSDE!

SQL

-Must set sa password and choose Mixed Mode during installation.

AFTER installing Websense Filtering components
-Insert license key inside WS Manager
- It will automatically start the download for MASTER DB (MDB)
- Once it starts to download, CANCEL the download.
- STOP Filtering Service.
- copy the pre-DOWNLOADED Master Database file (1.1GB) to Program Files--> Websense--> bin directory.

• the pre-dowloaded MDB file should be NO OLDER then 7 days old
  
• File is called Websense (no extension)

- Start Filtering Service.
- Go to WS Manager, click Server-->Database download. It should say LOADING DATABASE.
- Once loaded, all website categories and protocol categories should APPEAR.
- IF USING STANDALONE MODE, Go to WS Manager, Server--> Settings-->Network Agent

• Configure relevant NIC settings (NIC1, NIC2 etc)
• If using SPAN port, there should be 2 NICs, 1 for MONITORING and 1 for Sending BLOCK Packets (reset packets).
• If using HUB, only need ONE NIC. Same NIC configured for MONITORING and BLOCK packets.

Install WS logging/reporting components
- Run installer again
- Select Add components
- Select all three boxes in reporting components

Priority for users/groups/workstations/network ranges when setting POLICIES

- USER
- WORKSTATION
- RANGE
- GROUP
- GLOBAL POLICY

Opening Windows Firewall Ports on PDP via Remote Agent

Objective : Creating package that open Windows Firewall ports and deploy it to selected workstation.
Enviroment : ZENworks Patch Management 6.3/6.4 | MS Windows

Package Creation
- Go to Vulnerabilities ->Packages and click Create.
- In Package Editor main page, enter a name for the package and put in some descriptions on this package in the Description field. Click Next
- Select the operating systems (i.e. Win2k or Win2K3) and click Next
- Click Next in Add files and directories to package page
- Select Command as the type of script and BAT as script language. Click Edit
- Enter the following in the script editor and click OK

etsh firewall add portopening TCP 25253 ZPMTCP enable
etsh firewall add portopening UDP 25253 ZPMUDP enable

- The command appears in the scripting page now. Enable Script Execution Directory and type %TEMP% and click Next.
- Summary of the new package is displayed. Click Next and click Finish

Package Deployment
- Go to -> Vulnerabilities -> Packages and select locally Created Packages. Select Open port 25253 on PDP package and click Deploy.
- In the Devices/Groups Selection page, select the PDP Servers/hosts in which this package needs to be deployed and click Next
- Verify the package selection and click Next
- Accept the terms and conditions of this end user license agreement is selected and click Next
- Select Agent local Time and click Change to modify deployment start time.
- Modify the message where necessary and set other options if required
- Click Finish and package is ready for deployment
- Once agent successfully push to the client click Install