Mostrando entradas con la etiqueta IDS. Mostrar todas las entradas
Mostrando entradas con la etiqueta IDS. Mostrar todas las entradas
PacketFence  es una solución Open Source preparada para desplegar un Sistema de Control de Acceso en Red, es decir, NAC (Network Access Control). Es una distribución Linux basada en CentOS configurada para proporcionar un completo sistema de control de acceso a redes.
Network Access Control (NAC) is a computer networking solution that uses a set of protocols to define and implement a policy that describes how to secure access to network nodes by devices when they initially attempt to access the network [Wikipedia]-.

Advance Feautures
Características principales:
  • Portal cautivo para autenticación y registro de dispositivos que solicitan el acceso a la red.
  • Soporte 802.1x (FreeRadius included)
  • Gestión centralizada de las redes: cableada e inalámbrica.
  • Integración con SNORT y NESSUS.
  • Soporte VLAN y aislamiento de redes.
  • Autenticación, soporte para (Microsoft Active Directory, Novell eDirectory, OpenLDAP, Cisco ACS
    RADIUS (FreeRADIUS, Radiator, etc.), Local user file).

Estándares soportados:
  • 802.1X
  • Simple Network Management Protocol (SNMP)
  • Standard SNMP management information base (MIB) like BRIDGE-MIB, Q-BRIDGE-MIB, IF-MIB, IEEE8021-PAE-MIB
  • RADIUS
  • Netflow / IPFIX
  • Wireless ISP Roaming (WISPR)

Novedades de la ultima versión (3.6)

  • Integrating with Wireless IDS for Aruba, Motorola, and Ruckus controllers.
  • Adding OAuth2 as a valid authentication on the captive-portal (Google/Facebook/GitHub)
  • Radius Inline feature
  • LLDP support for Cisco switches
  • Better WISPR support (Integrating with Accuris Networks' AccuROAM WISPr Client)

ZONA DE DESCARGA

PacketFence v3.1 se encuentra disponible en varios formatos, destacando la existencia de una versión en VMware instalada y lista para ser desplegada en nuestra red.
ESX/ESXi 4.x Version
Desktop Version (Player 3.1 for Linux/Workstation 7.x for Linux)
Comprueba la ultima versión:



 Documentación


Para facilitar la instalación y puesta en marcha de esta solución NAC, en su página web se pueden encontrar los siguientes documentos:
Si tengo tiempo, !espero sacar algo¡, descargaré la versión VMware e intentaré probar a ver que tal, con los resultados de las pruebas "escribiré un post", aunque no prometo nada ;) ¿Si alguien lo ha probado que nos cuente que tal funciona?

Un Saludo.

Fuente | PacketFence
This article is aimed to Pentesters and Security Auditors.
Security Onion is a Linux distro that contains software used for installing, configuring, and testing Intrusion Detection Systems. It is based on Xubuntu 10.04 and contains: Snort, Suricata, Sguil, Squert, Xplico, Nmap, Scapy, Hping, Netcat, Tcpreplay and many other security tools.

This linux distro is distribute in ISO file (1,2 Gb), it can be used like you want:  DVD-Live, VMware machine, in USB drive or, even, install on hard drive.

 Main Security Tools Description


Now I going to describe the main security tools.

SNORT:  is an open source network intrusion prevention and detection system (IDS/IPS). Combining the benefits of signature, protocol, and anomaly-based inspection.


SURICATA: is a open source next generation Intrusion Detection and Prevention Engine owned by OISF. The Open Information Security Foundation (OISF) is a non-profit foundation organized to build a next generation IDS/IPS engine. The OISF has formed a multi-national group of the leading software developers in the security industry.

SGUIL: is an intuitive GUI that provides access to realtime events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis. Is an Analyst Console for Network Security Monitoring (NSM).

SQUERT: is a web application that is used to query and view event data stored in a Sguil database (typically IDS alert data). Squert is a visual tool that attempts to provide additional context to events through the use of metadata, time series representations and weighted and logically grouped result sets.


XPLICO: is a Internet Traffic Decoder (Network Forensic Analysis Tool). The goal of Xplico is extract from an internet traffic capture the applications data contained. Is a powerful tools for analyzing and interpreting the data captured (Network Monitoring) and shows us in a simple and easy way. With this tools you can analyzed the data more faster than other tools, because you can access to the analyzed data brownsing in graphics views. Usually, xplico is used in Network Forensic Analysis.

Although the distro includes two IDS engine, you can choose what engine want to use in the setup process.

Other Security Tools List

Snort, Suricata, Sguil, Squert, Xplico, Nmap, Scapy, Hping, Netcat, Tcpreplay, Metasploit, Armitage, OSSEC, ngrep, argus, tcpxtract, tcpdump, tshark, wireshark, hping3, vortex, chaosreader, inundator, ostinato, etc ...

What can it be used for? 

  • Security Onion can be used for Intrusion Detection. Simply boot the DVD, double-click the Setup desktop shortcut, and follow the prompts.
  • Security Onion can be used to test an Intrusion Detection System. Simply boot the DVD and use the included tools (such as nmap, scapy, hping, metasploit, and others) to test your existing IDS or to test the included Snort and Suricata IDS/IPS engines.
Conclusions

This linux distro is a great set of tools for Pentester or Security Auditors, specially in a Network Intrusion scene.

I recommend to try it.

For more Information and excellent review (only Spanish) click the following links:

Designed with by Way2themes | Distributed by Blogspot Themes