Posts
All the articles I've posted.
SSH Weak MAC Algorithms Enabled
Updated:OpenSSH_6.0p1 Edit /etc/ssh/sshd_config add or amend the following: Ciphers aes128-ctr,aes192-ctr,aes256-ctr MACs hmac-sha1,hmac-ripemd160
Nessus Certificates
In order to get your Nessus server to pass a vulnerability scan you'll need to replace the original self-signed cert it uses for its web server. It's easy
Strong Ciphers
Updated:Strong Ciphers for Apache, nginx and Lighttpd https://cipherli.st/ Mozilla SSL Configuration Generator https://mozilla.github.io/server-side-tls/ssl-config
Kali Linux
For penetration testing https://www.kali.org/
Server Message Block (SMB) Protocol Version 1 Unspecified RCE (uncredentialed check)
Updated:Start Powershell as an administrator and run the following to disable SMB Version 1. PS C:\> Get-SmbServerConfiguration | select enablesmb1protocol enables
SSL 64-bit Block Size Cipher Suites Supported (SWEET32)
Updated:Nessus reports a vulnerability because of 64-bit cipher suites and SSL Medium Strength Cipher Suites Supported (even though it shows up as strong ). Window
PacketFence Join Domain
Updated:This has caused me a lot of frustration this morning. The new version of PacketFence doesn't like the externally configured domain configuration that I was forced to use when I first set things up.
SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam)
Updated:Create and set the following registry key value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffi
SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam) - Tomcat
Updated:Disable the ciphers that use Diffie-Hellman by adding !DHE into your ciphers list ciphers="HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA:!3DES:!DHE" Now
SSL 64-bit Block Size Cipher Suites Supported (SWEET32) - Tomcat
Updated:Following on from the Windows vulnerability for SWEET32, Here's how to resolve the same issue with Tomcat 8. This use the OpenSSL format string for ciphers