The Network Stack

August 30, 2017 0 Comments duo, mfa, ubuntu, active-directory

Duo has thorough documentation for adding MFA to your SSH sessions, but there are a couple additional steps needed to also integrate with Active Directory. This post will go through the installation for both Duo and Active Directory for Ubuntu 16.04. For other Linux distros, the Duo documentation linked above has you covered.

System components:

  • Ubuntu 16.04 server
  • Duo MFA account
  • Duo Unix package
  • Centify Express for Active Directory integration

Duo Installation:

Install OpenSSL development headers and libraries:

August 22, 2017 0 Comments

A couple years ago, Ivan Pepelnjak wrote an interesting blog showing how all you need are two top-of-rack switches. Iwan Rahabok followed up on the systems side, with the perspective that 1000 VM per rack is the new minimum.

Now in mid 2017, I'd like to show you how we can fit 2M network routes, 1PB of storage, and over 1000 VM's in a half rack. Don't worry, I included redundancy as well.

Disclaimer: My examples use specific vendor equipment

August 04, 2017 0 Comments powershell, active-directory, windows

Using this page to keep track of all the useful powershell "mini-scripts" I've used:

Copy users from one security group to another security group

Add-ADGroupMember -Identity destination-group-name -Members (Get-ADGroupMember -Identity source-group-name -Recursive)

Add enabled users from an OU to a security group

Get-ADUser -SearchBase 'OU=Your-OU,DC=corp,DC=company,DC=com' -Filter {Enabled -eq $true} | ForEach-Object {Add-ADGroupMember -Identity 'your-group-name' -Members $_ }

Add users from a CSV file to a security group (username column is called "name"

July 23, 2017 0 Comments ansible

For network automation, I believe the best tool out there right now is Ansible. Ansible is open-source, agentless, has a large community, and is easy to get started quickly. For the major networking vendors, there are already pre-built modules making it simple to interface with their equipment. This post will focus on getting Ansible up and running on a Ubuntu 16.04 server (in three steps), and following posts will show how to use Ansible to automate network configuration.

  1. Assuming

June 27, 2017 0 Comments palo alto networks

Palo Alto firewalls have a neat feature called "DBL" - Dynamic Block List. This feature allows the firewall to grab a list of ip addresses or domains from an http page. You have to format the web page cleanly (https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-and-Limitations/ta-p/58795), but it allows you to update the web page dynamically, and the firewall will update it's policy accordingly.

For my use case, we had some new dynamic dev services being tested in

May 26, 2017 0 Comments adfs, duo, mfa

We wanted to implement MFA (multi-factor authentication) for our ADFS servers when authenticating to Office 365. If you just want basic “MFA for all users” then the AD FS GUI will allow you to select your MFA provider and enable. I needed a more granular policy:

Only enable MFA if the user is a member of a specific security group AND the user is coming from outside the corporate network AND it is a browser based authentication request

The third

May 17, 2017 0 Comments cisco

Found a great blog post on installing a demo license on the CSR router (http://www.burningnode.com/2016/02/08/the-csr1000v-license-and-the-100kbps/), but I came across one additional (and important step below).

TL;DR - Make sure to accept the end user agreement and SAVE before reloading!

ip-10-128-228-209#reload
% Unfortunately EULA is not detected for following feature/features:
% security
% Please configure 'license accept end user agreement' and
% use 'write' command to ensure license configurations take effect
% Continue reload will cause
April 13, 2017 0 Comments adfs, windows

If you use ADFS as your primary IdP, you may have noticed that before your users sign in, they have the option to pick the Relying Party they want to sign into under the "Sign in to one of the following sites" radio button. If ADFS is accessible from the internet (which it mostly likely is if you are using Office 365), this is a giant security concern, as it gives an attacker a view into all the external applications