Why do I wipe my hard drive once a year?

PC security is really an after thought for most users. So why do I wipe my hard drive once a year? Read more

Where to find your Cisco Clean Access logs

Log into the clean access server and cd to

/perfigo/logs/perfigo-redirect-log0.log.0

This is where you will find CAS logs to display recent events on your clean access deployment.

There are three levels of logging

ALL – all logging

INFO – informational messages only

SEVERE – only severe messages (default)

To change the log level drive down to ADMINISTRATION –> CCA MANAGER –> Support Logs

Good luck with your NAC deployment

How to modify the Cisco Clean Access web login page

Cisco clean access web login page can be modified via html editing. I only want to do this to remove the Cisco Clean Access branding from the login page on the bottom left hand corner. Read more

Privacy Policy

Privacy Policy for analysisandreview.com Read more

Red Hat OpenSSH Backdoor Vulnerability

Red Hat, Inc. is a company dedicated to free and open source software, and a major Linux distribution vendor. On August 22, 2008, Red Hat discovered that a website used for downloading updates had been compromised with rogue OpenSSH packages.  These packages contain code that opens a backdoor on the infected system allowing an intruder to gain superuser privileges.  The compromise affects both Red Hat and Fedora Linux distributions.

The  compromise resulted in the posting of a malicous update with the Red Hat signature which was available on some of the  download websites. Red Hat Enterprise Linux systems treated the updates as official, likely installing them automatically without raising any warnings.  Anyone who downloaded a recent copy of OpenSSH, on or before August 22, 2008, and installed the package, may be infected.

Red Hat reported that the problem was associated with download sites other than those of official Red Hat subscribers and that customers who keep their systems updated using Red Hat Network are not at risk.

Recommendations:

The following actions should be taken:

  • Check your system to ascertain if a rogue OpenSSH was installed. Red Hat has provided a web page http://www.redhat.com/security/data/openssh-blacklist.html outlining a process for you to detect a tampered software package.
  • If a rogue OpenSSH package was installed, immediately isolate the system, wipe the system clean and reinstall the operating system and application and apply the vendor update for OpenSSH.
  • Review system and firewall logs to identify anomalous activity associated with the rogue OpenSSH software.

References:

Red Hat:
http://rhn.redhat.com/errata/RHSA-2008-0855.html

SecurityFocus:
http://www.securityfocus.com/bid/30794