Strikeback with iplog and nmap
-
Strikeback is a package that uses iplog to monitor for port scans or connection attempts that could be malicious. Using the information generated you can determine if a port scan is an attacker or if any action needs to be taken against a particular host. nmap is used to gather more in depth information about possible attackers thus giving pfsense the capability to 'strikeback'
Sidewinder takes pride that they were to first to implement a strikeback capability and until recently they were the only router platform to do so. Now pfsense is among the short list with a strikeback capability.
Version: 1.0 BETA.
If you would like to support these packages please donate at TomSchaefer.org/pfsense
-
What does strikeback do? Fire off the LOIC at source IP? ;D
-
What does strikeback do? Fire off the LOIC at source IP? ;D
:), no. Just like the sidewinder series firewalls are capable of a strikeback, pfsense is now among the few. Sidewinder originally implemented that feature because corporations wanted options when it came to being scanned. pfsense is becoming more and more of a viable solution for corporations. Adding this feature just narrows the gap between pfsense and other solutions out there.
With forensic analytics becoming more significant, and even responses like trace backs, other automated forensics, and reporting, I have enabled pfsense to continue to be on the edge giving the end user or corporation more options that may be parallel with their security requirements.
In other words this package gives you the user more power while making pfsense a competitive platform to other firewall vendors.
-
why / strikeback / parse.php can not be accessed ? Nmap scan results (condensed)
-
Wow, this looks great. I need to give it a try.
-
After reboot strikeback can not run auto. why ??
-
Jul 6 14:58:31 php: /packages/strikeback/strikeback.php: The command '/usr/local/etc/rc.d/iplog start' returned exit code '127', the output was '/usr/local/etc/rc.d/iplog: not found'
Jul 6 14:58:31 php: /packages/strikeback/strikeback.php: The command 'rm /usr/local/etc/rc.d/iplog-e' returned exit code '1', the output was 'rm: /usr/local/etc/rc.d/iplog-e: No such file or directory'
Jul 6 14:58:31 php: /packages/strikeback/strikeback.php: The command '/usr/bin/sed -i -e 's/iplog_enable="NO"/iplog_enable="YES"/g' /usr/local/etc/rc.d/iplog' returned exit code '1', the output was 'sed: /usr/local/etc/rc.d/iplog: No such file or directory'
-
This do look really nice, but i can not get this packet to work.
Have tried to get it to run on two different systems but end up with the same error ??? ???Here is the errors i get on both boxes:
Jul 17 18:37:00 php: /packages/strikeback/strikeback.php: The command 'rm /var/log/iplog' returned exit code '1', the output was 'rm: /var/log/iplog: No such file or directory'
Jul 17 18:37:00 php: /packages/strikeback/strikeback.php: The command 'mkdir /var/run/iplog' returned exit code '1', the output was 'mkdir: /var/run/iplog: File exists'
Jul 17 18:36:59 php: /packages/strikeback/strikeback.php: The command 'rm /usr/local/www/packages/strikeback/ENABLED' returned exit code '1', the output was 'rm: /usr/local/www/packages/strikeback/ENABLED: No such file or directory'Any pointers to get this to work, is much appreciated ;D
-
You have to click on CLEAR LOG and then when it refreshes click on ENABLE strikeback. Not sure why when I click on clear log it disables strikeback. I guess to release the logfile lock so it can clear it.
This will work just fine until the reboot which you have to do that again. It's a first release so give him time to address it. Pretty cool package tho!
Darkk
-
You have to click on CLEAR LOG and then when it refreshes click on ENABLE strikeback. Not sure why when I click on clear log it disables strikeback. I guess to release the logfile lock so it can clear it.
This will work just fine until the reboot which you have to do that again. It's a first release so give him time to address it. Pretty cool package tho!
Darkk
This i as u say really, and to be first release it is really good work.
-
Ok I installed it, but not seeing in the web gui anywhere. Do I have to restart pfsense?
-
Ok I installed it, but not seeing in the web gui anywhere. Do I have to restart pfsense?
Should not need to restart, just click pfsense logo to reload webgui and the it should be under services
-
This do look really nice, but i can not get this packet to work.
Have tried to get it to run on two different systems but end up with the same error ??? ???Here is the errors i get on both boxes:
Jul 17 18:37:00 php: /packages/strikeback/strikeback.php: The command 'rm /var/log/iplog' returned exit code '1', the output was 'rm: /var/log/iplog: No such file or directory'
Jul 17 18:37:00 php: /packages/strikeback/strikeback.php: The command 'mkdir /var/run/iplog' returned exit code '1', the output was 'mkdir: /var/run/iplog: File exists'
Jul 17 18:36:59 php: /packages/strikeback/strikeback.php: The command 'rm /usr/local/www/packages/strikeback/ENABLED' returned exit code '1', the output was 'rm: /usr/local/www/packages/strikeback/ENABLED: No such file or directory'Any pointers to get this to work, is much appreciated ;D
Hi Everyone and tommyboy180, i found the problem for this and it looks like you can not use Opera Browser 11.5 to activate strickback, when i tried to use other browser it works fin. Strange one, anyone else that can confirm this????
-
Ok same problem as other guy, using firefox – WTF would the browser have to do with system not finding stuff?
Jul 18 07:34:41 php: /packages/strikeback/strikeback.php: The command '/usr/local/etc/rc.d/iplog start' returned exit code '127', the output was '/usr/local/etc/rc.d/iplog: not found'
Jul 18 07:34:41 php: /packages/strikeback/strikeback.php: The command 'rm /usr/local/etc/rc.d/iplog-e' returned exit code '1', the output was 'rm: /usr/local/etc/rc.d/iplog-e: No such file or directory'
Jul 18 07:34:41 php: /packages/strikeback/strikeback.php: The command '/usr/bin/sed -i -e 's/iplog_enable="NO"/iplog_enable="YES"/g' /usr/local/etc/rc.d/iplog' returned exit code '1', the output was 'sed: /usr/local/etc/rc.d/iplog: No such file or directory'I pushed the clear log a few times, and sure enough it removes the enabled checkbox.
-
Ok same problem as other guy, using firefox – WTF would the browser have to do with system not finding stuff?
Hehe, jupp this one do not make sense to me either ???
But this behaver is expected, it is a 0.1 beta ;D
-
Don't get me wrong, I completely understand its .1 – looking forward to working out the bugs with you, etc.
Just letting you know getting the same error as other guy. If you want me to try doing it with IE, or any other browser just let me know. But it makes NO sense at all that browser would have anything to do with system reporting it can not find stuff.
Ok tried with IE9, Opera 11, Chrome, Firefox and Safari -- all the same thing, those errors in the system log. You have some other browser you would like me to try it with ;)
-
Hi,
sorry for asking this:
I cannot find this package in package manager. I am using amd64. is this only available for 386? -
Ok same problem as other guy, using firefox – WTF would the browser have to do with system not finding stuff?
Jul 18 07:34:41 php: /packages/strikeback/strikeback.php: The command '/usr/local/etc/rc.d/iplog start' returned exit code '127', the output was '/usr/local/etc/rc.d/iplog: not found'
Jul 18 07:34:41 php: /packages/strikeback/strikeback.php: The command 'rm /usr/local/etc/rc.d/iplog-e' returned exit code '1', the output was 'rm: /usr/local/etc/rc.d/iplog-e: No such file or directory'
Jul 18 07:34:41 php: /packages/strikeback/strikeback.php: The command '/usr/bin/sed -i -e 's/iplog_enable="NO"/iplog_enable="YES"/g' /usr/local/etc/rc.d/iplog' returned exit code '1', the output was 'sed: /usr/local/etc/rc.d/iplog: No such file or directory'I pushed the clear log a few times, and sure enough it removes the enabled checkbox.
Quick fix to get Strikeback running is to:
- Install Strikeback from the package manager
- pkg_add -r iplog
- Edit /usr/local/etc/iplog.conf and change the user from iplog to root
- Enable Strikeback from the UI
-
All those things should be done automatically.
During the install process pkg_add -r iplog is ran. The username is also changed to root (you can also do this via the GUI).
The only thing that I can think of is that when the pkg_add command is ran the command doesn't install iplog due to the freeBSD repo not being contacted or the connection being interrupted.I will be able to look into this more tomorrow.
-
All those things should be done automatically.
During the install process pkg_add -r iplog is ran. The username is also changed to root (you can also do this via the GUI).
The only thing that I can think of is that when the pkg_add command is ran the command doesn't install iplog due to the freeBSD repo not being contacted or the connection being interrupted.I will be able to look into this more tomorrow.
Also I had to manually add nmap .. it didn't pull it in for whatever reason
