security – Ryan Schulze

WiFi SSIDs on different VLANs

January 27, 2019April 1, 2022Ryannetwork, security, vlan, wifi

Taking a different direction here and trying out a more HowTo style post. I thought I’d do a quick write-up covering WiFi SSIDs on multiple VLANs, something that might be useful in a home setup, separating SSIDs better from one another. While I usually prefer the CLI, a lot of the devices mentioned here only (or mainly) use a web GUI for configuration management, so this posting will include a lot more screenshots than my usual postings. This posting won’t contain anything exciting for people who run and support networks professionally (mostly just a “so what options are available on SOHO hardware?”), and may even be overly simple and assume settings you wouldn’t do in a professional setup. But it is useful for homelab enthusiasts looking to build a more complex setup than “everything on the same VLAN/network” or trying to figure out “how do I use VLANs, give me an example”.

Ubiquiti and Netgear have some reasonable priced network gear that I’ve written about in the past that behave decent in home networks. For out little setup today we will have a WiFi access point with multiple SSIDs, two switches, and a firewall/router. We will be focusing on the configuration of the WiFi Access Point (UniFi AP) , the two Netgear switches (GS105Ev2 / GS108Ev3) and the Ubiquiti Router (Edgerouter X).

Our goal is to have two SSIDs on the access point, one for the “normal” devices (VLAN 1), and one for separate devices (VLAN 178). Since the router to VLAN 178 is on a different switch than the access point we also need to trunk both VLANs across the network. Another way of looking at it, is that we are expanding Subnet/VLAN 178 into our network (but limiting it to the WiFi Access points). 178 doesn’t hold any special meaning, you can use any VLAN number you want, just chose 178 because the subnet in this test setup was 10.0.178.0/24.

Here is a diagram of our test setup:

VLAN 1: The management and main client VLAN
VLAN 178: Subnet 178, 2nd WiFi network

Netgear 1

Port 1: Connection to Netgear 2
Port 5: Access Point

Netgear 2

Port 1: Connection to Netgear 1
Port 8: Edgerouter

Edgerouter

eth0: Connection to Subnet 178
eth1: Connection to Netgear 2

Wireless Configuration

In the UniFi controller go to Settings->Wireless Networks either create a new network or edit an existing one. If you go into the advanced options area, you will find the VLAN setting for that SSID. Activating the option and setting a value means the access point will tag all packets from that SSID to the specified VLAN number.

In the network overview below we see that packets from one network are tagged with VLAN 178, and packets from the other network are untagged (the switch configuration will take care of deciding which VLAN untagged packets are part of).

Netgear Configuration

The Netgear devices only have a VLAN 1 defined by default, so the first step will be to add VLAN 178 to both of them. Enable Advanced 802.1q (VLAN->802.1Q->Advanced->VLAN Configuration), enter the VLAN ID 178 in the box and click on “Add” at the top.

Now let’s move on to the VLAN Membership configuration. To switch settings, just click on the port and it will switch from tagged->untagged->none.

Netgear 1 device

For VLAN 1 we want port 1 to be (T)agged since it is the trunk to the next switch, and all other ports (U)ntagged since they will be dealing with untagged VLAN 1 traffic. The PVID will also be set to 1 for all ports.

For VLAN 178 we want port 1 to be (T)agged since it is the trunk to the next switch, port 5 (T)agged since it is the connection to the access point, and all other ports “none” since none of those ports are part of VLAN 178.

VLAN overview after changing all the settings:

For this scenario it is sane to leave the Port PVID configuration to PVID 1 on all ports. You could change a port to 178 if you are expecting untagged traffic on that port that needs to be in VLAN 178.

Netgear 2 device

Similar configuration as the first switch so I’ll skip the screenshots. Port 1 is the connection to the Netgear 1 device, port 8 is connected to the Edgerouter.

- all ports PVID 1
- VLAN 1 Tagged port 1 and 8, all other ports untagged
- VLAN 178 Tagged port 1 and 8, all other ports none

Edgerouter Configuration:

Make sure the interface switch0 spans all ports you want to use VLANs on. Add the two VLANs 1 and 178. They should show up in the list as switch0.1 and switch0.178, and you can apply firewall rules to these interfaces to restrict traffic if you are doing any routing between the two networks.
We will want to tag everything from Subnet 178 as VLAN 178 on the interface connected to that network (eth0 in our setup), and allow VLAN 178 on the outgoing interface (eth1 in our setup). The Edgerouter doesn’t need us to specifically allow VLANs already set by the PVID, only additional VLANs need to be specified in the vid field.

Where to go from here?

You could put servers or virtual machines in their own subnet/VLAN and then use a firewall to restrict access between the different networks.

Adding more Access Points is straightforward, UniFi automatically applies the wireless configuration to all Access Points it manages, so all you need to do is take care of the switch port configuration.

Adding CVE information to Nmap scans

January 19, 2018April 1, 2022Ryannmap, security

Last week I stumbled across a nice nmap script that adds CVE information from https://vulners.com/ to the results of nmap scans. Since it relies on version information from services it requires you scan the host with -sV

Example: nmap -sV --script vulners host

The github repository is https://github.com/vulnersCom/nmap-vulners/
You can add the script to your nmap installation with dir=/usr/share/nmap/scripts/ ; curl -ksL https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/vulners.nse >> ${dir}vulners.nse && chmod 0644 ${dir}vulners.nse
(or wherever your nmap script directory is, e.g. /usr/local/share/nmap/scripts/ ).

OpenVAS: Using PostgreSQL instead of sqlite

August 16, 2016November 1, 2016Ryanopenvas, postgresql, security, sqlite

When using OpenVAS in larger environments (e.g. lots of tasks and/or lots of slaves) you may have noticed the manager controlling all the slaves/scans can get sluggish or unresponsive at times. In my experience it is often due to the different processes waiting for an exclusive lock on the sqlite database. Fortunately OpenVAS 8 and above also supports using PostgreSQL as a database backend instead of sqlite. I think OpenVAS 7 also had support built-in, but it was still considered experimental.

Documentation on how to use PostgreSQL as the backend is in the OpenVAS svn repository. In a nutshell it is mainly adding -DBACKEND=POSTGRESQL to your cmake when you compile the manager (my cmake line is cmake -DCMAKE_INSTALL_PREFIX=/ -DCMAKE_BUILD_TYPE=Release -DBACKEND=POSTGRESQL ..). I generally only compile the master with PostgreSQL support and leave the slaves to use sqlite (since they don’t have as many concurrent accesses to their database). The documentation also steps you through the permissions you need to set up in PostgreSQL so it can be used by OpenVAS. Don’t forget to make the system aware of your OpenVAS libraries, in my case since I install OpenVAS to / I put /lib64/ in my /etc/ld.so.conf.d/openvas.conf file and then execute ldconfig.

One issue you may run into is migrating data from sqlite to PostgreSQL. There is a migration script in svn that can migrate the data, but it only works for a few older database versions. I assume OpenVAS 9 will contain an updated version of the script when it is released, but until then I wrote a script that uses the OMP protocol to export/store/import some of the settings. Since it only uses OMP to communicate with the master it is backend agnostic. You can use it to export the sqlite data and import it back into a manger using the PostgreSQL backend. It also means that it can only access data you can export via OMP (so no credential passwords/keys). The script will keep references intact (which tasks uses which target/schedule/…). The list of what it exactly imports/exports is on the github page: github.com/ryanschulze/openvas-tools

How to install the latest Nmap for Debian/Ubuntu

August 21, 2013August 27, 2013Ryanbash, nmap, security

A quick & dirty script to download the latest version of nmap (sourcecode) and generate a deb and install it (so that it’s correctly in the package management). Yes, I know this is not much more than a glorified configure && make && checkinstall

#!/bin/bash

# some packages we will need. I put nmap in here to satisfy any dependencies like LUA
apt-get -qqy install checkinstall nmap build-essential

# get latest version
URL='http://nmap.org/dist/'
FILE="$(wget -qO - ${URL}|cut -d\" -f8|grep "tar.bz2"|sort -rn|head -n1)"

INSTALLED="$(dpkg -p nmap|grep Version:|awk '{print $2}')"

echo "Installed version: ${INSTALLED}, Downloaded version: ${FILE/.tar.bz2/}"
read -p "Compile and install new version? [Y/n] " answer
if [[ ${answer,,} = "n" ]] ; then
  exit 0
fi

echo "Downloading ${FILE}"
[[ -e  ${FILE} ]] || wget -qO ${FILE} ${URL}${FILE}
tar -xjf ${FILE}

cd ${FILE/.tar.bz2/}
./configure
if [[ ${FILE} =~ ^nmap-6.40. ]] ; then 
  # fixing an error in the 6.40 ncat Makefile
  sed -i 's/^LUA_LIBS.*/LUA_LIBS = $(top_srcdir)\/..\/liblua\/liblua.a -ldl -lm/1' ncat/Makefile
fi
make &amp;&amp; \
checkinstall -y

echo -e "\n Installed nmap version:"
$(which nmap) --version

#!/bin/bash

# some packages we will need. I put nmap in here to satisfy any dependencies like LUA

apt-get -qqy install checkinstall nmap build-essential

# get latest version

URL='http://nmap.org/dist/'

FILE="$(wget -qO - ${URL}|cut -d\" -f8|grep "tar.bz2"|sort -rn|head -n1)"

INSTALLED="$(dpkg -p nmap|grep Version:|awk '{print $2}')"

echo "Installed version: ${INSTALLED}, Downloaded version: ${FILE/.tar.bz2/}"

read -p "Compile and install new version? [Y/n] " answer

if [[ ${answer,,} = "n" ]] ; then

exit 0

echo "Downloading ${FILE}"

[[ -e ${FILE} ]] || wget -qO ${FILE} ${URL}${FILE}

tar -xjf ${FILE}

cd ${FILE/.tar.bz2/}

./configure

if [[ ${FILE} =~ ^nmap-6.40. ]] ; then

# fixing an error in the 6.40 ncat Makefile

sed -i 's/^LUA_LIBS.*/LUA_LIBS = $(top_srcdir)\/..\/liblua\/liblua.a -ldl -lm/1' ncat/Makefile

make && \

checkinstall -y

echo -e "\n Installed nmap version:"

$(which nmap) --version

Script to start minion in tmux

February 15, 2013Ryanbash, minion, scripting, security, tmux

Minion is a security project from Mozilla (link). It provides a user-friendly web interface to various security scanner tools. There is a webcast demonstrating the software (link).

The software requires a few services to run, and since I like having one script take care of starting everything with the right parameters, I threw together a simple shell script that sets up a tmux session with the services started in windows with the names of the services.

#!/bin/bash

session="minion"
http="0.0.0.0:8000"

cd /opt/minion

#-------------------------------------------------------------------------------

if [[ "$(tmux list-sessions|cut -d: -f1|grep "^${session}$")" == "${session}" ]]
then
  tmux -2 attach-session -t "${session}"
  exit
fi
tmux new-session -s ${session} -d

window="${session}:1"
tmux send-keys -t "${window}" 'top' Enter

window="${session}:2"
tmux new-window -t "${window}" -n "task-engine"
tmux send-keys -t "${window}" 'source env/bin/activate' Enter
tmux send-keys -t "${window}" 'minion-task-engine --debug' Enter

window="${session}:3"
tmux new-window -t "${window}" -n "plugin-service"
tmux send-keys -t "${window}" 'source env/bin/activate' Enter
tmux send-keys -t "${window}" 'minion-plugin-service --debug' Enter

window="${session}:4"
tmux new-window -t "${window}" -n "frontend"
tmux send-keys -t "${window}" 'source env/bin/activate' Enter
tmux send-keys -t "${window}" 'cd frontend' Enter
tmux send-keys -t "${window}" 'python manage.py syncdb' Enter
tmux send-keys -t "${window}" "python manage.py runserver ${http}" Enter

tmux -2 attach-session -t "${session}"

#!/bin/bash

session="minion"

http="0.0.0.0:8000"

cd /opt/minion

#-------------------------------------------------------------------------------

if [[ "$(tmux list-sessions|cut -d: -f1|grep "^${session}$")" == "${session}" ]]

then

tmux -2 attach-session -t "${session}"

exit

tmux new-session -s ${session} -d

window="${session}:1"

tmux send-keys -t "${window}" 'top' Enter

window="${session}:2"

tmux new-window -t "${window}" -n "task-engine"

tmux send-keys -t "${window}" 'source env/bin/activate' Enter

tmux send-keys -t "${window}" 'minion-task-engine --debug' Enter

window="${session}:3"

tmux new-window -t "${window}" -n "plugin-service"

tmux send-keys -t "${window}" 'source env/bin/activate' Enter

tmux send-keys -t "${window}" 'minion-plugin-service --debug' Enter

window="${session}:4"

tmux new-window -t "${window}" -n "frontend"

tmux send-keys -t "${window}" 'source env/bin/activate' Enter

tmux send-keys -t "${window}" 'cd frontend' Enter

tmux send-keys -t "${window}" 'python manage.py syncdb' Enter

tmux send-keys -t "${window}" "python manage.py runserver ${http}" Enter

tmux -2 attach-session -t "${session}"