axsguard Gatekeeper Command Line Interface How To v1.6

Transcription

1 axsguard Gatekeeper

2 Legal Notice VASCO Products VASCO data Security, Inc. and/or VASCO data Security International GmbH are referred to in this document as 'VASCO'. VASCO Products comprise Hardware, Software, Services and Documentation. This document addresses potential and existing VASCO customers and has been provided to you and your organization for the sole purpose of helping you to use and evaluate VASCO Products. As such, it does not constitute a license to use VASCO Software or a contractual agreement to use VASCO Products. Disclaimer of Warranties and Limitations of Liabilities VASCO Products are provided as is without warranty or conditions of any kind, whether implied, statutory, or related to trade use or dealership, including but not limited to implied warranties of satisfactory quality, merchantability, title, non-infringement or fitness for a particular purpose. VASCO, VASCO DISTRIBUTORS, RESELLERS AND SUPPLIERS HAVE NO LIABILITY UNDER ANY CIRCUMSTANCES FOR ANY LOSS, DAMAGE OR EXPENSE INCURRED BY YOU, YOUR ORGANIZATION OR ANY THIRD PARTY (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF data) ARISING DIRECTLY OR INDIRECTLY FROM THE USE, OR INABILITY TO USE VASCO SOFTWARE, HARDWARE, SERVICES OR DOCUMENTATION, REGARDLESS OF THE CAUSE OF THE LOSS, INCLUDING NEGLIGENCE, EVEN IF VASCO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, OR IF THEY WERE FORESEEABLE. OUR MAXIMUM AGGREGATE LIABILITY TO YOU, AND THAT OF OUR DISTRIBUTORS, RESELLERS AND SUPPLIERS SHALL NOT EXCEED THE AMOUNT PAID BY YOU FOR THE PRODUCT. THE LIMITATIONS IN THIS SECTION SHALL APPLY WHETHER OR NOT THE ALLEGED BREACH OR DEFAULT IS A BREACH OF A FUNDAMENTAL CONDITION OR TERM, OR A FUNDAMENTAL BREACH. THIS SECTION WILL NOT APPLY ONLY WHEN AND TO THE EXTENT THAT APPLICABLE LAW SPECIFICALLY REQUIRES LIABILITY DESPITE THE FOREGOING EXCLUSIONS AND LIMITATIONS. Intellectual Property and Copyright VASCO Products contain proprietary and confidential information. VASCO data Security, Inc. and/or VASCO data Security International GmbH own or are licensed under all title, rights and interest in VASCO Products, updates and upgrades thereof, including copyrights, patent rights, trade secret rights, mask work rights, database rights and all other intellectual and industrial property rights. No part of these Products may be transferred, disclosed, reproduced or transmitted in any form or by any means, electronic, mechanical or otherwise, for any purpose, except as expressly permitted by VASCO or its authorized licensee in writing. This document is protected under US and international copyright law as an unpublished work of authorship. No part of it may be transferred, disclosed, reproduced or transmitted in any form or by any means, electronic, mechanical or otherwise, for any purpose, except as expressly permitted in writing by VASCO or its authorized licensee. Trademarks VASCO, VACMAN, IDENTIKEY, axsguard, DIGIPASS, and are registered or unregistered trademarks of VASCO data Security, Inc. and/or VASCO data Security International GmbH in the U.S. and other countries. Other company brand or product names or other designations, denominations, labels and/or other tags, titles, as well as all URLs (Internet addresses) linked to such designations or communications (irrespective of whether protected by intellectual property law or not), mentioned in VASCO Products may be the trademarks or registered trademarks or be part of any other entitlement of their respective owners. Radius Disclaimer Information on the RADIUS server provided in this document relates to its operation in the axsguard Gatekeeper environment. We recommend that you contact your NAS/RAS vendor for further information. Copyright 2009 VASCO data Security, Inc, VASCO data Security International GmbH All rights reserved VASCO Data Security. 2

3 Table of Contents Table of Contents 1 Introduction Audience and Purpose of this document What is the axsguard Gatekeeper? About VASCO Console Tool Local Access Overview Connecting a Keyboard and Screen Enabling Console Tool Access Connecting to the Console Tool Console Tool Remote Access Overview Downloading and Installing the Required Software The Windows PuTTY Client SSH in Linux The Windows PuTTY Key Generator Linux SSH Key Generator Generating Key Pairs What is a Key Pair? What is a Key Fingerprint? Generating a Key Pair with PuTTYgen Generating a Key Pair with ssh-keygen Enabling Console Tool Access Connecting to the Console Tool Using Windows PuTTY Using the Secure Shell Console Tool Menus Overview Console Menu Navigation State & Information Interfaces System Menu Factory Default Settings Utilities Menu VASCO Data Security. 3

4 Table of Contents 5 Console Commands Overview Network Configuration with ip Network Configuration with ifconfig Testing Connectivity with ping Packet Tracing with traceroute Bandwidth Usage with iftop Extracting Log Information with grep Viewing Log Entries with tail Analyzing Network Traffic with tcpdump Matching Network Traffic with tcpdump Examples Copying Files Overview Downloading and Installing the required Software WinSCP for Windows SCP for Linux Software Configuration and Use WinSCP Configuration Using WinSCP Using SCP in Linux Analyzing Files with Wireshark Overview Downloading and Installing Wireshark Using Wireshark Troubleshooting Support procedure Overview If you encounter a problem Return procedure if you have a hardware failure VASCO Data Security. 4

5 Table of Contents Illustration Index Image 1: Connectors for Display and Keyboard...11 Image 2: Enabling Console Tool Access...12 Image 3: Console Login Screen...13 Image 4: Windows PuTTY Client...14 Image 5: SSH Man Page...15 Image 6: Windows PuTTYgen Application...16 Image 7: Key Fingerprint Example...17 Image 8: Generating a Public Key with PuTTYgen...18 Image 9: Generating a Key Pair with ssh-keygen...19 Image 10: Enabling Console Tool Access...20 Image 11: PuTTY: Importing the Private Key...21 Image 12: PuTTY: Making a Connection...21 Image 13: Console Tool Main Menu...22 Image 14: System Load...24 Image 15: Network Interface Settings...24 Image 16: Factory Default Option...26 Image 17: Command Line Interface...27 Image 18: ifconfig command output...29 Image 19: Example ping command...30 Image 20: iftop command output...32 Image 21: tcpdump output example...36 Image 22: WinSCP Login Screen...38 Image 23: scp man page...39 Image 24: WinSCP Configuration Settings...40 Image 25: WinSCP Advanced Settings...41 Image 26: Saving WinSCP Session Settings...41 Image 27: WinSCP Login...42 Image 28: Accepting the Server Host Key...42 Image 29: Private Key Password...43 Image 30: WinSCP Main Screen...43 Image 31: WinSCP Copying a File...44 Image 32: Using scp to copy Files...45 Image 33: Wireshar Donwload...46 Image 34: Windows Vista Signature Warning...47 Image 35: Windows Vista Allowing Installations...47 Image 36: Completing the Installation VASCO Data Security. 5

6 Table of Contents Image 37: Starting Wireshark...49 Image 38: Wireshark File Menu...49 Image 39: Selecting and Opening a File with Wireshark...50 Image 40: File Analysis...50 Image 41: Setting the Administrator Level...51 Image 42: User Login Enabled VASCO Data Security. 6

7 Table of Contents Index of Tables Table 1: State & Information: Overview of Menu Items...23 Table 2: Overview of System Load Values...24 Table 3: Overview or Network Settings Submenus...25 Table 4: ip command...28 Table 5: ifconfig command...29 Table 6: Overview of ping command options...30 Table 7: Overview of traceroute options...31 Table 8: Overview of iftop command arguments...32 Table 9: Overview of grep command arguments...33 Table 10: Overview of tail arguments...34 Table 11: Overview of tcpdump arguments...35 Table 12: WinSCP Configuration Settings...40 Table 13: SCP Parameters VASCO Data Security. 7

8 1 Introduction 1.1 Audience and Purpose of this document Introduction This axsguard Gatekeeper guide serves as a reference source for technical personnel and / or system administrators. It explains the use of the axsguard Gatekeeper console tool, which is used for advanced troubleshooting. In sections 1.2 and 1.3, we introduce the axsguard Gatekeeper and VASCO. In section 2, we introduce the axsguard Gatekeeper console tool and explain how to access the console tool locally, by connecting a keyboard and monitor to the axsguard Gatekeeper. In section 3, we explain how to access the console tool remotely via Windows PuTTY and the Secure Shell (SSH). In section 4, we explain how to navigate through the console tool menus, describing each menu in detail and how to restore the axsguard Gatekeeper to the factory default settings. In section 5, we take a closer look at some crucial console commands. Each command is illustrated with one or more examples. We also explain how to save network traffic to files. The saved files can be copied to the location of your choice for further analysis. In section 6, we explain how to copy files, such as log files and network traffic files from the axsguard Gatekeeper to a local machine, using WinSCP in Windows and the scp command in Linux. In section 7, we explain how to download and install Wireshark, a network traffic analyzer which can be used to examine files generated with tcpdump in the console tool. In section 8, we provide some solutions to solve difficulties. In section 9, we explain how to request support, and return hardware for replacement. Other documents in the set of axsguard Gatekeeper documentation include: axsguard Gatekeeper Installation Guide, which explains how to set up the axsguard Gatekeeper, and is intended for technical personnel and / or system administrators. 'How to guides', which provide detailed information on configuration of each of the features available as 'add-on' modules (explained in the next section). These guides cover specific features such as: axsguard Gatekeeper Authentication axsguard Gatekeeper Firewall axsguard Gatekeeper Single Sign-On axsguard Gatekeeper VPN axsguard Gatekeeper Reverse Proxy axsguard Gatekeeper Directory Services Access to axsguard Gatekeeper guides is provided through the permanently on-screen Documentation button in the axsguard Gatekeeper Administrator Tool. 8

9 Introduction Further resources available include: Context-sensitive help, which is accessible in the Administrator Tool through the Help button. This button is permanently available and displays information related to the current screen. Training courses covering features in detail can be organized on demand. These courses address all levels of expertise. Please see for further information. Welcome to axsguard Gatekeeper security. 9

10 1.2 Introduction What is the axsguard Gatekeeper? The axsguard Gatekeeper is an authentication appliance, intended for small and medium sized enterprises. In addition to strong authentication, the axsguard Gatekeeper has the potential to manage all of your Internet security needs. Its modular design means that optional features can be purchased at any time to support, for example, , Web access and VPN management. The axsguard Gatekeeper can easily be integrated into existing IT infrastructures as a stand-alone authentication appliance or as a gateway providing both authentication services and Internet Security. Authentication and other features such as firewall, and Web access, are managed by security policies, which implement a combination of rules, for example, whether a user must use a Digipass One-Time Password in combination with a static password for authentication. Security Policies are applied to specific users or groups of users and can also be applied to specific computers and the entire system. 1.3 About VASCO VASCO is a leading supplier of strong authentication and Electronic Signature solutions and services specializing in Internet Security applications and transactions. VASCO has positioned itself as a global software company for Internet Security serving customers in more than 100 countries, including many international financial institutions. VASCO s prime markets are the financial sector, enterprise security, e-commerce and egovernment. Over 50 of VASCO s client authentication technologies, products and services are based on the VASCO s one and unique core authentication platform: VACMAN. VASCO solutions comprise combinations of the VACMAN core authentication platform, IDENTIKEY authentication server, axsguard authentication appliances, DIGIPASS client Password and Electronic Signature software and DIGIPASS PLUS authentication services. For further information on these security solutions, please see 10

11 Console 2 Console Tool Local Access 2.1 Overview Tool Local Access The console tool is a text-based command line interface (CLI) to edit and display critical axsguard Gatekeeper settings and variables via menus. It also allows to execute commands for advanced troubleshooting, such as network traffic analysis. In this chapter, we explain how to access the axsguard Gatekeeper console. There are two methods to access the axsguard Gatekeeper console: Local Access: by connecting a keyboard and monititor to the axsguard Gatekeeper. Access should be granted first via the axsguard Gatekeeper Administrator Tool. Remote Access: by granting remote console tool access to a user via the axsguard Gatekeeper Administrator Tool. The user logs on from a remote PC to the axsguard Gatekeeper. This is explained in chapter Connecting a Keyboard and Screen You can access the console tool locally by connecting a keyboard and monitor to the connectors on the back of the axsguard Gatekeeper appliance (see the image below). Before you can access the console tool, you should enable console tool access for the user, as explained in section 2.3 or use the sysadmin account, as explained in the axsguard Gatekeeper Getting Started and System Administration guides. These guides can be accessed by clicking on the permanently available Documentation button in the Administrator Tool. Image 1: Connectors for Display and Keyboard Notes USB keyboards are not supported until further notice. QWERTY (US) is the default keyboard layout. 11

12 Console 2.3 Tool Local Access Enabling Console Tool Access Cautions This procedure does not apply to the sysadmin user account. The console tool is only accessible to Basic Administrators or above and the sysadmin user. Detailed information about the sysadmin user account is available in the axsguard Gatekeeper Getting Started and System Administration guides, which can be accessed by clicking on the permanently available Documentation button in the Administrator Tool. This section explains how to enable access to the axsguard Gatekeeper console for an administrator: 1. Log on to the axsguard Gatekeeper with an advanced administrator account, as explained in the axsguard Gatekeeper System Administration How To, which can be accessed by clicking on the permanently available Documentation button in the Administrator Tool. 2. Navigate to Users&Groups > Users. 3. Click on the administrator who requires access to the axsguard Gatekeeper console. 4. Click on the axsguard Gatekeeper Administration Tab (see Image 2). 5. Check the ConsoleTool Access option (see Image 2). No key is required for direct access. 6. Click on Update. Image 2: Enabling Console Tool Access 12

13 Console 2.4 Tool Local Access Connecting to the Console Tool Once the boot process is complete, press Alt + F2 to log on to the axsguard Gatekeeper console. The following screen will appear. Image 3: Console Login Screen You can log on with the sysadmin user account or an administrator who has console tool access (see section 2.3). Notes Detailed information about the sysadmin account is available in the axsguard Gatekeeper Getting Started and System Administration guides, which can be accessed by clicking on the permanently available Documentation button in the Administrator Tool. The console tool menus are explained in chapter 4. 13

14 Console 3 Console Tool Remote Access 3.1 Overview Tool Remote Access In this section, we explain the prerequisites to successfully log on to the axsguard Gatekeeper console from a PC in your network. Topics covered in this section include: The downloading and installation of required clients and key generators. How to generate key pairs. The required axsguard Gatekeeper configuration settings. How to connect to the axsguard Gatekeeper console tool. 3.2 Downloading and Installing the Required Software In this section, we explain how to download and install the necessary client software and key generators, required to connect to the axsguard Gatekeeper console tool The Windows PuTTY Client PuTTY is an SSH (Secure Shell) and Telnet client, developed for Windows platforms. PuTTY is open source software and is freely available on the Internet. SSH is explained in section PuTTY can be downloaded free of charge from the following site: PuTTY does not need to be installed like any other classic Windows program (running setup.exe or install.exe). Just download the executable and save it to the desired location. Double-click the PuTTY application icon to start. When PuTTY is started, a screen similar to Image 4 appears. Image 4: Windows PuTTY Client 14

15 Console Tool Remote Access SSH in Linux SSH stands for Secure Shell. SSH is a free program allowing users to securely log on to another computer on the Internet or in a LAN. SSH is an encrypted shell connection, which is entirely command line based and which uses the Public Key Infrastructure (PKI). PKI is the general term used to describe the technical equipment and the processes used by asymmetric encryption. On most Linux distributions, the SSH client is installed by default. Please refer to the documentation of your Linux distribution for downloading and installing instructions, if needed. SSH is entirely command line-based. Detailed information is available in the SSH man pages (see Image 5). Just type man ssh in a Linux console for help. The syntax used to access the axsguard Gatekeeper console tool is: ssh user_name@the_lan_ip_address_of_your_axsguard Gatekeeper Examples are provided further in this guide. Image 5: SSH Man Page 15

16 Console Tool Remote Access The Windows PuTTY Key Generator PuTTYgen is a freely available RSA and DSA key pair generator, manager and converter for use with the Windows PuTTY client (see section 3.2.1). PuTTYgen is required to generate the necessary key pairs to access the axsguard Gatekeeper console tool. PuTTYgen can be downloaded from the following site: PuTTYgen does not need to be installed like any other classic Windows program (running setup.exe or install.exe). Just download the executable and save it to the desired location. Double-click the PuTTYgen application icon to start. When PuTTYgen is started, a screen similar to Image 6 appears. Image 6: Windows PuTTYgen Application 16

17 Console Tool Remote Access Linux SSH Key Generator ssh-keygen is a Linux command to generate, manage and convert RSA and DSA authentication keys. It supports the creation of keys for the SSH protocol versions 1 and 2. On many Linux distributions, the SSH key generator (ssh-keygen) is installed by default. Please refer to the documentation of your Linux distribution for downloading and installing instructions, if necessary. For detailed information about the ssh-keygen command, consult the appropriate man pages by typing man ssh-keygen in a Linux console. The basic syntax used to generate a key pair for the axsguard Gatekeeper console is: ssh-keygen 3.3 Generating Key Pairs What is a Key Pair? A Key Pair is a pair of digital keys: a public key, which needs to be copied to the axsguard Gatekeeper and a unique private key, which needs to be saved on the client workstation. The private key should be secured and not be accessible to anyone but the intended user. A Public Key can easily be identified by its Key Fingerprint (see section 3.3.2). Both keys are required for encrypting the connection between the client and the axsguard Gatekeeper. The keys have the following properties: One key is used to encrypt a message, the other key is used to decrypt the message. Even if the Public Key is known, it is virtually impossible to discover or deduct the Private Key. This is why it is crucial to protect your Private Key with a password What is a Key Fingerprint? A Key Fingerprint is a uniquely identifying string of numbers and characters or ASCII art (see Image 7), which enables a connecting user to easily identify the Public Key of a server. Public keys can be extremely lenghty and difficult to read. The Key Fingerprint is used so that the server can be initially and easily identified by a user on the client side. This is and extra security feature to prevent man-in-the-middle attacks. Image 7: Key Fingerprint Example 17

18 Console Tool Remote Access Generating a Key Pair with PuTTYgen Cautions It is highly recommended to protect your Private Key with a Password. The private key should not be accessible to anyone but the intended user. PuTTYgen automatically adds extra information to the Public Key when it is saved to a file. This extra information cannot be entered on the axsguard Gatekeeper, otherwise the SSH connection will fail. Always use copy/paste to add the Public Key. In this section, we explain how to generate a Key Pair with the PuTTYgen program for Windows. 1. Double Click on the puttygen icon on your desktop. 2. Enter the number of desired bits (size) for the key you are about to generate. The default is 1024 bits (see Image 8). The higher the number, the stronger the key. 3. Select the type of key to generate, e.g. SSH 2 RSA (program default). 4. Enter a key passphrase to protect your Private Key. Confirm the passphrase. 5. Click on the Generate button. 6. Move your mouse to generate random bits. When finished, the Public Key and the Key Fingerprint are displayed (see Image 8). 7. The generated Public Key has to be entered on the axsguard Gatekeeper (see section 3.4). Use copy / paste to do this. Do not copy the contents of a saved Public Key file. (see caution above). 8. Save the Private Key to a folder of your choice, preferably a private folder which nobody else can access. Image 8: Generating a Public Key with PuTTYgen 18

19 Console Tool Remote Access Generating a Key Pair with ssh-keygen Caution It is highly recommended to protect your Private Key with a Password. The private key should not be accessible to anyone but the intended user. In this section, we explain how to generate a Key Pair with the ssh-keygen command(linux). 1. Start a Linux console. 2. Type ssh-keygen without any arguments and press enter. 3. Enter the location (directory and filename) in which the private key should be saved, e.g. /home/yourhomedirectory/.ssh/axsguard. 4. Enter a password for the Private Key. 5. Confirm the password. When finished, the Key file names, locations and the Public Key Fingerprint is displayed (see Image 9). The contents of the pub file need to be entered on the axsguard Gatekeeper (see section 3.4). The pub file contains the Public Key. Image 9: Generating a Key Pair with ssh-keygen Note If invoked without any arguments, ssh-keygen generates an RSA key for use with SSH protocol 2 connections. Please refer to the ssh-keygen man pages for specific options and supported key types. 19

20 Console 3.4 Tool Remote Access Enabling Console Tool Access Caution The console tool is only accessible to Basic Administrators or above and the sysadmin user. This section explains how to enable access to the axsguard Gatekeeper console for an administrator: 1. Log on to the axsguard Gatekeeper with an advanced administrator account, as explained in the axsguard Gatekeeper System Administration How To, which can be accessed by clicking on the permanently available Documentation button in the Administrator Tool. 2. Navigate to Users&Groups > Users. 3. Click on the administrator who requires access to the axsguard Gatekeeper console. 4. Click on the axsguard Gatekeeper Administration Tab (see Image 10). 5. Check the ConsoleTool Access option (see Image 10). 6. Enter the generated Public DSA/RSA key (generated with PuTTYgen or ssh-keygen), using copy/paste (see Image 10). 7. Click on Update. Image 10: Enabling Console Tool Access The console tool access can now be accessed by the selected administrator. The procedure is explained in section 3.5. Note If an invalid Key is entered, the axsguard Gatekeeper generates an error message. 20

21 Console 3.5 Connecting to the Console Tool Using Windows PuTTY Tool Remote Access To access the axsguard Gatekeeper console with Windows PuTTY: 1. Double click on the PuTTY executable icon on your desktop (or in the folder where the PuTTY client is located). 2. Navigate to Connection > Data and enter the axsguard Gatekeeper user name in the Auto-login username field. This is the user for whom console tool access has been enabled (see section 3.4). Make sure to use the correct cases, since user names are case sensitive. 3. Navigate to Connection > SSH > Auth and add the correct Private Key for the user with the Browse button (see below). Image 11: PuTTY: Importing the Private Key 4. Navigate to Session and enter the LAN IP address of the axsguard Gatekeeper, e.g and press enter. Image 12: PuTTY: Making a Connection 21

22 Console Tool Remote Access Tips A PuTTY session can be saved, so that the entered connection information can be recycled for future use. When the information is entered, navigate to Session, enter a name in the Saved Sessions field and click on Save (see Image 12). If you Private Key is password protected (recommended), you should enter the password before connecting to the axsguard Gatekeeper console tool Using the Secure Shell To access the axsguard Gatekeeper console using the Secure Shell (SSH) client in Linux: 1. Start a console in your Linux Window Manager, for instance xterm. 2. Enter the following command. Specify the Private Key with the -i parameter, e.g.: ssh -i /home/yourhomedir/.ssh/axsguard admin@ Notes If you protected the Private Key with a password (recommended), you will be prompted to enter it before the connection can be established. Replace yourhomedir with the correct path. Replace admin with the user for whom you allowed access to the axsguard Gatekeeper console tool. Image 13: Console Tool Main Menu 22

23 Console Tool 4 Console Tool Menus 4.1 Overview Menus This section explains the console tool (sub)menus. Topics covered in this section include: Navigating the console tool menus. The State & Information menu. The Interfaces menu. The System menu. Returning to factory default settings. The Utilities menu. 4.2 Console Menu Navigation You can navigate through the (sub)menus with the up and down arrow keys.press enter to select a particular (sub)menu. Use the tab key to switch between the ok and the back buttons. 4.3 State & Information The State and Information menu provides access to several submenus, which display axsguard Gatekeeper system information such as the current system time, the system's uptime, the axsguard Gatekeeper serial number, the routing table and information about the hardware. Table 1: State & Information: Overview of Menu Items Menu Item Desciption Date and Time This submenu displays the current system date in the MM/DD/YY format. The current system time is displayed in the HH:MM:SS format. Uptime Displays the system's uptime and load average. The load average is conventionally given as three numbers that represent the system load during the last one, five and fifteen minute periods (see Image 14 and Table 2 on page 24). Serial Number Displays the serial number of your axsguard Gatekeeper. It corresponds to the information which can be found in the Administrator Tool, by navigating to System > Status > System Info. Routing Table Displays the Routing Table of the axsguard Gatekeeper. It corresponds to the information which can be found in the Administrator Tool, by navigating to Network > Status > Route Table. PCI Devices Displays information about the hardware of your axsguard Gatekeeper, such as the brand and type of the USB controllers and network interfaces. 23

24 Console Tool Menus Image 14: System Load Table 2: Overview of System Load Values Load 4.4 Desciption Load < 1 There are no processes waiting to use the axsguard Gatekeeper CPU(s). The number of processes to be handled is inferior to the CPU capabilities. Load = 1 The axsguard Gatekeeper CPU(s) does not have any waiting processes The processes are handled as soon as they are invoked. The operation is optimal. Load > 1 The number of processes to be handled are temporarily exceeding the capabilities of the axsguard Gatekeeper CPU(s). The processes are placed in a queue. Interfaces The Interfaces menu allows you to view and modify the following axsguard Gatekeeper network settings: IP addresses of the axsguard Gatekeeper Ethernet (physical) interfaces. IP addresses of virtual interfaces (VLANs), if any. Network interface drivers. Physical interfaces are labeled as eth0, eth1, eth2, etc. Virtual interfaces (VLANs) are labeled as eth0.12, eth0.13, etc. Select the desired interface and press enter. The information in this menu corresponds to the information which can be found in the Administrator Tool, in the IP Settings Tab of a network device under Network > Devices > Eth. An overview of the submenus is available in. Image 15: Network Interface Settings 24

25 Console Tool Menus Table 3: Overview or Network Settings Submenus Submenu Desciption Information The device name of the interface which is currently selected, e.g. eth0. Change IP Select this submenu to change the IP address and subnet mask for the selected network interface. Use the CIDR notation, e.g /24. A system reboot is required in order to activate the new IP address and subnet mask. Switch to other Device Select this submenu to change the driver for the selected network interface. A system reboot is required. Caution Do not modify the driver settings, unless when specifically advised by VASCO technical experts. Note Some of the device drivers (ADSL) are reserved for systems which are only available in the BENELUX. 4.5 System Menu The System menu allows you to: Reboot the axsguard Gatekeeper, in case you cannot access the Administrator Tool. Shut down the axsguard Gatekeeper, in case your cannot access the Administrator Tool. Restore the axsguard Gatekeeper to its factory default settings (explained in section 4.6). 4.6 Factory Default Settings You can reset the axsguard Gatekeeper to its factory default settings (see Image 16) via the System menu. Caution Make sure to back up all your configuration and user data before restoring the axsguard Gatekeeper to its factory default settings. Details about backing up your axsguard Gatekeeper configuration and user data is available in the axsguard Gatekeeper System Administration How To, which can be accessed by clicking on the permanently available Documentation button in the Administration Tool. 25

26 Console Tool Menus Image 16: Factory Default Option Resetting the axsguard Gatekeeper to the factory default settings will: Reset the IP addresses of all axsguard Gatekeeper network interfaces to their factory default settings. (For more information, see the axsguard Gatekeeper Getting Started guide and the System Administration How To, which can be accessed by clicking on the permanently available Documentation button in the Administrator Tool). Clear the customer information. Delete all users, groups and computers. Delete all user data, such as s. Delete all custom firewall, web access, mail rules and policies. Remove all VPN configurations, users and tunnel definitions. Remove all authentication rules and policies. Remove all anti-virus and anti-spyware updates. Remove the latest IPS rulesets. Remove all DNS entries in the DNS repository. Remove all bandwidth management schemes. Reset the sysadmin password to its default setting. Note The list above is non-exhaustive. 26

27 Console Tool 4.7 Menus Utilities Menu Select this menu to access to the axsguard Gatekeeper command shell (command line interface). The command shell allows you to execute commands for advanced troubleshooting and analysis. The most important commands are explained in section 5. Image 17: Command Line Interface 27

28 Console Commands 5 Console Commands 5.1 Overview This section explains the most important console commands used to: Display the configuration of a axsguard Gatekeeper network devices using the ip and ifconfig commands. Extract specific system information from axsguard Gatekeeper system logs, such as the Firewall logs, using the grep and tail commands. Analyze network traffic on the axsguard Gatekeeper using the tcpdump command. 5.2 Network Configuration with ip Cautions The ip command should not be used to change any IP settings. Use the Administrator Tool or the Interfaces menu (see section 4.4) instead. The ip command allows administrators to display information about the axsguard Gatekeeper routing tables and network devices for: All available axsguard Gatekeeper network interfaces. A specific axsguard Gatekeeper network interface. Table 4: ip command Command Description ip addr list This displays the information for all available axsguard Gatekeeper network interfaces. ip addr list eth0 This displays the information for a specific axsguard Gatekeeper network interface, e.g. eth0 (see Image 42). link/ether: The MAC address of the specified network interface, e.g. 00:0C:29:38:24:16. inet: The IP address and subnet mask (CIDR notation) of the specified network interface, /24. brd: The Broadcast IP address of the subnet to which the interface is assigned, Note The ip command as described above also displays IP alias information (secondary eth0), if any. 28

29 Console Commands 5.3 Network Configuration with ifconfig Cautions The ifconfig command should not be used to change any IP settings. Use the Administrator Tool or the Interfaces menu (see section 4.4) instead. Aliases are not shown when using ifconfig. Use the ip command to display alias information (see section 5.2). The ifconfig command is used to display the axsguard Gatekeeper network interface information. You can display information for: All available axsguard Gatekeeper network interfaces. A specific axsguard Gatekeeper network interface. Table 5: ifconfig command Command Desciption ifconfig If no arguments are given, ifconfig displays the status of all active network interfaces, physical and virtual (VLANs). ifconfig eth0 This command only displays the information for the eth0 device. If eth1 is given as an argument, only the information for the eth1 device is displayed, etc. Hwaddr: The MAC address of the specified network interface, e.g. 00:0C:29:38:24:16 inet addr: The IP address of the specified network interface, e.g Bcast: The Broadcast IP address of the subnet to which the interface is assigned, e.g Mask: The Subnet Mask or network segment in which the interface operates, e.g Image 18: ifconfig command output 29

30 Console Commands 5.4 Testing Connectivity with ping ping is a network tool to test if a given host is reachable across an IP network; it is also used to self test the network interface card of the computer or even as a speed test. It works by sending ICMP echo request packets to the target host and listens for ICMP echo response replies. ping measures the round-trip time and records any packet loss. When finished, a statistical summary of the received echo response packets is displayed. You can use the ping command: Without options: the ping command runs with default settings until it is interrupted. With options: the ping command adopts a different behavior according to the specified options (see Table 6). Note Options are cases sensitive. Press Ctrl + C to exit. Table 6: Overview of ping command options Option Desciption -b Allows you to ping a broadcast address to check which hosts are alive (up), e.g. ping -b c Executes the ping command for the number of times specified, e.g. ping -c I Execute the ping command from a specific network device, e.g. ping -I Image 19: Example ping command 30

31 Console Commands 5.5 Packet Tracing with traceroute traceroute is a network tool used to determine the route taken by packets across an IP network. traceroute works by increasing the "time-to-live" value of each successive batch of packets sent. The first three packets have a time-to-live (TTL) value of one (implying that they are not forwarded by the next router and make only a single hop). The next three packets have a TTL value of 2, and so on. When a packet passes a host, its TTL value is decremented by one and the packet is forwarded to the next host. You can use the traceroute command: Without options: the traceroute command runs with its default settings. With options: the traceroute command adopts a different behavior according to the specified options (see Table 7). Note Options are cases sensitive. Table 7: Overview of traceroute options Option Desciption -i Specifies the interface through which traceroute should send packets, e.g. traceroute -i eth1 By default, the interface is selected according to the routing table. -m Specifies the maximum number of hops (max time-to-live value) traceroute will probe, e.g. traceroute -m 15 The default is

32 Console Commands 5.6 Bandwidth Usage with iftop iftop listens to network traffic on the specified axsguard Gatekeeper network interface and displays it in a table. You can use the iftop command: Without arguments: iftop listens on the first active axsguard Gatekeeper network interface (typically eth0) and displays a table of current bandwidth usage per host pair. With arguments: depending on the arguments (see Table 8), the output changes. Press Ctrl + C to exit. Table 8: Overview of iftop command arguments Argument Desciption -i Specifies the interface for which network traffic information should be displayed, e.g. iftop -i eth0 -F Displays the network traffic from and to the specified IP, e.g. iftop -i eth0 -F n Do not perform host name lookups, e.g. iftop -i eth0 -n -F B Displays bandwidth rates in bytes per second rather than bits per second, e.g. iftop -i eth0 -n -B -F P Displays the ports (IP / Port pairs), e.g. iftop -i eth0 -n -B -P -F Image 20: iftop command output 32

33 Console Commands 5.7 Extracting Log Information with grep The grep command searches the specified file(s) for lines containing a match to the provided pattern. This is useful when searching for specific entries in log files, such as the Firewall logs, Mail logs, etc. The grep command requires arguments (see Table 9) to return a result. A basic grep command is executed as follows: grep 'pattern to look for' filename It is possible to search multiple files simultaneously, e.g. grep 'pattern to look for' filename1 filename2 filename3. Note Specified patterns are case sensitive by default. Table 9: Overview of grep command arguments Argument Desciption -i Toggle case insensitive pattern search, e.g. grep -i 'drop' r Toggle recursion. Search all files recursively within a specified directory, e.g. grep -ir 'drop' /log/fw -v Exclude the specified string from the search, e.g. grep -iv 'drop' /log/fw/ Example 1 Searching for dropped network traffic at a specific time This example demonstrates how to search for network traffic which was dropped by the Firewall, logged on June 11 th 2009 between 10:15 AM and 10:20 AM (10:20 AM is not included in the result) Syntax: grep -i 'drop' /log/fw/ grep '10:1' Example 2 Searching for access to a specific website This example demonstrates how to search for network traffic related to the access of a specific website ( in all available axsguard Gatekeeper proxy log files. Syntax: grep -ir ' /log/proxy Example 3 Searching for dropped network traffic at a specific time excluding a specific source This example demonstrates how to search for network traffic which was dropped by the Firewall, logged on June 11 th 2009 between 10:15 AM and 10:20 AM (10:20 in not excluded in the result) and not originating from source IP Syntax: grep -i 'drop' /log/fw/ grep -v ' ' grep '10:1' 33

34 Console Commands 5.8 Viewing Log Entries with tail The tail command displays the last lines of a specified file. The tail command requires arguments (see Table 10) to return a result. A basic tail command is executed as follows: tail filename Press Ctrl + C to exit. Live log viewing Very useful in some situations, is the -f parameter. This parameter instructs the tail command to 'follow' the output of the file. Initially, the result is the same as using tail without the -f option, displaying the last 10 lines of a given file. However, with the -f option, the command does not return to the command prompt. Instead, it continues to 'follow' the file. When additional lines are added to the file, they are displayed in real-time. This is very useful for watching log files or any other file to which data is appended over time (live log viewer), e.g. tail -f /log/fw/yyyy-mm-dd provides a live view of the current Firewall Log. Table 10: Overview of tail arguments Argument file name -f Desciption Specifies the file (location) of which the data should be displayed, e.g. tail /log/fw/file1 Displays data as it is appended to the file in real-time, e.g. tail -f /log/fw/file1 34

35 Console Commands 5.9 Analyzing Network Traffic with tcpdump tcpdump displays the contents of packets entering and leaving the specified network interface(s). It is used to monitor network traffic and display information which matches (see section 5.9.1) the provided criteria. tcpdump can be used: Without arguments: If no arguments (parameters) are provided, tcpdump captures all network traffic of the first active axsguard Gatekeeper network device (typically eth0). With arguments: depending on the arguments (see Table 11), the output varies. Press Ctrl + C to exit. Table 11: Overview of tcpdump arguments Arguments Desciption -i Specifies the network interface to listen on, e.g. tcpdump -i eth0 -n Does not resolve IP addresses to host names. Only displays IP addresses, e.g. tcpdump -ni eth0 -v Produces verbose output, such as TTL, ICMP header checksum, etc., e.g. tcpdump -v -ni eth0 -c Specifies the number of packets to capture, for instance tcpdump -vvv -c10 -ni eth0 -s Specifies the length (in bytes) of data for each packet to be captured, rather than the default of 68, e.g. tcpdump -vvv -c10 -ni eth0 -s0 Setting the value to 0 means that tcpdump automatically uses the required length. -w Writes the raw packets to a file rather than parsing them and displaying them on the screen, e.g. tcpdump -vvv -c10 -ni eth0 -s0 -w myfile This option is used to analyze the packets with a protocol analyzer, such as Wireshark (see section). Notes More verbose output is provided for each additional 'v', e.g. tcpdump -vvv -ni eth0 Consult the appropriate man pages for additional details about the tcpdump command Matching Network Traffic with tcpdump The output of the tcpdump command can be matched with the following: A specific destination or source host, e.g. dst host A specific destination or source port, e.g. dst port 80 A specific network protocol, e.g. udp port 53 Notes Matches can be combined using the and, or & not operands. The provided list is non-exhaustive. 35

36 Console Commands Examples tcpdump -ni eth0 host Captures network packets on the eth0 network interface and matches on the host with IP address Image 21: tcpdump output example tcpdump -ni eth0 port 22 Captures network packets on the eth0 network interface, displays all network traffic related to port 22 (SSH). tcpdump -ni eth0 icmp Captures network packets on the eth0 network interface, displays all ICMP network traffic. tcpdump -ni eth0 host and port 25 Captures network packets on the eth0 network interface and matches on the host with IP address Only displays network traffic related to port 25 (SMTP). tcpdump -ni eth0 host and not port 22 Captures network packets on the eth0 network interface and matches on the host with IP address All traffic is displayed, except traffic related to port 22 (excluded). tcpdump -ni eth0 host and not port 22 -s0 Performs the same operation as explained in the example above, but in addition tcpdump automatically captures the required packet length, since the -s0 parameter is added. tcpdump -ni eth0 host and not port 22 -s0 -w myfile Performs the same operation as explained in the example above, but in addition the command output is written to a file, allowing further analysis with a protocol analyzer, such as Wireshark (see section 7). Note Press Ctrl + C to exit tcpdump 36

37 6 Copying Files 6.1 Overview Copying Files This chapter explains how to copy files from the axsguard Gatekeeper to your local machine for further analysis. Topics covered in this chapter include: How to download and install the necessary programs to copy files from the axsguard Gatekeeper to a local machine with winscp (Windows) and scp (Linux). How to configure and use these programs with the axsguard Gatekeeper, e.g. how to copy files, such as logs and network traffic files created with tcpdump (see section 5.9.2), from the axsguard Gatekeeper to a local machine for further analysis. 6.2 Downloading and Installing the required Software In this section, we explain how to download and install the necessary software, required to copy files from the axsguard Gatekeeper console to a local machine WinSCP for Windows WinSCP (Windows Secure Copy) is an open source SFTP and FTP client for Microsoft Windows. Its main function is secure file transfer between a local and a remote computer. Beyond this, WinSCP offers basic file manager and file synchronization functionality. For secure transfers, it uses the Secure Shell (SSH, explained in section 3.2.2) and supports the SCP protocol in addition to SFTP. Downloading You can download WinSCP free of charge from this site: Installation WinSCP is installed like any other classic Windows program (running setup.exe or install.exe). Download the installation executable and save it to the desired location. Double-click on the executable to start installing the WinSCP program. Note When downloading, you can either select the WinSCP installation package or the portable executable. The portable executable does not need to be installed like any other classic Windows program (running setup.exe or install.exe). Just download the executable and save it to the desired location. 37

38 Copying Files One the installation is complete or the portable executable is double-clicked, a screen similar to Image 22 is displayed. The configuration is explained in section Image 22: WinSCP Login Screen SCP for Linux In Linux, you can use the scp command to copy files and directories securely between remote hosts without starting an FTP session or logging in to the remote systems explicitly. The scp command uses SSH (see section 3.2.2) to transfer data, so it requires a password or passphrase for authentication. scp encrypts both the file(s) and any passwords exchanged between hosts. On most Linux distributions, the scp is installed by default. Please refer to the documentation of your Linux distribution for downloading and installing instructions, if needed. scp is entirely command line-based. Detailed information is available in the scp man pages (see Image 23). Just type man scp in a Linux console for help. The standard syntax used to copy files from the axsguard Gatekeeper is: scp -i privatekey username@the_lan_ip_address_of_your_axsguard Gatekeeper:/filelocation /filelocation-to-copy-to Example scp -i /home/axsguard/axskey admin@ :/log/tool/ /myfile This command copies the log file to your current directory. 38

39 Copying Files Image 23: scp man page 39

40 Copying 6.3 Files Software Configuration and Use In this section we explain how to configure and use WinSCP for Windows and scp for Linux. scp does not require any configuration. To copy the axsguard Gatekeeper logs, go to the /log directory. Each module stores its logs in a specific subdirectory, e.g. the Firewall logs can be found under /log/fw. The logs are named after the dates on which they were generated WinSCP Configuration 1. Start WinSCP by double-clicking on the WinSCP application icon. 2. Enter the settings as explained in Table 12. Image 24: WinSCP Configuration Settings Table 12: WinSCP Configuration Settings Name Desciption Host Name The internal DNS name or LAN IP address of the axsguard Gatekeeper. Port Number The port to used by the axsguard Gatekeeper. This is the same port as SSH. Leave the port to the default settings, i.e. 22 User Name The axsguard Gatekeeper user name with console tool access (see section 3.4). Password The password of the axsguard Gatekeeper user with console tool access (see section 3.4) Private Key File The user's private key generated with PuTTYgen (see section 3.3.3). File Protocol The protocol used to connect to the axsguard Gatekeeper. Set this to SCP. 40

41 Copying Files 3. Check Advanced Options (see Image 24). 4. Navigate to Environment > SCP / Shell. 5. Change the Shell to /bin/bash as shown in the image below. Image 25: WinSCP Advanced Settings 6. Click on Save. Image 26: Saving WinSCP Session Settings 7. Do not save the password. 8. Click on OK. This concludes the configuration of WinSCP. You can now copy files to your local machine. 41

42 Copying Files Using WinSCP Connecting to the axsguard Gatekeeper: 1. Start WinSCP by double-clicking on the WinSCP application icon. Image 27: WinSCP Login 2. Select your session (This is the session you saved in steps 7 and 8, explained in section 6.3.1). 3. Click on Login. 4. If you log on for the first time, WinSCP will ask you to confirm the host key of the axsguard Gatekeeper. Click on Yes to continue. Image 28: Accepting the Server Host Key 42

43 Copying Files 5. If you protected your private key with a password, you are prompted to enter it at this point. 6. Click on OK. Image 29: Private Key Password A screen similar to Image 30 will appear after successful authentication. Image 30: WinSCP Main Screen 43

44 Copying Files Copying files from the axsguard Gatekeeper: There are two panes on the main screen of WinSCP: The left pane displays the current directory of your local machine. The right pane displays the current directory of the axsguard Gatekeeper. When you log in with WinSCP, the default directory is /home. To copy a file from the axsguard Gatekeeper to a directory of your machine: 1. In the left pane, navigate to the desired directory on your machine, e.g. temp. 2. In the right pane, navigate to the desired file on the axsguard Gatekeeper, e.g. /log/tool/yyyy-mm-dd. 3. Select the file. 4. Click on F5 Copy. A dialog will appear (see Image 31). 5. Verify the local directory in the dialog window and click on Copy. Image 31: WinSCP Copying a File The selected fille is transferred to the selected local directory and can be viewed with your favorite text editor, e.g. Notepad. Tip Using Shift + right-click in the right pane allows you to select multiple files simultaneously. 44

45 Copying Files Using SCP in Linux Note scp does not allow you to navigate through directories and select files, such as with WinSCP (see section 6.3.2). You should know the exact location of the file to copy before executing the command. To use scp: 1. Open a console. 2. type scp, followed by the parameters explained in Table 13, e.g. scp -i privatekey user@ :/log/tool/ /home/mydir/myfile Table 13: SCP Parameters Option / Arguments Use / Desciption -i Indicates that scp should use a private key. This is required to copy files, since the matching public key is copied in the user settings of the axsguard Gatekeeper (see section 3.4). -i is to be followed by a space and the location which points to your private key file, e.g. scp -i privatekeyfile user The axsguard Gatekeeper user name without spaces, e.g. admin@ LAN IP or Internal DNS name The LAN IP address or internal DNS name of the axsguard Gatekeeper preceded without spaces. If used, the DNS name should be properly registered in the DNS registry, e.g Source file The exact location of the source file (the file to be copied) preceded by a colon, e.g. :/log/tool/yyyy-mm-dd Destination file The exact location of the destination file (directory and file name where the source file should be copied) preceded by a space, e.g. /home/axsguard/logfile 3. Once the command is entered, press the Enter key. If you protected your private key with a password, you will be prompted to enter it before the file is actually copied. Image 32: Using scp to copy Files Image 32 shows how a log file from the axsguard Gatekeeper Administrator Tool is copied to the current local directory. The log file can be viewed with you favorite editor. 45

46 Analyzing 7 Analyzing Files with Wireshark 7.1 Overview Files with Wireshark This chapter explains: Where to download Wireshark, a network traffic analyzer. How to install Wireshark on a Windows platform. How to open files generated with the tcpdump command (see section 5.9) on your local machine with Wireshark. Wireshark is free software and is available for Windows and Linux. Guidance for using this software is out of the scope of this guide. For details about the use and configuration of Wireshark, check the online documentation: Downloading and Installing Wireshark This section explains how to download and install Wireshark on a Windows platform. For Linux you should consult the documentation of your distribution. Downloading 1. Open your preferred Internet browser. 2. Navigate to 3. Select the appropriate installer for your Windows platform (32 or 64-bit). 4. Download the installer to the location of your choice. Image 33: Wireshar Donwload 46

47 Analyzing Files with Wireshark Installing 1. Once the installer is downloaded, click on Run (see Image 33). 2. In Windows Vista, you will receive a warning the the software is not digitally signed. Click on Run to go ahead with the installation. Image 34: Windows Vista Signature Warning 3. Click on Allow (Windows Vista). Image 35: Windows Vista Allowing Installations 47

48 Analyzing Files with Wireshark 4. Follow the on-screen instructions. 5. Click on Finish to complete the installation. Image 36: Completing the Installation This completes the installation of Wireshark. The program is now ready for use. 48

49 Analyzing 7.3 Files with Wireshark Using Wireshark 1. Click on Start > Wireshark or double-click the Wireshark application icon on your Windows desktop. Image 37: Starting Wireshark 2. In the menu, click on File > Open. Image 38: Wireshark File Menu 49

50 Analyzing Files with Wireshark 3. Select the file created with tcpdump (see section 5.9). 4. Click on Open. Image 39: Selecting and Opening a File with Wireshark 5. The file can now be analyzed. See for instructions. Image 40: File Analysis 50

51 Troubleshooting 8 Troubleshooting The axsguard Gatekeeper ConsoleTool option is not available You can only enable Console Tool access for a user if you are logged on to the axsguard Gatekeeper Administrator Tool as an advanced administrator. More information about axsguard Gatekeeper user levels is available in the axsguard Gatekeeper System Administration How To, which can be accessed by clicking on the permanently available Documentation button in the Administration Tool. Make sure you have selected Basic Administration or above for the given user (see section 3.4 and the image below). Image 41: Setting the Administrator Level The user cannot log on to the axsguard Gatekeeper Console Tool Verify if the Public Key has been copied correctly. The smallest error prevent the user from logging on (see section 3.4). Verify if the user is allowed to access the console (see section 3.4). Verify if the user login option is enabled (see below). Verify if the credentials are entered correctly. US QWERTY is the default keyboard layout (see section 2.2). Image 42: User Login Enabled 51