POODLE SSLv3 Vulnerabilities Fixes on Debian/pfSense for common widely used apps

Systems or apps that enabled SSLv3 is vulnerable and the only way currently is to disable SSLv3 in various software, applications. Whenever you see any cert that says Version V3, it is vulnerable and must be disabled until further notice.
Ref: CVE-2014-3566

IMPORTANT

• USETHIS GUIDE AT YOUR OWN RISK, i am not responsible for any broken apps/programs etc etc.
• We do not know the extent of the vulnerability/fixes this is from best knowledge and effort, you are advised to research of your own too and not completely rely on these below. These methods are also described in many many online articles, i put them together mainly for our customers and people using Deb6/7.
• This article is to be done/performed by those who have sufficient knowledge in these apps/software
• Please read more articles and follow online security resources for updates should there be any.
• Until a patch is released, customers are advised to simply disable SSLv3 as part of an enforced or fallback method for providing encryption.

Software that we use/distribute

1) Apache
2) Asterisk
3) Nagios (and related software)
4) pfSense and related software (e.g. OpenVPN)
5) Other related software

There are many guides out there and (i’ve) we have copied some of them for the ease of our clients

Apache fix

#nano /etc/apache2/mods-available/ssl.conf
Locate the value SSLProtocol, if it doesn’t exist, add exactly as below within the </ifmodule> tag
SLProtocol all -SSLv2 –SSLv3
if exist in that file, change as below
SLProtocol all -SSLv2 to  SLProtocol all -SSLv2 –SSLv3

Restart apache
#/etc/init.d/apache2 restart

A simple test for apache would be to run
#openssl s_client -ssl3 -connect localhost:443

It should throw an error like handshake failure, that’s good!, SSLv3 is disabled on Apache!

Asterisk fix

Read stuff here: http://downloads.asterisk.org/pub/security/AST-2014-011.html

For Asterisk 11

Go to your Asterisk 11 source directory
#cd /usr/src/asterisk-11…..
If don't exist, just download from http://downloads.asterisk.org/pub/telephony/asterisk/. NOTE: Asterisk 11.13.1 fixes this so you don’t have to patch as below if you are redownloading.
#wget http://downloads.asterisk.org/pub/security/AST-2014-011-11.diff
#patch –p0 < AST-2014-011-11.diff

For recent installs (2013 onwards):
#make clean && ./configure --with-crypto --with-ssl --with-srtp=/usr/local/lib --prefix=/usr
#make && make install

Older Installs simply run (Skip if the above worked!)
#make clean && ./configure

For Asterisk 1.8

Go to your Asterisk 1.8 source directory
#cd /usr/src/asterisk-1.8…..
If don't exist, just download from http://downloads.asterisk.org/pub/telephony/asterisk/. NOTE: Asterisk 1.8.31.1 fixes this, so you don’t have to patch as below if you are redownloading
#wget http://downloads.asterisk.org/pub/security/AST-2014-011-1.8.diff
#patch –p0 < AST-2014-011-1.8.diff
#make clean && ./configure --with-crypto --with-ssl --with-srtp=/usr/local/lib --prefix=/usr

Older Installs simply run (Skip if the above worked!)
#make clean && ./configure

#make && make install

For both 1.8 and 11, restart Asterisk (FreePBX users!)
#amportal kill
#amportal start

Nagios fix

[Nagios info contributor: Anthony [at..]] Astiostech.com
Nagios itself as a monitoring system doesn't use SSL in the monitoring core itself. With the POODLE SSLv3 Vulnerabilities in mind, so far Nagios itself is not vulnerable to the issue as the following explains.

Nagios Console (Monitoring Core)

Nagios Core monitoring engine doesnt use SSL in itself. It is only used by the Nagios Web Console or any Nagios Web Configuration Editor. These web consoles are very dependant on the running HTTP server in the system. Therefore the POODLE vulnerabilities on the CORE Nagios should be properly handled by the HTTP server itself.

Nagios NRPE

SSL option in NRPE is used to encrypt the monitoring data. When this is switched on Nagios NRPE encrypts the data between the Nagios Core and the remote server. According to the file 'src/nrpe.c' line 256, since January 19th 2004, by default SSLv3 and SSLv2 has been disabled in NRPE and only TLS protocols are used. Therefore it is considered safe if the SSL is enabled in the NRPE agent.

Nagios NDO2DB

SSL option in NDO2DB is used to encrypt the received monitoring data from Nagios. When this is switched on Nagios NDO2DB encrypts the data between the Nagios Core and the NDO2DBserver. According to the file 'src/ndo2db.c' in line 167, since January 19th 2004, by default SSLv3 and SSLv2 has been disabled in ndo2db and only TLS protocols are used. Therefore it is

pfSense fix

The webserver

Go into the shell of pfsense, and run
#openssl s_client -connect localhost:443 -ssl3
If you see a value other than NONE in the cipher then its vulnerable and must be fixed.

Using the WebUI, we will download and install the system patch manager
1) Goto System, go to Packages, click on Available Packages
2) Locate System Patches and add it/install it
3) Go back to System, click on Patches
4) Click on + to add new patch
5) If using 2.2x, enter this “5ff7f58e5903cca4f99edd20f9db402163527fd6” without quotes as the commit ID
6) If using 2.1x, enter “29be59ad8ed25830f4e50a89977aca53ad8a29f4” without quotes as the commit ID
7) Click on Save, then it will bring you out to the main page, click on Fetch. Wait for it to complete. Now, you should see the word test, click on test. Once you can test, it will tell you patch can be applied cleanly. If only so, click Apply. If not, you’ve done something wrong :(
8) Restart the webservice
9) Point your browser to /restart_httpd.php, say if your pfsense IP is https://10.10.10.1 then just point to https://10.10.10.1/restart_httpd.php
10) Run again
#openssl s_client -connect localhost:443 –ssl3
You should now get an error!

The OpenVPN

OpenVPN uses TLS so it is not vulnerable. OpenVPN uses TLSv1.0, or (with >=2.3.3) optionally TLSv1.2 and is thus not impacted by POODLE. [src pfsense forum]

Other software that uses SSLv3

If you are aware of any other encrypting software that may use SSLv3, you might need to search for documents online on how to disable SSLv3 within the app’s implementation. If you know of such app and need help from us, do contact us and we will have a look at it.

Debian 7 (wheezy) based Asterisk 13, Freepbx 12 on VMware / Virtualbox (Asterisk VM/Asterisk Ready Virtual Machine)

Show some love,  do like our FB page www.fb.com/Astiostech |

[UPDATED: 03 FEB 2015]

Here’s a VMDK image to run a full featured Asterisk PaBX with FreePBX as the management UI using our default and secure install practices. No registrations, no username/password, no signing up for newsletter.

Get it from Sourceforge: https://sourceforge.net/projects/debianasterisk/ [Select SWSterisk13 folder, then download the zip file therein]

 

After extracting, You either need VirtualBox or VMPlayer/VMWare or any Virtualization products that supports VMDK files or if you’re using Hypervisor, convert the image to VHD using MVMC from here.  This is to give you a feel of Asterisk with FreePBX without worrying about installation etc., its plug and play, literally. Just start up to your VirtualBox/VMplayer and get it up and running in seconds. Go in to FreePBX and start creating extensions and enable other features.

This image is free from any lockdowns or customizations that you cannot reverse or disable or enable as you wish. It is completely FREE from any personal restrictions.

This image does not trace usage, or “dials home” or anything strange like that. Totally clean, totally lean and totally fast. It is functional and you can hook it up to a real production environment and you almost have a full fledge PBX, just add a Digium VoIP Gateway or another IP based PSTN.

IMPORTANT

• DISCLAIMER: By using this VIRTUAL MACHINE IMAGE, i disclaim any sorts of liability whatsoever. What you do with this image is purely your choice/actions.
• This is not "another distros", nothing proprietary, i don't claim any copyrights, just make it look and feel like its mine for fun, but of course any of those customizations can be reversed. All other trademarks are properties of their respective owners. All rights reserved.

Here’s some information about the VM image you just downloaded

• It’s in ZIP compression, just get WinRAR or 7-ZIP to extract. After extracting, there should be one vmdk just mount the vmdk into VMWare/VMPlayer or Virtualbox and start the image
• Username/password
• OS
  - Username: root (the other non root user is support with same password as below)
  - Password: asteriskrocks (change this!)
• FreePBX(admin), MySQL(root), AMI(admin): usernames and passwords;
  username: admin
  password: @steriskRocks1 (change this, here’s a good guide to start you off withhttp://www.freepbx.org/support/documentation/installation/first-steps-after-installation)
• REMEMBER REMEMBER REMEMBER: CHANGE PASSWORDS!
• The network adapter is set to auto on eth0.
• Image needs at least 384M memory (or more if you have more)
• All source files except kernel-headers are removed to save disk space for downloading, you need to download them manually (Size before compression ~ 2.2GB, size after compression ~600M)

OS features/settings

• Debian 7.6.0 64bit (Source AMD64 netinstall) UPDATED, Bash Vulnerability Fixed with latest patch no33, SSLV3 disabled and Ghost Vulnerability fixed.
• Disks are LVM so you can add more storage
• The interface, eth0, is set to use DHCP, so be sure to hook up DHCP or manually edit the IP. IPV6 is disabled. In case you can’t bring the interface up, run #ifconfig –a . Then edit the file in /etc/network/interfaces and set all values to correspond to the interface shown when you run ifconfig –a (not loopback of course)
• Webmin installed but not started (# /etc/init.d/webmin start , then access using https://<ipaddress>:10000) . Use sparingly, has many holes if it doesn’t get updated constantly.
• Apache as webserver with enforced HTTPS (Port 443)
• MySQL administration with Adminer in https://<ipaddress>/dbmanage.php
• Phpsysinfo https://<ipaddress>/phpsysinfo
• Munin for monitoring in https://<ipaddress>/munin
• DHCP and TFTP server downloaded, not installed
• Firewalled with IPTables (be sure to see /bin/wallfire.sh) –UPDATED bug fixes can be stopped and started #wallfire stop #wallfire start
• Time i.e NTP autosyncs with ntp.org daily, when starting and when stopping
• Exim4 (mailserver) configured to relay, configure your email appropriately #dpkg-reconfigure exim4-config
• fail2ban properly set up and ready for ssh and asterisk failed attempts (modify notification email here /etc/fail2ban/jail.conf) - UPDATED
• Many CLI tools for troubleshooting like tcpdump, ntop, htop…
• Astribank support [if ever u need it]
• Removed Virtualbox OSE addons for best compatibility

FreePBX/Asterisk features

• FreePBX 12 with most basic and extended modules pre-installed – UPDATED to v12.0.36
• Asterisk 13.1.1 (Dahdi tools/linux 2.10.0.1/LibPRI). NOTE I have set to chan_sip as the default sip driver, not pjssip. Had issues with fail2ban and other things. But all other components will work fine, not to worry. Change as you see fit.
• Asterisk runs as high priority (Nice = 10)
• New version of g711 selected
• H323 Enabled
• SRTP enabled (GoogleTalk/XMPP/Jingle + Secure RTP)
• Iksemel for GoogleTalk/XMPP/Jingle
• Asterisk-CEL logging enabled (in DB/table asteriskcdr/cel)
• Log rotation enabled for files inside /var/log/asterisk/
• Extra codecs: Speex (wanted to add SILK and openg729 but they seem to crash Asterisk codec translators)
• WebRTC ready using FreePBX’s UAC
  • Notes on using this
    • A test user has been created for you to immediately use.
    • Click on UCP.
    • Username: 2000, password 2000 (password can be changed under User Management)
    • When using Chrome, be sure to check and enable “unsafe script” on top right corner in the address bar
    • Be sure ports 80 (or 443), ports 8088 both TCP are opened to this box
    • Here’s me making a test call with that user 2000 inside UCP
    •  

Error 0x0000005d when installing Windows 10 tech preview on Oracle VirtualBox (4.3.x)

Thought of quickly setting a note on this. If you get this error with Windows 10 Tech Preview on Virtual Box, you probably have to set the in the General Setting to Windows 8.1 (32 or 64 bit depending on your version you’ve downloaded).

Also be sure to have sufficient video memory > 32M, reboot and start installation. Cheers :-)

FreePBX RCE vulnerability CVE: 2014-7235

The FreePBX team has been made aware of a security vulnerability affecting one of its modules called the Asterisk Recording Interface (ARI). While many of our users do not use this module on a day to day basis, it is almost available in all our installs. 

Important Notes

• This vulnerability allows unauthenticated remove execution of code via the web and execute shell commands which are then limited to the rights of the apache process (in our client's cases, that would be low privilege user asterisk). However, this user has rights to manage the Asterisk, FreePBX and other web related software or services.
• FreePBX versions affected: Any version prior to version 12 (e.g. 2.8,2.9,2.10,2.11). 
• All OS versions
• This is a FreePBX only bug, not Asterisk, not OS, etc..
• It is safe to upgrade during production/live. Restarts or reboots are not required

The fixes are available since 30 Sept 2014 and users are advised to run the following commands and/or run from via the web interface or the module admin page: The following commands may require internet access from the Asterisk/FreePBX console to perform the upgrade.

(Do not copy the '#' when pasting into the putty/CLI interface, they are indicators of command line codes)

#rm -rf /var/www/html/admin/modules/admindashboard
#amportal a ma delete admindashboard

NOTE: You may NOT have the above modules installed, even if in error, ignore and proceed as below;

Now, locate and delete these files like below

#for i in `find / -name 'c2.pl' -print`; do rm -i $i; done
#for i in `find / -name 'c.sh' -print`; do rm -i $i; done

The above command will search through any of the automated hacking scripts (if exists) and ask you to remove, just hit [y]es if you find them. Otherwise, the command will return an empty output.

Finally, and most importantly, get the upgrade;
#amportal a ma upgrade fw_ari
#amportal a r

Alternatively, you can upgrade the module as show above via the FreePBX module admin module too.

Systems that expose the http/https port TCP80 or TCP443 (or FreePBX) interface via the internet is at particularly higher risk, you are advised to immediately close all access from the Internet to your FreePBX webUI and should be doing so anyway for best security practice.

For more detailed understanding, please checkout article: http://goo.gl/6JT3oT