- opensource-wg - mailman.ripe.net

Open-source Software Risk Mitigation Practices survey
by Sasha Romijn 15 May '24

15 May '24

Hello all, As you can see on the agenda, Petr Špaček from ISC will do a talk on Open-source QA in our RIPE88 session. They’ve set up a survey on this subject, and we encourage you all to submit: https://ec.europa.eu/eusurvey/runner/RIPE88OpenSourceWGSurvey The data from this survey will serve as input for both the presentation and the discussion we can have afterwards. Looking forward to insightful discussions from your survey input! Best regards, Marcos Sanz & Martin Winter & Sasha Romijn Open-source WG chairs

2 1

Credit and contributions policy guide launches May 20
by Valerie Aurora 14 May '24

14 May '24

Hi all, I'm happy to say that, thanks to Maria Matějka, the guide to creating a contributions and credit policy is up on GitHub and ready for PRs: https://github.com/contribution-credit/policy Feel free to share this starting now, but the "official" launch will be May 20, when Linux Weekly News publishes an article on the policy guide. We are open to improvements of all sorts, and especially additions to the list of projects that already have such a policy: https://github.com/contribution-credit/policy/blob/main/policies.md And of course you can check out our own contributions and credit policy :) https://github.com/contribution-credit/policy/blob/main/CONTRIBUTING.md Thanks again to Maria Matějka for many contributions, edits, structural improvements, and creating the GitHub repo, Marcos Sanz and Martin White for early support and important input, and many others from the OS WG for their input. If you'd like to add yourself as a named contributor or update your entry on the credits, please do! Valerie

1 1

Draft agenda open source wg RIPE 88
by Marcos Sanz 10 May '24

10 May '24

Dear all, Please find attached the draft agenda for the upcoming open source working group meeting during RIPE 88. It will soon be online. As always, we'd still welcome any lightning talks! No formal submission is required ahead of RIPE 88, but please send a short message to the chairs by noon on Tuesday of the meeting week. Talks will be selected on Tuesday afternoon. Best regards, Martin Winter & Sasha Romijn & Marcos Sanz Open Source WG Chairs -- Thursday, 23rd May, 14:00-15:30 CEST * Administrivia * Chair selection process review (Martin Winter, co-chair) * Open-source QA process (Petr Špaček, Internet Systems Consortium) Speculative session with WG participant survey & open mic discussion about how WG sees open-source Q&A processes. We will compare wishes of the WG with real example of what is being done today around BIND DNS server. * Contribution and credits policy for open-source projects (Maria Matejka, BIRD | CZ.NIC) After RIPE 87 in Rome, several people thought more about contributing to open-source software and crediting people. We created a template or example how a policy on contributions and credits may look like, and it's ready for use. * Lightning talks * AOB --

1 0

Register for RIPE NCC Training Courses: Zagreb, Croatia: 15-16-17 May 2024.
by Vesna Manojlovic ＠ RIPE.net 30 Apr '24

30 Apr '24

Dear colleagues, We invite you to register for the the RIPE NCC*LIR,**RIPE Database and BGP Routing Security Training Course* which will take place in *Zagreb* on *15-16-17 May 2024*. : https://learning.ripe.net For each of those topics, we promote Free/Libre & Open Source tools to help you in your work. Our training courses are free of charge and *delivered* in *English*. Trainers will be Gerardo Viviers and Ralph Smit. If you have already benefitted from a RIPE NCC training, we encourage you to share this email with your colleagues who might be interested in attending our courses. *General Information:* ------------------- Register to attend your chosen course(s) through our learning platform: https://learning.ripe.net We have a limited number of places, and registration will close once we are at capacity. The course includes lunch and printed training materials. If you have any questions, please contact learning(a)ripe.net. We are looking forward to seeing you in Zagreb! Kind regards, RIPE NCC Learning and Development (& Vesna, your link between RIPE NCC Croatia ;-) ======= *LIR Training Course:* ------------------ Date: *Wednesday, 15 May 2024* Time: 09:00-17:30 local time Hosted by: Carnet <https://www.carnet.hr/en/> at this location: Josipa Marohnića 5, 10 000 Zagreb <https://www.google.com/maps/place/Croatian+Academic+and+Research+Network+-+…> The *LIR Training Course* is a one-day introduction to the RIPE NCC's administrative procedures and RIPE Policies related to obtaining and distributing Internet resources (i.e. IP addresses, AS Numbers and reverse DNS delegation) and operating a Local Internet Registry (LIR). The course includes a basic introduction to the RIPE Database. You should attend this training course: if you are a staff member of a Local Internet Registry (LIR) in the RIPE NCC service region. For more information visit our: *Course information* and *registration page* <https://learning.ripe.net/w/courses/1-lir-training-course> === **RIPE Database Training Course*:* ---------------------------- Date: *Thursday, 16 May 2024* Time: 09:00-17:30 local time Hosted by: Carnet <https://www.carnet.hr/en/> at this location: Josipa Marohnića 5, 10 000 Zagreb <https://www.google.com/maps/place/Croatian+Academic+and+Research+Network+-+…> The *RIPE Database Training Course* is a one-day course. We'll make you a capable user of the RIPE Database. Mixing hands-on activities with theory, the course participants will get a comprehensive idea of what the RIPE Database is and what they can do with it. You should attend this training course if you are part of the staff of a Local Internet Registry (LIR) in the RIPE NCC service region, and need to register networks in the RIPE Database. You should attend this training course if you are part of the staff of a Local Internet Registry (LIR) in the RIPE NCC service region, and need to register networks in the RIPE Database. For more information visit our: *Course information* and *registration page* <https://learning.ripe.net/w/courses/2-ripe-database-training-course> === *BGP Routing Security Training Course:* ----------------------------- Date: *Friday, 17 May 2024* Time: 09:00-17:30 local time Hosted by: Carnet <https://www.carnet.hr/en/> at this location: Josipa Marohnića 5, 10 000 Zagreb <https://www.google.com/maps/place/Croatian+Academic+and+Research+Network+-+…> BGP Routing Security training course is a one-day course covering different aspects of the security of BGP protocol. The participant will gain insight and a high-level understanding of the need for security in BGP, the main threats it faces and the main security measures that can be applied nowadays. Some future developments on the topic will also be covered. The course includes theory and hands-on exercises. You should attend this training course if you are using, or plan to use, BGP in your network and want to know more about the potential threats and the security solutions available to make your BGP routing more secure. For more information visit our: *Course information and registration page* <https://learning.ripe.net/w/courses/34-bgp-routing-security-training-course…>

1 0

Invitation to RIPE NCC Open House Events – Community Projects Fund Recipients 2023
by Alastair Strachan 22 Apr '24

22 Apr '24

Dear Colleagues, We are pleased to invite you to participate in the upcoming RIPE NCC Open House events. If you are thinking of applying for the Community Projects Fund this year or want to get updates about the projects selected for the 2023 RIPE NCC Community Projects Fund, make sure you attend these sessions to gain insights into the progress, challenges, and future goals of the supported initiatives. During the sessions, recipients of the 2023 RIPE NCC Community Projects Fund will present detailed updates on their projects, summarising their journey thus far and their current advancements. Each presentation will be followed by a Q&A segment, offering you the chance to interact directly with the project teams and gain a deeper understanding of their work. https://www.ripe.net/membership/meetings/open-house/cpf-recipients-2024/ Session Schedule: First Session: April 26, 2024, 10:00 - 11:30 CEST (08:00 - 09:30 UTC) Thomas Holterbach: Designing the Next Generation of Public BGP Route Collection Infrastructures Tobias Fiebig: Measurement.network - Organizing Active Measurements Ioana Livadariu: SubZero - Monitoring the Deployment Impact of the Submarine Cable System Second Session: May 2, 2024, 10:00 - 11:30 CEST (08:00 - 09:30 UTC) Marcus Dansarie: : Secure Time for IoT Devices - Developing the Roughtime Proposed Standard Raffaele Sommese: Anycast Discovery - Daily Mapping the Anycast Landscape for Enhanced Internet Resilience Suelette Dreyfus and Richard Prospesel: Community Canary - Exploring Tor's Rust Implementation, Arti We encourage all members of the Internet technical community and anyone interested in the advancement of Internet infrastructure to attend these insightful sessions. Looking forward to your participation in fostering innovation and progress within our community. Kind Regards Alastair Strachan RIPE NCC

1 0

xz incident shows the need for structural change (in FLOSS maintenance & funding)
by Vesna Manojlovic 11 Apr '24

11 Apr '24

FYI: by Sovereign Tech Fund https://www.sovereigntechfund.de/news/xz-structural-change APRIL 4, 2024 BY ADRIANA GROH " xz incident shows the need for structural change" At Sovereign Tech Fund, we're following the xz incident closely and listening to the many voices in the FOSS maintainer community. There are clear signs that this is a sophisticated attack, but experts are still analyzing it, and it seems we won't know all the facts for a while. At this time, we don't want to point at any single cause and certainly don’t want to suggest a quick fix. We would, however, like to point out again the huge importance of digital infrastructure, which is regrettably overlooked and invisible to most of us. xz is merely the most recent example to illustrate how important the open source ecosystem is for all of us. At the same time, it shows very clearly how serious the structural issues are: for example, not enough new contributors, too few experienced contributors, too little recognition, and not enough (long-term) support from various stakeholders. One consequence is burnout among unpaid volunteers, which is unfortunately not a rare occurrence. If we keep ignoring these systemic issues, this house of cards will be our undoing (see our favorite xkcd comic). A great many companies and organizations incorporate and use critical open source components without ensuring that they are maintained and secured at all. We see this kind of maintenance as an undertaking that is in the public interest. It should not be the responsibility of unpaid volunteers alone, nor should it rest wholly on the private sector. It's a task whose importance society as a whole needs to acknowledge, and should be prioritized accordingly. As we saw with Heartbleed (2014), Log4Shell (2021) and other incidents, foundational open source technologies are essential parts of modern digital infrastructure. They underpin all (not just digital) endeavors, both in the public and private sectors. Just as physical infrastructure like roads, railways, and water systems are constantly being maintained, these digital components also need to be serviced and updated in order to serve as the foundation for digital sovereignty, a successful economy, and a resilient democratic society. Since the creation of the Sovereign Tech Fund, we have been exploring different support mechanisms to fulfill our mission of supporting the development, improvement, and maintenance of open digital infrastructure. We are currently working on more ways to tackle these challenges. Financial support for the people behind the code is a good first step and an important building block. However, to increase the long-term success of our mission, complementary and reinforcing mechanisms are needed. We are in contact with maintainers and FOSS communities as we develop and test these additional mechanisms. Our areas of focus include improving software maintainability, increasing bug resilience, better developer tooling, reducing technical debt, and expanding the communities of FOSS contributors. We welcome you to share your ideas, feedback, or constructive criticism with us. Through Sunday, 7 April 2024, we are especially eager to hear from open source maintainers who would like to fill out our fellowship pilot program survey. https://www.sovereigntechfund.de/news/foss-maintainer-fellowship-survey We see the creation of and commitment to the Sovereign Tech Fund by SPRIND and the German Ministry for Economic Affairs and Climate Action as a clear sign of the increasing awareness of the open source ecosystem’s significance. We hope that our plans for the future will inspire many others to join us in this work and have a lasting impact together. Incidents like xz – others will surely follow – show that we have a major task ahead of us for the foreseeable future.

2 1

On the xz/liblzma breach and open source maintainer burnout
by Johan Helsingius 30 Mar '24

30 Mar '24

Rob Mensching: A Microcosm of the interactions in Open Source projects https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interacti…

1 0

Teo En Ming's Notes on Basic Configuration of Cisco ASA 5516-X Firewall - Version 1
by Turritopsis Dohrnii Teo En Ming 21 Mar '24

21 Mar '24

Subject: Teo En Ming's Notes on Basic Configuration of Cisco ASA 5516-X Firewall - Version 1 Good day from Singapore, Author: Mr. Turritopsis Dohrnii Teo En Ming Country: Singapore Date of Publication: 20 March 2024 Wednesday Document Version: 1 I have bought this refurbished/second hand/used Cisco ASA 5516-X firewall with FirePOWER Services for SGD$100 at Bukit Panjang Ring Road on 17 Mar 2024 Sunday at about 8.30 PM Singapore Time. On 19 March 2024 Tuesday, I have completed basic configuration of this firewall. Configuration Start: 19 March 2024 Tuesday, 9.22 PM Configuration End: 19 March 2024 Tuesday, 11.33 PM Below are my notes on configuring the Cisco ASA 5516-X firewall (basic). Part 1: Factory reset the Cisco ASA 5516-X firewall =================================================== Reference guide: Clearing, resetting or erasing configuration on Cisco ASA Link: https://www.linkedin.com/pulse/clearing-resetting-erasing-configuration-cis… cisco> en Password: ***** cisco# conf t cisco(config)# ***************************** NOTICE ***************************** Help to improve the ASA platform by enabling anonymous reporting, which allows Cisco to securely receive minimal error and health information from the device. To learn more about this feature, please visit: http://www.cisco.com/go/smartcall Would you like to enable anonymous error reporting to help improve the product? [Y]es, [N]o, [A]sk later: Y Enabling anonymous reporting. Adding "call-home reporting anonymous" to running configuration... Creating trustpoint "_SmartCallHome_ServerCA" and installing certificate... Trustpoint CA certificate accepted. Please remember to save your configuration. cisco(config)# configure factory-default Based on the inside IP address and mask, the DHCP address pool size is reduced to 250 from the platform limit 256 WARNING: The boot system configuration will be cleared. The first image found in disk0:/ will be used to boot the system on the next reload. Verify there is a valid image on disk0:/ or the system will not boot. Begin to apply factory-default configuration: Clear all configuration Executing command: ! Executing command: interface Management1/1 Executing command: management-only Executing command: no nameif Executing command: no security-level Executing command: no ip address Executing command: no shutdown Executing command: exit Executing command: ! Executing command: interface GigabitEthernet1/1 Executing command: nameif outside INFO: Security level for "outside" set to 0 by default. Executing command: security-level 0 Executing command: ip address dhcp setroute Executing command: no shutdown Executing command: exit Executing command: ! Executing command: interface GigabitEthernet1/2 Executing command: nameif inside INFO: Security level for "inside" set to 100 by default. Executing command: security-level 100 Executing command: ip address 192.168.1.1 255.255.255.0 Executing command: no shutdown Executing command: exit Executing command: ! Executing command: object network obj_any Executing command: subnet 0.0.0.0 0.0.0.0 Executing command: nat (any,outside) dynamic interface Executing command: exit Executing command: ! Executing command: http server enable Executing command: http 192.168.1.0 255.255.255.0 inside Executing command: ! Executing command: dhcpd auto_config outside Executing command: dhcpd address 192.168.1.5-192.168.1.254 inside Executing command: dhcpd enable inside Executing command: ! Executing command: logging asdm informational Executing command: ! Executing command: ! Executing command: ! Factory-default configuration is completed ciscoasa(config)# reload System config has been modified. Save? [Y]es/[N]o: y Cryptochecksum: 200435a9 cee9c848 4fb5e91d ac201631 3250 bytes copied in 0.150 secs Proceed with reload? [confirm] ciscoasa(config)# *** *** --- START GRACEFUL SHUTDOWN --- Shutting down isakmp Shutting down webvpn Shutting down sw-module Shutting down License Controller Shutting down File system *** *** --- SHUTDOWN NOW --- Process shutdown finished Rebooting... (status 0x9) .. INIT: Sending processes the TERM signal Deconfiguring network interfaces... done. Sending all processes the TERM signal... Sending all processes the KILL signal... Deactivating swap... Unmounting local filesystems... Rebooting... Part 2: Basic Configuration of Cisco ASA 5516-X Firewall ========================================================= Reference guide: Basic Cisco ASA 5506-x Configuration Example Link: https://www.speaknetworks.com/basic-cisco-asa-5506-x-configuration-example/ ciscoasa> en Password: ciscoasa# ciscoasa# show bootvar BOOT variable = Current BOOT variable = CONFIG_FILE variable = Current CONFIG_FILE variable = Step 1: Configure ASA interfaces and assign appropriate security levels =========================================================================== ciscoasa# conf t ciscoasa(config)# interface GigabitEthernet1/1 ciscoasa(config-if)# description to WAN ciscoasa(config-if)# nameif outside ciscoasa(config-if)# security-level 0 ciscoasa(config-if)# ip address dhcp setroute ciscoasa(config-if)# exit ciscoasa(config)# interface GigabitEthernet1/2 ciscoasa(config-if)# description to LAN ciscoasa(config-if)# nameif inside ciscoasa(config-if)# security-level 100 ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0 ciscoasa(config-if)# exit ciscoasa(config)# interface GigabitEthernet1/3 ciscoasa(config-if)# description to DMZ1 ciscoasa(config-if)# nameif dmz1 ciscoasa(config-if)# security-level 50 ciscoasa(config-if)# ip address 192.168.2.1 255.255.255.0 ciscoasa(config-if)# exit Step 2: Configure ASA as an Internet gateway, enable Internet access ======================================================================== Configure NAT rules. ciscoasa(config)# nat (inside,outside) after-auto source dynamic any interface ciscoasa(config)# nat (dmz1,outside) after-auto source dynamic any interface Allow ping requests to go out. ciscoasa(config)# policy-map global_policy ciscoasa(config-pmap)# class inspection_default ciscoasa(config-pmap-c)# inspect icmp ciscoasa(config-pmap-c)# exit ciscoasa(config-pmap)# exit Step 3: Configure static NAT to web servers, grant Internet inbound access to web servers =========================================================================================== I will skip this step because I am not planning to have any public facing web servers at home at the moment. Step 4: Configure DHCP service on the ASA ============================================ Configure DHCP server for LAN network. ciscoasa(config)# dhcpd address 192.168.1.2-192.168.1.254 inside ciscoasa(config)# dhcpd dns 8.8.8.8 8.8.4.4 ciscoasa(config)# dhcpd lease 3600 ciscoasa(config)# dhcpd ping_timeout 50 ciscoasa(config)# dhcpd enable inside ciscoasa(config)# dhcprelay timeout 60 Configure DHCP Server for DMZ network. ciscoasa(config)# dhcpd address 192.168.2.2-192.168.2.254 dmz1 ciscoasa(config)# dhcpd enable dmz1 ciscoasa(config)# exit (Optional) Step 5: Redirect traffic to the FirePOWER module for deeper level inspection ======================================================================================== I don't think I have any FirePOWER feature license, so I will skip this step for the moment. Step 6: Hardening the device =============================== Shutdown unused interfaces. ciscoasa(config)# interface GigabitEthernet1/4 ciscoasa(config-if)# shutdown ciscoasa(config-if)# interface GigabitEthernet1/5 ciscoasa(config-if)# shutdown ciscoasa(config-if)# interface GigabitEthernet1/6 ciscoasa(config-if)# shutdown ciscoasa(config-if)# interface GigabitEthernet1/7 ciscoasa(config-if)# shutdown ciscoasa(config-if)# interface GigabitEthernet1/8 ciscoasa(config-if)# shutdown ciscoasa(config-if)# exit Enable SSH access for admin. ciscoasa(config)# hostname ASA5516X ASA5516X(config)# crypto key generate rsa modulus 1024 (change to 4096 in future) WARNING: You have a RSA keypair already defined named <Default-RSA-Key>. Do you really want to replace them? [yes/no]: yes Keypair generation process begin. Please wait... Hosts from the internet are not allowed to ssh into the firewall. LAN users are allowed to ssh into the firewall. ASA5516X(config)# ssh 192.168.1.0 255.255.255.0 inside DMZ users are not allowed to ssh into the firewall. ASA5516X(config)# ssh timeout 30 ASA5516X(config)# ssh version 2 ASA5516X(config)# aaa authentication ssh console LOCAL WARNING: local database is empty! Use 'username' command to define local users. Step 7: Configure time and enable logging =========================================== I didn't set the time or timezone correctly. Will fix it in the future. ASA5516X(config)# clock set 22:37:00 Mar 19 2024 ASA5516X(config)# clock timezone GMT +8 ASA5516X(config)# logging enable ASA5516X(config)# logging timestamp ASA5516X(config)# logging buffer-size 512000 ASA5516X(config)# logging buffered debugging Part 3: Create LOCAL users for SSH ================================== Reference guide: Cisco ASA Firewall Management Interface Configuration (with Example) Link: https://www.networkstraining.com/using-the-management-interface-of-the-cisc… ASA5516X(config)# username cisco password cisco privilege 15 Part 4: Enable ASA Web Interface ================================= Reference guide: How do I perform a basic setup of Cisco ASA 5516-X firewall? Link: https://community.cisco.com/t5/network-security/how-do-i-perform-a-basic-se… ASA5516X(config)# http server enable ASA5516X(config)# http 192.168.1.0 255.255.255.0 inside ASA5516X(config)# enable password cisco level 15 Hosts from the internet are not allowed to access the ASA web interface. Hosts from the DMZ are not allowed to access the ASA web interface. Part 5: Saving the Firewall Configuration ========================================== ASA5516X(config)# write mem Building configuration... Cryptochecksum: 5857f4ec 34234f34 4cec64f6 f85d7cd4 7180 bytes copied in 0.150 secs [OK] ASA5516X(config)# write mem Building configuration... Cryptochecksum: 5857f4ec 34234f34 4cec64f6 f85d7cd4 7180 bytes copied in 0.150 secs [OK] Part 6: show run output ======================= ASA5516X# show run : Saved : : Serial Number: JAD****00ZZ : Hardware: ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores) : ASA Version 9.7(1)4 ! hostname ASA5516X enable password $sha512$5000$LuFgFhttGYuAEdvYbB7Y9g==$M2/7xYvePzQsOAQNrQsxTg== pbkdf2 names ! interface GigabitEthernet1/1 description to WAN nameif outside security-level 0 ip address dhcp setroute ! interface GigabitEthernet1/2 description to LAN nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface GigabitEthernet1/3 description to DMZ1 nameif dmz1 security-level 50 ip address 192.168.2.1 255.255.255.0 ! interface GigabitEthernet1/4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/5 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/6 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/7 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/8 shutdown no nameif no security-level no ip address ! interface Management1/1 management-only no nameif no security-level no ip address ! ftp mode passive clock timezone GMT 8 object network obj_any subnet 0.0.0.0 0.0.0.0 pager lines 24 logging enable logging timestamp logging buffer-size 512000 logging buffered debugging logging asdm informational mtu outside 1500 mtu inside 1500 mtu dmz1 1500 no failover no monitor-interface service-module icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 16384 ! object network obj_any nat (any,outside) dynamic interface ! nat (inside,outside) after-auto source dynamic any interface nat (dmz1,outside) after-auto source dynamic any interface timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 timeout igp stale-route 0:01:10 user-identity default-domain LOCAL aaa authentication ssh console LOCAL http server enable http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact service sw-reset-button crypto ipsec security-association pmtu-aging infinite crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure crypto ca trustpool policy crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 18dad19e267de8bb4a2158cdcc6b3b4a 308204d3 308203bb a0030201 02021018 dad19e26 7de8bb4a 2158cdcc 6b3b4a30 0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b 13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504 0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72 20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56 65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043 65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d30 36313130 38303030 3030305a 170d3336 30373136 32333539 35395a30 81ca310b 30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20 496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65 74776f72 6b313a30 38060355 040b1331 28632920 32303036 20566572 69536967 6e2c2049 6e632e20 2d20466f 72206175 74686f72 697a6564 20757365 206f6e6c 79314530 43060355 0403133c 56657269 5369676e 20436c61 73732033 20507562 6c696320 5072696d 61727920 43657274 69666963 6174696f 6e204175 74686f72 69747920 2d204735 30820122 300d0609 2a864886 f70d0101 01050003 82010f00 3082010a 02820101 00af2408 08297a35 9e600caa e74b3b4e dc7cbc3c 451cbb2b e0fe2902 f95708a3 64851527 f5f1adc8 31895d22 e82aaaa6 42b38ff8 b955b7b1 b74bb3fe 8f7e0757 ecef43db 66621561 cf600da4 d8def8e0 c362083d 5413eb49 ca595485 26e52b8f 1b9febf5 a191c233 49d84363 6a524bd2 8fe87051 4dd18969 7bc770f6 b3dc1274 db7b5d4b 56d396bf 1577a1b0 f4a225f2 af1c9267 18e5f406 04ef90b9 e400e4dd 3ab519ff 02baf43c eee08beb 378becf4 d7acf2f6 f03dafdd 75913319 1d1c40cb 74241921 93d914fe ac2a52c7 8fd50449 e48d6347 883c6983 cbfe47bd 2b7e4fc5 95ae0e9d d4d143c0 6773e314 087ee53f 9f73b833 0acf5d3f 3487968a ee53e825 15020301 0001a381 b23081af 300f0603 551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 06306d06 082b0601 05050701 0c046130 5fa15da0 5b305930 57305516 09696d61 67652f67 69663021 301f3007 06052b0e 03021a04 148fe5d3 1a86ac8d 8e6bc3cf 806ad448 182c7b19 2e302516 23687474 703a2f2f 6c6f676f 2e766572 69736967 6e2e636f 6d2f7673 6c6f676f 2e676966 301d0603 551d0e04 1604147f d365a7c2 ddecbbf0 3009f343 39fa02af 33313330 0d06092a 864886f7 0d010105 05000382 01010093 244a305f 62cfd81a 982f3dea dc992dbd 77f6a579 2238ecc4 a7a07812 ad620e45 7064c5e7 97662d98 097e5faf d6cc2865 f201aa08 1a47def9 f97c925a 0869200d d93e6d6e 3c0d6ed8 e6069140 18b9f8c1 eddfdb41 aae09620 c9cd6415 3881c994 eea28429 0b136f8e db0cdd25 02dba48b 1944d241 7a05694a 584f60ca 7e826a0b 02aa2517 39b5db7f e784652a 958abd86 de5e8116 832d10cc defda882 2a6d281f 0d0bc4e5 e71a2619 e1f4116f 10b595fc e7420532 dbce9d51 5e28b69e 85d35bef a57d4540 728eb70e 6b0e06fb 33354871 b89d278b c4655f0d 86769c44 7af6955c f65d3208 33a454b6 183f685c f2424a85 3854835f d1e82cf2 ac11d6a8 ed636a quit telnet timeout 5 ssh stricthostkeycheck ssh 192.168.1.0 255.255.255.0 inside ssh timeout 30 ssh version 2 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd dns 8.8.8.8 8.8.4.4 dhcpd auto_config outside ! dhcpd address 192.168.1.2-192.168.1.254 inside dhcpd enable inside ! dhcpd address 192.168.2.2-192.168.2.254 dmz1 dhcpd enable dmz1 ! dhcprelay timeout 60 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-access-policy-record DfltAccessPolicy username cisco password $sha512$5000$G5B9+ZfYxXVvcUPZ67ndpg==$SzTisL+GxQG2Nr/K7hh9gA== pbkdf2 privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp ! service-policy global_policy global prompt hostname context call-home reporting anonymous Cryptochecksum:2cf585656729bff783f7247b760f1d15 : end Part 7: Corrective Steps for DMZ network ======================================== ASA5516X(config)# interface GigabitEthernet1/3 ASA5516X(config-if)# no shut ASA5516X(config-if)# exit ASA5516X(config)# write mem Building configuration... Cryptochecksum: 2cf58565 6729bff7 83f7247b 760f1d15 7170 bytes copied in 0.150 secs [OK] That's all. Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individual in Singapore Blogs: https://tdtemcerts.blogspot.com https://tdtemcerts.wordpress.com

1 0

Cisco ASA 5516-X Firewall (Open Source) Console Bootup Messages and Show Version
by Turritopsis Dohrnii Teo En Ming 18 Mar '24

18 Mar '24

Subject: Cisco ASA 5516-X Firewall (Open Source) Console Bootup Messages and Show Version Good day from Singapore, I have bought this refurbished/second hand/used Cisco ASA 5516-X firewall with FirePOWER Services for SGD$100 at Bukit Panjang Ring Road on 17 Mar 2024 Sunday at about 8.30 PM Singapore Time. Cisco ASA firewalls use open source software. Console Output Below ===================== Rom image verified correctly Cisco Systems ROMMON, Version 1.1.8, RELEASE SOFTWARE Copyright (c) 1994-2015 by Cisco Systems, Inc. Compiled Thu 06/18/2015 12:15:56.43 by builders Current image running: Boot ROM0 Last reset cause: PowerOn DIMM Slot 0 : Present DIMM Slot 1 : Present Platform ASA5516 with 8192 Mbytes of main memory MAC Address: 70:70:8b:67:c9:64 Use BREAK or ESC to interrupt boot. Use SPACE to begin boot immediately. Located '.boot_string' @ cluster 841081. # Attempt autoboot: "boot disk0:" Located 'asa971-4-lfbff-k8.SPA' @ cluster 11. ##################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################### LFBFF signature verified. INIT: version 2.88 booting Starting udev Configuring network interfaces... done. Populating dev cache dosfsck 2.11, 12 Mar 2005, FAT32, LFN There are differences between boot sector and its backup. Differences: (offset:original/backup) 65:01/00 Not automatically fixing this. Starting check/repair pass. Starting verification pass. /dev/sdb1: 116 files, 820003/1798211 clusters dosfsck(/dev/sdb1) returned 0 Mounting /dev/sdb1 IO Memory Nodes: 1 IO Memory Per Node: 499122176 bytes Global Reserve Memory Per Node: 314572800 bytes Nodes=1 LCMB: got 499122176 bytes on numa-id=0, phys=0x1b1400000, virt=0x2aaaaae00000 LCMB: HEAP-CACHE POOL got 314572800 bytes on numa-id=0, virt=0x2aaac8a00000 Processor memory: 4379978902 Compiled on Fri 31-Mar-17 07:21 PDT by builders Total NICs found: 14 i354 rev03 Gigabit Ethernet @ irq255 dev 20 index 08 MAC: 7070.8b67.c964 ivshmem rev03 Backplane Data Interface @ index 09 MAC: 0000.0001.0002 en_vtun rev00 Backplane Control Interface @ index 10 MAC: 0000.0001.0001 en_vtun rev00 Backplane Int-Mgmt Interface @ index 11 MAC: 0000.0001.0003 en_vtun rev00 Backplane Ext-Mgmt Interface @ index 12 MAC: 0000.0000.0000 en_vtun rev00 Backplane Tap Interface @ index 13 MAC: 0000.0100.0001 Verify the activation-key, it might take a while... Running Permanent Activation Key: Licensed features for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 150 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Active perpetual Encryption-DES : Enabled perpetual Encryption-3DES-AES : Enabled perpetual Security Contexts : 2 perpetual Carrier : Disabled perpetual AnyConnect Premium Peers : 4 perpetual AnyConnect Essentials : Disabled perpetual Other VPN Peers : 300 perpetual Total VPN Peers : 300 perpetual AnyConnect for Mobile : Disabled perpetual AnyConnect for Cisco VPN Phone : Disabled perpetual Advanced Endpoint Assessment : Disabled perpetual Shared License : Disabled perpetual Total TLS Proxy Sessions : 1000 perpetual Botnet Traffic Filter : Disabled perpetual Cluster : Enabled perpetual Cluster Members : 2 perpetual VPN Load Balancing : Enabled perpetual Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1) Cisco Adaptive Security Appliance Software Version 9.7(1)4 ****************************** Warning ******************************* This product contains cryptographic features and is subject to United States and local country laws governing, import, export, transfer, and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute, or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return the enclosed items immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export(a)cisco.com. ******************************* Warning ******************************* Cisco Adaptive Security Appliance Software, version 9.7 Copyright (c) 1996-2017 by Cisco Systems, Inc. For licenses and notices for open source software used in this product, please visit http://www.cisco.com/go/asa-opensource Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. Cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Reading from flash... !.. Cryptochecksum (unchanged): e97ddf36 72cca0b4 515230d7 74abffbe INFO: Power-On Self-Test in process. ....................................................................... INFO: Power-On Self-Test complete. INFO: Starting HW-DRBG health test... INFO: HW-DRBG health test passed. INFO: Starting SW-DRBG health test... INFO: SW-DRBG health test passed. Type help or '?' for a list of available commands. cisco> ************************************************************************************************* ************************************************************************************************* cisco> show version Cisco Adaptive Security Appliance Software Version 9.7(1)4 Firepower Extensible Operating System Version 2.1(1.66) Device Manager Version 7.7(1)151 Compiled on Fri 31-Mar-17 07:21 PDT by builders System image file is "disk0:/asa971-4-lfbff-k8.SPA" Config file at boot was "startup-config" cisco up 1 hour 1 min Hardware: ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores) Internal ATA Compact Flash, 8000MB BIOS Flash M25P64 @ 0xfed01000, 16384KB Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1) Number of accelerators: 1 1: Ext: GigabitEthernet1/1 : address is 7070.8b67.c965, irq 255 2: Ext: GigabitEthernet1/2 : address is 7070.8b67.c966, irq 255 3: Ext: GigabitEthernet1/3 : address is 7070.8b67.c967, irq 255 4: Ext: GigabitEthernet1/4 : address is 7070.8b67.c968, irq 255 5: Ext: GigabitEthernet1/5 : address is 7070.8b67.c969, irq 255 6: Ext: GigabitEthernet1/6 : address is 7070.8b67.c96a, irq 255 7: Ext: GigabitEthernet1/7 : address is 7070.8b67.c96b, irq 255 8: Ext: GigabitEthernet1/8 : address is 7070.8b67.c96c, irq 255 9: Int: Internal-Data1/1 : address is 7070.8b67.c964, irq 255 10: Int: Internal-Data1/2 : address is 0000.0001.0002, irq 0 11: Int: Internal-Control1/1 : address is 0000.0001.0001, irq 0 12: Int: Internal-Data1/3 : address is 0000.0001.0003, irq 0 13: Ext: Management1/1 : address is 7070.8b67.c964, irq 0 14: Int: Internal-Data1/4 : address is 0000.0100.0001, irq 0 Licensed features for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 150 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Active perpetual Encryption-DES : Enabled perpetual Encryption-3DES-AES : Enabled perpetual Security Contexts : 2 perpetual Carrier : Disabled perpetual AnyConnect Premium Peers : 4 perpetual AnyConnect Essentials : Disabled perpetual Other VPN Peers : 300 perpetual Total VPN Peers : 300 perpetual AnyConnect for Mobile : Disabled perpetual AnyConnect for Cisco VPN Phone : Disabled perpetual Advanced Endpoint Assessment : Disabled perpetual Shared License : Disabled perpetual Total TLS Proxy Sessions : 1000 perpetual Botnet Traffic Filter : Disabled perpetual Cluster : Enabled perpetual Cluster Members : 2 perpetual VPN Load Balancing : Enabled perpetual Failover cluster licensed features for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 150 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Active perpetual Encryption-DES : Enabled perpetual Encryption-3DES-AES : Enabled perpetual Security Contexts : 4 perpetual Carrier : Disabled perpetual AnyConnect Premium Peers : 8 perpetual AnyConnect Essentials : Disabled perpetual Other VPN Peers : 300 perpetual Total VPN Peers : 300 perpetual AnyConnect for Mobile : Disabled perpetual AnyConnect for Cisco VPN Phone : Disabled perpetual Advanced Endpoint Assessment : Disabled perpetual Shared License : Disabled perpetual Total TLS Proxy Sessions : 1000 perpetual Botnet Traffic Filter : Disabled perpetual Cluster : Enabled perpetual VPN Load Balancing : Enabled perpetual The Running Activation Key feature: 2000 TLS Proxy sessions exceed the limit on the platform, reduced to 1000 TLS Proxy sessions. Serial Number: JAD****00ZZ Running Permanent Activation Key: Configuration register is 0x1 Image type : Release Key Version : A Configuration has not been modified since last system restart. cisco> Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individual in Singapore

1 0

Ukrainian open source app for citizen's digital documents & government services
by Shane Kerr 14 Mar '24

14 Mar '24

Comrades in open source, This popped up on my radar today: https://opensource.diia.gov.ua/en.html It seems like a good initiative, and in general I think that governments have a duty to make source code available whenever possible. I checked the GitHub: https://github.com/diia-open-source/ And it looks like all of the code is under the EUPL, which is a nice copyleft license. However if you look at the main page there is a section titled Open Source Usage License, which takes you here: https://opensource.diia.gov.ua/documents/Public_licence.DOCX This license includes things like: 2.6. This License applies to the territory of all states of the world (except for the territories of states recognized by the Verkhovna Rada of Ukraine as aggressor states, states subject to sanctions in accordance with the Law of Ukraine "On Sanctions", states that are members of customs and military unions with such states). And also: 1.3.5. the Licensee – any person (except for persons of states recognized by the Verkhovna Rada of Ukraine as aggressor states, states subject to sanctions in accordance with the Law of Ukraine “On Sanctions”, states that are members of customs and military unions with such states) who voluntarily uses the Diia mobile application software under a public license; Such provisions would likely prevent the license from being considered free (as in freedom) by folks like the OSI. Honestly I'm not really sure where this second license is meant to apply, since the source code currently is under the EUPL which has no such restrictions. Anyway, I thought it was interesting! Cheers, -- Shane

1 0