Finding Cisco IOS XE CVE-2023-20198 With ConfigSources
On October 16, 2023, Cisco published a vulnerability that affects IOS XE machines running the built-in web server:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z This is tracked ashttps://nvd.nist.gov/vuln/detail/CVE-2023-20198 By adding a simple Config Check to an existing Cisco IOS ConfigSource, LogicMonitor can help people quickly identify which resources have the web server enabled. Here is an example: Name: Cisco-CSCwh87343-Check Check type: "Use Groovy Script" Groovy script: /* The built-in string variable 'config' contains the entire contents of the configuration file. The following example will trigger an alert when the configuration file contains the string "blue". if (config.contains("blue")) { return 1; } else { return 0; } */ if (config.contains("ip http")) { return 1; } else { return 0; } Then trigger this type of alert: Warning Description: "Search for presence of Cisco CSCwh87343 vulnerability" Caveats: -This will apply to all devices where the ConfigSource is used, even though all devices may not be affected by the vulnerability -This assumes usage of ConfigSources and specifically the Cisco_iOS ConfigSource Thanks to Todd Ritter for finding this CVE and Creating the ConfigSource
LogicMonitor Security Best Practices
At LogicMonitorwe take the protection of customer data and cybersecurity very seriously. Security is a team effort and partnership between LogicMonitor and our valued customers. Below we have provided our recommended guidance on security best practices, and how to keep your LogicMonitor portals secure, including the 2FA authentication enablement. General Security LogicMonitor Security Corporate site: LogicMonitor’s Security corporate site provides resources for our customers who are interested in reviewing our security white papers or accessing SOC2 Type 2 and SOC3 reports. Security Best Practices: This comprehensive document offers invaluable security guidance and best practices which LogicMonitor strongly recommends be diligently followed. It also provides critical insights into how LogicMonitorsecures customer accounts, such as regular updates to strong, unique passwords and not sharingaccount information. Configuring Multi & Single Sign On Single Sign-On Integration Setup Guide: Single Sign-On (SSO) is a powerful mechanism for enforcing robust authentication measures, including 2FA, while simultaneously mitigating the risk of password-related issues. This guide outlines the prerequisites and initial setup steps for SSO, including how to restrict account access to SSO user accounts. Multi Sign-On Integration Setup Guide: Multi-sign on augments security by requiring multiple authentication factors. This document empowers administrators to add multiple tenants (Identity Providers), and manage users directly from their Identity Provider (IdP). Microsoft Azure Active Directory (AD) IdP for Single Sign-On (SSO) Setup Guide: Customers interested in utilizing Microsoft Azure Active Directory (AD) IdP for SSO will find this guide invaluable. It provides step-by-step instructions for integrating Azure with LogicMonitor. Additional Tools to Increase Security Account IP Whitelisting: Customers looking to restrict access to their accounts, based on specific IP addresses or subnets, can refer to point five (5) in the "Configuring the Portal Settings" section document for detailed guidance. Role Based Access Control settings: Role-Based Access Controls offer a powerful means of restricting access to security features or entire product sections for specific user groups. This document explains the numerous configurations available at the role level, ensuring that your security posture aligns seamlessly with your business requirements. Preparing for two-factor authentication (2FA) Remote Session Access Control: In preparation of implementing 2FA, this document comprehensively explains the Access Controls available for the Remote Session feature, allowing for enhanced security through customizable access restrictions or feature disabling. 2FA Setup Guide: This guide provides step-by-step instructions on configuring 2FA at various levels. LogicMonitor strongly recommends customers who are not currently using 2FA or employing Single Sign-On (SSO), without enabling the "Restrict to SSO" option, proactively enable 2FA for their non-SSO user accounts. User Reporting for 2FA: The User Report serves as a vital tool in securing your account with 2FA. It facilitates the identification of user accounts that do not currently utilize 2FA or lack associated phone numbers, which could potentially disrupt user access, if not addressed before 2FA is activated. See also 2FA FAQ’s&User Reports.
WinRM Collector and Non-admin scripts beta
Hello, and welcome to LogicMonitor’s Beta for WinRM non-admin automation! At Logicmonitor we are constantly pushing the envelope on security. In our endeavor to further reduce the attack surface of our customers we are proud to bring to you the beta program for monitoring windows devices using least privilege. This beta would also allow you to try out our WinRM based collector. Goal for the beta Validate and test windows monitoring with WinRM based collectors running with least privilege in your environment. We suggest the following operations to test out the non-admin automation 1. Set up a normal WMI based windows collector to monitor your windows devices. 2. Set up at least 10 the WinRM based beta collector by following the instructions in the support page. Ensure that the collectors are not running under admin privilege after completing the setup. 3. Move your devices from the WMI based collector to the beta collector to confirm that the WinRM beta collector fulfills your windows monitoring needs. 4. Test out WMI, Powershell and perfmon datasources Timeline The beta has started and will run Through Sept 30, 2023. Documentation Since the process to install a WinRM collector is slightly more tedious than a normal LM collector, we advise you to go through the documentation before setting it up. Documentation for the beta is available at https://www.logicmonitor.com/support/configuring-winrm-for-windows-collector and updated as questions come in, or as things are added/fixed. Note: The beta is available in EA collector 34.100 and later. All you have to do is follow the steps in the support documentation above to install the WinRM collector. Feedback You can submit your feedback via this linkor post a comment here to chat directly with the product manager. You can also contact Logicmonitor support or you Customer Success Manager for further assistance.
modernize WebSSH client
One of our customers could not connect via the WebSSH client to a newly setup switch using modern SSH algorithms. I personally only rarely use that feature, but I tested it and traced the issue to: %SSH-3-NO_MATCH: No matching kex algorithm found: client diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 server ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256 I added diffie-hellman-group14-sha1 to the switch KEX list, but would prefer to keep only modern algorithms active. Any chance we can get that client updated to negotiate newer algorithms? Security teams are more and more tight on what is allowed to operate within enterprise networks (for good reason). Thanks, Mark
