So the F5 is a tricky beast often refereed to as the swiss army knife of network appliances. The appliances primary role in many networks is to load balance and is a beast negotiating SSL. That being said its not always easy to determine how to configure the clients SSL profiles to be secure and still service the public. F5s documentation is helpful but designed to be vague because cipher suites and browser support is always changing. https://support.f5.com/csp/article/K8802
SSL Labs has become the de-facto to use tool that helps the public understand the nuances of SSL by giving an easy to understand letter grade, https://www.ssllabs.com . The website runs a multitude of tests from insuring your certificate is chained correctly to end device OS and browser simulations, to commonly found vulnerability testing. The down fall of having such a sophisticated tool issuing a simple letter score, is not every environment can be configured for an A or B plus.
So I wanted to through an F5 Client SSL Profile out there that at the time of testing got a solid A- and still supported a ton of OS and browser combinations. You will mostly want to keep the defaults but I will highlight what changes you will want to make to get an A. You will need to select Advanced to see some of these settings.
- The first step is to add your public certificate and the intermediate certificates if applicable as well as the key.
- this is what create the certificates chain
- Next you will want to customize the Ciphers that will be used by the F5 to negotiate SSL with the client. This is where 99% of the magic will happen.
- DEFAULT:HIGH: (are pre canned cipher settings created by F5, the additional settings are additional customization.
- !RSA: Do not use RSA ciphers
- !SSLV3: Do not use SSL version 3
- !RC4: Do not use RC4 ciphers
- !EXP: Do not use Cipher length of 40 or 56 bits export strength
- !DES: Do not use Des or triple Des ciphers
- !TLSv1_1: Do not use TLS version 1.1
- !TLSv1: Do not use TlS version 1.0
- !ADH: Do not use ADH ciphers
- !EXPORT: Do not use EXPORT grade (weak) ciphers
- !SHA: Do not use Message Authentication Code SHA 128
- The complete string looks like this:
- DEFAULT:HIGH:!RSA:!SSLV3:!RC4:!EXP:!DES:!TLSv1_1:!TLSv1:!ADH:!EXPORT:!SHA
- Lastly you will want to set up strict SSL renegotiation:
- Check the Renegotiation box
- Next set Secure Renegotiation to "Require Strict"
From here save your SSL client profile, apply it to a public accessible virtual server, and run SSL labs against your server. Its kind of fun testing and playing around to see what modifying the cipher settings.
Enjoy.
**Update**
I have noticed that after upgrading Ubuntu to 20.04 or 22.04 I have run into a little snag. It appears that the upgrade over rights the sysctl.conf file back to default values. The symptom is your wiregurad server will not be forwarded IP V4 or V6 traffic.
To resolve the issue perform the following steps.
- sudo nano /etc/sysctl.conf
- net.ipv4.ip_forward = 1
- sudo sysctl -p
WireGuard is a simple, fast, and secure VPN that utilizes state-of-the-art cryptography. With a small source code footprint, it aims to be faster and leaner than other VPN protocols such as OpenVPN and IPSec. WireGuard is still under development, but even in its non optimized state it is faster than the popular OpenVPN protocol. In fact it connects so quickly you'll likely find your self going to whats my IP to insure your traffic is actually being tunneled.
The WireGuard configuration is as simple as setting up SSH. A connection is established by an exchange of public keys between server and client. Only a client that has its public key in its corresponding server configuration file is allowed to connect. WireGuard sets up standard network interfaces (such as wg0 and wg1), which behave much like the commonly found eth0 interface. This makes it possible to configure and manage WireGuard interfaces using standard tools such as ifconfig and ip. I was going to post a guide but there are so many good guides already on the internet just google it. Also the official documentation is really good and has some install guides as well.
Enjoy, be safe, support and contribute to WireGuard.
The WireGuard configuration is as simple as setting up SSH. A connection is established by an exchange of public keys between server and client. Only a client that has its public key in its corresponding server configuration file is allowed to connect. WireGuard sets up standard network interfaces (such as wg0 and wg1), which behave much like the commonly found eth0 interface. This makes it possible to configure and manage WireGuard interfaces using standard tools such as ifconfig and ip. I was going to post a guide but there are so many good guides already on the internet just google it. Also the official documentation is really good and has some install guides as well.
Enjoy, be safe, support and contribute to WireGuard.
**Update 8/8/2020**
I have been spending some time in the #lobby-bar channel on the Defcon Discord. We have been reminiscing of Defcons' past and one of the attendees posted up a couple Docs from the AP they had worked on. I wanted to post them because they pretty much sum up a lot of peoples Defcon experience at the AP.
**Update 8/8/2020**
Dark Tangent just posted in the info-booth Discord channel a link to the Defcon info page. Really nice easy to use interface and search functionality:
**Update 8/7/2020**
Wall of Sheep aka Packet Hacking Village talk schedule is online.
Shedule:
Where to watch:
**Update 8/6/2020**
DCTV just posted their twitch channel.
**Update 8/6/2020 13:21**
"The following Twitch Streams are available depending on the schedule for each specific track or village. The schedule can be found at https://info.defcon.org/.
I have found if you follow the channels within twitch you can see what channels are live or not.
https://www.twitch.tv/defconorg
https://www.twitch.tv/defcon_music
https://www.twitch.tv/defcon_chill
https://www.twitch.tv/biohackingvillage
https://www.twitch.tv/blueteamvillage
https://www.twitch.tv/bypassvillage
https://www.twitch.tv/cryptovillage
https://www.twitch.tv/hackthesea
https://www.twitch.tv/passwordvillage
https://www.twitch.tv/roguesvillage
https://www.twitch.tv/dcpolicy
https://www.twitch.tv/hamradiovillage
https://www.twitch.tv/ics_village
https://www.twitch.tv/iotvillage
https://www.twitch.tv/monerovillage
https://www.twitch.tv/paymentvillage
https://www.twitch.tv/redteamvillage
**Update 8/6/2020 10:00**
I have found a method to engage in Defcon that works well with me.
- Identify the talks I want to watch
- Create a youtube playlist listing the talks in order of the live Q&A's (then watch them)
- Created calendar events of the live Q&A with the speaker on the Defcon Twitch channel (https://www.twitch.tv/defconorg)
- between live Q&A I want to watch I stream the Defcon Entertainment channel on twitch (https://www.twitch.tv/defcon_music)
- Hang out on the Defcon Discord server in #linecon, #dcg, #pool-1, and the #pool-3 channels we will see which ones i spend the most time in. Currently linecon is holding most of my attention.
We will see when the Villages open up tomorrow how much time I will hang in there.
Defcon 28 Safe Mode is a culture shock, and for me the move to online does not feel as natural as I though it would. I am fighting 18 years of routine and habit that I need to kick. That being said I wanted to create a page where I could keep track of whats going on and where it happening, I imagine there will be a lot of spin off twitch channels and discord channels I will try to keep it up.
Defcon Talks:
The schedule was released https://defcon.org/html/defcon-safemode/dc-safemode-schedule.html One interesting point about the lineup it looks like all the talks will be sequential so you can see every talk if you want.
Defcon Forums:
This is the major jumping off point for everything going down at Defcon 28. Explore the forums that interest you and get involved. Some of the villages have already set up active discord channels and the will list them in their forum channel.
Defcon Entertainment:
Here is a link to some of the live entertainment that will be going down. Defcon has posted the schedule of the live sets and published the twitch channel that will be streaming the performances.
Defcon Swag Shop:
The lines are way shorter... https://www.ebay.com/str/defconcommunications
Discord Servers:
Defcon 28 Main Server: https://discord.gg/defcon
Red Team Village: https://discord.gg/redteamvillage
Blue Team Village: https://discord.gg/nqMrrJ
Wireless Village: https://discord.gg/pfu9mu
Ham Radio Village: https://discord.gg/Dv38mc
Biohacking Village: https://discord.gg/G3TyUp
Defcon Reddit Post
Below is an extensive list that was posted by Defcon on Reddit (https://www.reddit.com/r/Defcon/comments/hzafso/lots_of_links_defcon_and_village_info_pages/)I wanted to capture it here to share with everyone.
Please also consider "The One!", a unofficial consolidated schedule of all the Villages, Talks, Contests, and various Events occurring during DEFCON 28. One page, one look, all things happening!
Lots of things are still missing, As various schedules get released and processed they will appear. Keep coming back to get the latest.
Links
DEFCON home page
DEFCON 28 FAQ
DEFCON FAQ
DEFCON 28 Contest & Events
DEFCON 28 Demolabs Schedule
DEFCON 28 Entertainment
DEFCON 28 Villages
Village info derived from the following pages
DEF CON 28 Villages page
DEF CON 28 Villages Forum page
Villages
Other Interesting Links
Defcon MUD a Multi User Dungeon. An old school game style
that uses telnet to connect to a remote server. Check it out https://mud.mog.ninja/
Other cons during #SummerHackerCamp
Guides/Tips/FAQs
General / previous years
JK-47 - BSidesLV & DEFCON Conference Tips
Just another DEF CON guide
HACKER SUMMER CAMP 2018 GUIDE
On Attending DefCon
Mutual authentication or two-way authentication refers to two parties authenticating each other at the same time. Below is an excerpt from the Wikipedia page, they did a nice job explaining what mutual authentication is.
By default the TLS protocol only proves the identity of the server to the client using X.509 certificate and the authentication of the client to the server is left to the application layer (for example, username and passwords.) TLS also offers client-to-server authentication using client-side X.509 authentication. As it requires provisioning of the certificates to the clients and involves less user-friendly experience, it's rarely used in end-user applications. But at a small scale or proof of concept this is completely reasonable.
Mutual TLS authentication (mTLS) is much more widespread in business-to-business (B2B) applications, where a limited number of programmatic and homogeneous clients are connecting to specific web services, the operational burden is limited, and security requirements are usually much higher as compared to consumer environments. The factor that impacts scaling of this design is not the technology, devices are built to handle millions of SSL transactions, but the policy and procedures around the certificate management and client on-boarding.
In this example a client will be connecting to an Apache web server and authenticate using mutual TLS authentication.
First you must build the web server running SSL. You can find a lot of step by step articles online about how to build an Apache web server preferably on Linux. Also take a look at Lets Encrypt, it's a free SSL certificate issuer that is freaking awesome.
Once you have your web server up and running you will want your client to generate a certificate. This can be done using OpenSSL the de facto for everything SSL on the internet. There are some awesome guides on how to build out the mutual SSL authentication and the accompanying Apache config. The best one I found was on stefanocapitanio.com they do a great job of outlining each step that makes up the mutual TLS authentication. In this example I will Jump ahead to the certificate creation,
This will generate your private key and certificate. You will need to answer the following questions when prompted this makes up the attributes of your client certificate.
|
Here is an example what it will look like.
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:US
State or Province Name (full name) []:State
Locality Name (eg, city) []:City
Organization Name (eg, company) []:Anything
Organizational Unit Name (eg, section) []:Anything
Common Name (eg, fully qualified host name) []:Username
Email Address []:youremail
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:US
State or Province Name (full name) []:State
Locality Name (eg, city) []:City
Organization Name (eg, company) []:Anything
Organizational Unit Name (eg, section) []:Anything
Common Name (eg, fully qualified host name) []:Username
Email Address []:youremail
Next we will combine the Key and Certificate in PKCS#12 file:
|
Once you have generated and installed your client certificate you will want to send ONLY THE PUBLIC CERTIFICATE, in this case client-certificate.pem to the server admin. Your public certificate will be what is used to identify your machine when it attempts to connect tot he web server. Read up on the Apache man pages about he SSLVerifyClient options there is quit a but out there. This is a very basic config.
The server admin will place your certificate in their certificate store and configure Apache.
<VirtualHost *:443> ServerName secure.example.com DocumentRoot "/var/www/html" ServerAdmin [email protected] SSLEngine on SSLCertificateFile /home/sempla1/ssl/server-cert.pem SSLCertificateKeyFile /home/sempla1/ssl/private/server-key.pem SSLVerifyClient require SSLVerifyDepth 10 SSLCACertificateFile /home/sempla1/ssl/client-certificate.pem </VirtualHost> |
That's it I had a good time playing with this I hope you do as well.