DOCSLIB.ORG

Qradar Application Configuration Guide Provides You with Information About How to Configure Application Mappings

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Qradar Application Configuration Guide Provides You with Information About How to Configure Application Mappings IBM QRadar 7.3.3 Application Configuration Guide IBM Note Before you use this information and the product that it supports, read the information in “Notices” on page 51. Product information This document applies to IBM® QRadar® Security Intelligence Platform V7.3.3 and subsequent releases unless superseded by an updated version of this document. © Copyright International Business Machines Corporation 2014, 2019. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents About this guide.................................................................................................... v Chapter 1. Application mappings........................................................................... 1 Defining new applications............................................................................................................................1 Defining application mappings...............................................................................................................2 Defining application signatures..............................................................................................................5 Chapter 2. Default applications..............................................................................9 ICMP type and code IDs............................................................................................................................ 40 Port IDs...................................................................................................................................................... 42 Protocol IDs............................................................................................................................................... 50 Notices................................................................................................................51 Trademarks................................................................................................................................................ 52 Terms and conditions for product documentation................................................................................... 52 IBM Online Privacy Statement.................................................................................................................. 53 General Data Protection Regulation..........................................................................................................53 Privacy policy considerations ................................................................................................................... 54 iii iv About this guide The IBM QRadar Application Configuration Guide provides you with information about how to configure application mappings. Defining custom applications enables QRadar to classify applications that are used in a flow. Application mapping is useful when you investigate various types of security threats. Intended Audience The guide is intended for the system administrator who configures application mappings in your QRadar deployment. You must have QRadar administrative access and a knowledge of your corporate network and networking technologies. Technical documentation To find IBM QRadar product documentation on the web, including all translated documentation, access the IBM Knowledge Center (http://www.ibm.com/support/knowledgecenter/SS42VS/welcome). For information about how to access more technical documentation in the QRadar products library, see QRadar Support – Assistance 101 (https://ibm.biz/qradarsupport). Contacting customer support For information about contacting customer support, see QRadar Support – Assistance 101 (https:// ibm.biz/qradarsupport). Statement of good security practices IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. Please Note: Use of this Program may implicate various laws or regulations, including those related to privacy, data protection, employment, and electronic communications and storage. IBM QRadar may be used only for lawful purposes and in a lawful manner. Customer agrees to use this Program pursuant to, and assumes all responsibility for complying with, applicable laws, regulations and policies. Licensee represents that it will obtain or has obtained any consents, permissions, or licenses required to enable its lawful use of IBM QRadar. © Copyright IBM Corp. 2014, 2019 v vi IBM QRadar : QRadar Application Configuration Guide Chapter 1. Application mappings IBM QRadarincludes default application IDs. However, you can edit the application mapping file to ensure that traffic is appropriately classified in QRadar. What is an application ID? When QRadar detects a flow, it assigns an application ID to the flow. The application ID is assigned based on the protocol and ports that are used for the flow, and the flow content. QRadar default application IDs are allocated based on the Service Name and Transport Protocol Port Number Registry (http:// www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt). What tasks are required to map applications? When you create or customize an application mapping, do the following tasks in sequence. 1. Define new applications The application configuration file contains default applications. To define new applications, you must add new applications IDs to the application configuration file. 2. Map traffic to the new applications by using one of the following methods: • Define application mappings Update the application mapping file, which maps applications to application IDs based on IP address and port number. • Define application signatures Define application signatures to apply to flows that the default application mapping does not automatically detect. To assign application IDs to flows, this method requires you to create rules that are based on IP address, port, and content. To define port-only application signatures, configure port mappings in the application mapping file, not the application signatures file. Defining new applications To define new applications, edit the application configuration file. About this task When you define new applications, the application ID number must not exist in the apps.conf file. Assign numbers that are in the 15,000 - 20,000 range for custom applications. The format of the entry uses the following syntax: <appname><appid> The application name <appname> is used in the Network Activity and Offenses tabs. You can specify an application name with up to five application levels. However, QRadar uses only three levels of the application name. Use a number sign (#) to separate each level of the application name. The following example defines the Authentication.Radius-1646 application with an application ID of 51343: Authentication#Radius-1646####51343 Five application levels are represented in the application ID. Application levels are separated by number sign (#). If an application ID contains fewer than five levels, include the number signs for all five levels. © Copyright IBM Corp. 2014, 2019 1 For example, to add Authentication#Radius-1646####51343as an application ID, insert the application ID as follows: Authentication#Radius-1645####51342 Authentication#Radius-1646####51343 <- inserted application Authentication#Radius-1812####51344 Authentication#Radius-1813####51345 Procedure 1. Using SSH, log in to QRadar as the root user. 2. Open the following file: /store/configservices/staging/globalconfig/apps.conf 3. Insert new applications and ensure that you insert the new application ID in alphabetical order. 4. Save and exit the file. 5. Log in to QRadar as an administrator. 6. Click the Admin tab. 7. On the toolbar, click Deploy Changes. What to do next Choose one of the following options: • To define application mappings, see “Defining application mappings” on page 2. • To define application signatures, see “Defining application signatures” on page 5. Defining application mappings To identify application signatures, create user-defined application mappings that are based on the IP address and port number. Before you begin You must add the new application IDs. For more information, see “Defining new applications” on page 1. About this task When you update the application mapping file, follow these guidelines: • Each line in the file indicates a mapped application. You can specify multiple mappings, each on a separate line, for the same application. • You can specify a wildcard character (*) for any field. Use the wildcard character alone, and not as part of a comma-separated list. The wildcard character indicates that the field applies to all flows. • You can associate a flow with multiple mappings.
Load more

Recommended publications
  • Towards Web-Based Delta Synchronization for Cloud Storage Services
    Towards Web-based Delta Synchronization for Cloud Storage Services He Xiao Zhenhua Li ∗ Ennan Zhai Tianyin Xu Tsinghua University Tsinghua University Yale University UIUC Yang Li Yunhao Liu Quanlu Zhang Yao Liu Tsinghua University Tsinghua University Microsoft Research SUNY Binghamton Abstract savings in the presence of users’ file edits [29, 39, 40]. Delta synchronization (sync) is crucial for network-level Unfortunately, today delta sync is only available for efficiency of cloud storage services. Practical delta sync PC clients and mobile apps, but not for the web—the most pervasive and OS-independent access method [37]. techniques are, however, only available for PC clients 0 and mobile apps, but not web browsers—the most per- After a file f is edited into a new version f by users, vasive and OS-independent access method. To under- Dropbox’s PC client will apply delta sync to automati- stand the obstacles of web-based delta sync, we imple- cally upload only the altered bits to the cloud; in contrast, Dropbox’s web interface requires users to manually up- ment a delta sync solution, WebRsync, using state-of- 0 1 the-art web techniques based on rsync, the de facto delta load the entire content of f to the cloud. This gap sig- sync protocol for PC clients. Our measurements show nificantly affects web-based user experiences in terms of that WebRsync severely suffers from the inefficiency of both sync speed and traffic cost. JavaScript execution inside web browsers, thus leading Web is a fairly popular access method for cloud stor- to frequent stagnation and even hanging.
    [Show full text]
  • Uila Supported Apps
    Uila Supported Applications and Protocols updated Oct 2020 Application/Protocol Name Full Description 01net.com 01net website, a French high-tech news site. 050 plus is a Japanese embedded smartphone application dedicated to 050 plus audio-conferencing. 0zz0.com 0zz0 is an online solution to store, send and share files 10050.net China Railcom group web portal. This protocol plug-in classifies the http traffic to the host 10086.cn. It also 10086.cn classifies the ssl traffic to the Common Name 10086.cn. 104.com Web site dedicated to job research. 1111.com.tw Website dedicated to job research in Taiwan. 114la.com Chinese web portal operated by YLMF Computer Technology Co. Chinese cloud storing system of the 115 website. It is operated by YLMF 115.com Computer Technology Co. 118114.cn Chinese booking and reservation portal. 11st.co.kr Korean shopping website 11st. It is operated by SK Planet Co. 1337x.org Bittorrent tracker search engine 139mail 139mail is a chinese webmail powered by China Mobile. 15min.lt Lithuanian news portal Chinese web portal 163. It is operated by NetEase, a company which 163.com pioneered the development of Internet in China. 17173.com Website distributing Chinese games. 17u.com Chinese online travel booking website. 20 minutes is a free, daily newspaper available in France, Spain and 20minutes Switzerland. This plugin classifies websites. 24h.com.vn Vietnamese news portal 24ora.com Aruban news portal 24sata.hr Croatian news portal 24SevenOffice 24SevenOffice is a web-based Enterprise resource planning (ERP) systems. 24ur.com Slovenian news portal 2ch.net Japanese adult videos web site 2Shared 2shared is an online space for sharing and storage.
    [Show full text]
  • Red Hat Enterprise Linux 3 Security Guide
    Red Hat Enterprise Linux 3 Security Guide Red Hat Enterprise Linux 3: Security Guide Copyright © 2003 by Red Hat, Inc. Red Hat, Inc. 1801 Varsity Drive Raleigh NC 27606-2072 USA Phone: +1 919 754 3700 Phone: 888 733 4281 Fax: +1 919 754 3701 PO Box 13588 Research Triangle Park NC 27709 USA rhel-sg(EN)-3-Print-RHI (2003-07-25T17:12) Copyright © 2003 by Red Hat, Inc. This material may be distributed only subject to the terms and conditions set forth in the Open Publication License, V1.0 or later (the latest version is presently available at http://www.opencontent.org/openpub/). Distribution of substantively modified versions of this document is prohibited without the explicit permission of the copyright holder. Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is prohibited unless prior permission is obtained from the copyright holder. Red Hat, Red Hat Network, the Red Hat "Shadow Man" logo, RPM, Maximum RPM, the RPM logo, Linux Library, PowerTools, Linux Undercover, RHmember, RHmember More, Rough Cuts, Rawhide and all Red Hat-based trademarks and logos are trademarks or registered trademarks of Red Hat, Inc. in the United States and other countries. Linux is a registered trademark of Linus Torvalds. Motif and UNIX are registered trademarks of The Open Group. XFree86 is a trademark of The XFree86 Project, Inc, and is pending registration. Intel and Pentium are registered trademarks of Intel Corporation. Itanium and Celeron are trademarks of Intel Corporation. AMD, Opteron, Athlon, Duron, and K6 are registered trademarks of Advanced Micro Devices, Inc.
    [Show full text]
  • Cisco SCA BB Protocol Reference Guide
    Cisco Service Control Application for Broadband Protocol Reference Guide Protocol Pack #60 August 02, 2018 Cisco Systems, Inc. www.cisco.com Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco website at www.cisco.com/go/offices. THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
    [Show full text]
  • Traffic Recognition in Cellular Networks
    IT 09 010 Examensarbete 30 hp March 2009 Traffic Recognition in Cellular Networks Alexandros Tsourtis Institutionen för informationsteknologi Department of Information Technology Abstract Traffic Recognition in Cellular Networks Alexandros Tsourtis Teknisk- naturvetenskaplig fakultet UTH-enheten Traffic recognition is a powerful tool that could provide valuable information about the network to the network operator. The association of additional information Besöksadress: carried by control packets in the core cellular network would help identify the traffic Ångströmlaboratoriet Lägerhyddsvägen 1 that stem from each user and acquire statistics about the usage of the network Hus 4, Plan 0 resources and aid detecting problems that only one or a small group of users experience. The program used is called TAM and it operates only on Internet traffic. Postadress: The enhancements of the program included the support for the Gn and Gi interfaces Box 536 751 21 Uppsala of the cellular network where the control traffic is transferred via the GTP and RADIUS protocols respectively. Furthermore, the program output is verified using Telefon: two other tools that operate on the field with satisfactory results and weaknesses 018 – 471 30 03 were detected on all tools studied. Finally, the results of TAM were demonstrated Telefax: with conclusions being drawn about the statistics of the network. The thesis 018 – 471 30 00 concludes with suggestions for improving the program in the future. Hemsida: http://www.teknat.uu.se/student Handledare: Tord Westholm Ämnesgranskare: Ivan Christoff Examinator: Anders Jansson IT 09 010 Tryckt av: Reprocentralen ITC Acknowledgements My thanks goes first to my supervisor in Ericsson, Tord Westholm for sug- gesting valuable comments, helping to structure the work and the presenta- tion and allowing me to take decisions concerning the project direction.
    [Show full text]
  • Cheat Sheet – Common Ports (PDF)
    COMMON PORTS packetlife.net TCP/UDP Port Numbers 7 Echo 554 RTSP 2745 Bagle.H 6891-6901 Windows Live 19 Chargen 546-547 DHCPv6 2967 Symantec AV 6970 Quicktime 20-21 FTP 560 rmonitor 3050 Interbase DB 7212 GhostSurf 22 SSH/SCP 563 NNTP over SSL 3074 XBOX Live 7648-7649 CU-SeeMe 23 Telnet 587 SMTP 3124 HTTP Proxy 8000 Internet Radio 25 SMTP 591 FileMaker 3127 MyDoom 8080 HTTP Proxy 42 WINS Replication 593 Microsoft DCOM 3128 HTTP Proxy 8086-8087 Kaspersky AV 43 WHOIS 631 Internet Printing 3222 GLBP 8118 Privoxy 49 TACACS 636 LDAP over SSL 3260 iSCSI Target 8200 VMware Server 53 DNS 639 MSDP (PIM) 3306 MySQL 8500 Adobe ColdFusion 67-68 DHCP/BOOTP 646 LDP (MPLS) 3389 Terminal Server 8767 TeamSpeak 69 TFTP 691 MS Exchange 3689 iTunes 8866 Bagle.B 70 Gopher 860 iSCSI 3690 Subversion 9100 HP JetDirect 79 Finger 873 rsync 3724 World of Warcraft 9101-9103 Bacula 80 HTTP 902 VMware Server 3784-3785 Ventrilo 9119 MXit 88 Kerberos 989-990 FTP over SSL 4333 mSQL 9800 WebDAV 102 MS Exchange 993 IMAP4 over SSL 4444 Blaster 9898 Dabber 110 POP3 995 POP3 over SSL 4664 Google Desktop 9988 Rbot/Spybot 113 Ident 1025 Microsoft RPC 4672 eMule 9999 Urchin 119 NNTP (Usenet) 1026-1029 Windows Messenger 4899 Radmin 10000 Webmin 123 NTP 1080 SOCKS Proxy 5000 UPnP 10000 BackupExec 135 Microsoft RPC 1080 MyDoom 5001 Slingbox 10113-10116 NetIQ 137-139 NetBIOS 1194 OpenVPN 5001 iperf 11371 OpenPGP 143 IMAP4 1214 Kazaa 5004-5005 RTP 12035-12036 Second Life 161-162 SNMP 1241 Nessus 5050 Yahoo! Messenger 12345 NetBus 177 XDMCP 1311 Dell OpenManage 5060 SIP 13720-13721
    [Show full text]
  • Introduction to Web 2.0 Technologies
    Introduction to Web 2.0 Joshua Stern, Ph.D. Introduction to Web 2.0 Technologies What is Web 2.0? Æ A simple explanation of Web 2.0 (3 minute video): http://www.youtube.com/watch?v=0LzQIUANnHc&feature=related Æ A complex explanation of Web 2.0 (5 minute video): http://www.youtube.com/watch?v=nsa5ZTRJQ5w&feature=related Æ An interesting, fast-paced video about Web.2.0 (4:30 minute video): http://www.youtube.com/watch?v=NLlGopyXT_g Web 2.0 is a term that describes the changing trends in the use of World Wide Web technology and Web design that aim to enhance creativity, secure information sharing, increase collaboration, and improve the functionality of the Web as we know it (Web 1.0). These have led to the development and evolution of Web-based communities and hosted services, such as social-networking sites (i.e. Facebook, MySpace), video sharing sites (i.e. YouTube), wikis, blogs, etc. Although the term suggests a new version of the World Wide Web, it does not refer to any actual change in technical specifications, but rather to changes in the ways software developers and end- users utilize the Web. Web 2.0 is a catch-all term used to describe a variety of developments on the Web and a perceived shift in the way it is used. This shift can be characterized as the evolution of Web use from passive consumption of content to more active participation, creation and sharing. Web 2.0 Websites allow users to do more than just retrieve information.
    [Show full text]
  • The Application Usage and Risk Report an Analysis of End User Application Trends in the Enterprise
    The Application Usage and Risk Report An Analysis of End User Application Trends in the Enterprise 8th Edition, December 2011 Palo Alto Networks 3300 Olcott Street Santa Clara, CA 94089 www.paloaltonetworks.com Table of Contents Executive Summary ........................................................................................................ 3 Demographics ............................................................................................................................................. 4 Social Networking Use Becomes More Active ................................................................ 5 Facebook Applications Bandwidth Consumption Triples .......................................................................... 5 Twitter Bandwidth Consumption Increases 7-Fold ................................................................................... 6 Some Perspective On Bandwidth Consumption .................................................................................... 7 Managing the Risks .................................................................................................................................... 7 Browser-based Filesharing: Work vs. Entertainment .................................................... 8 Infrastructure- or Productivity-Oriented Browser-based Filesharing ..................................................... 9 Entertainment Oriented Browser-based Filesharing .............................................................................. 10 Comparing Frequency and Volume of Use
    [Show full text]
  • Porte TCP/IP 19/09/2021
    1 MarkOne Tools Porte TCP/IP 19/09/2021 1 PORTS 0F TCP/IP Protocols and Services Introduction The port numbers are divided into three ranges: the Well Known Ports: are those from 0 through 1023. DCCP Well Known ports SHOULD NOT be used without IANA registration. The registration procedure is defined in [RFC4340], Section 19.9. the Registered Ports: are those from 1024 through 49151. DCCP Registered ports SHOULD NOT be used without IANA registration. The registration procedure is defined in [RFC4340], Section 19.9. the Dynamic and/or Private Ports: are those from 49152 through 65535 PLEASE NOTE THE FOLLOWING: 1. UNASSIGNED PORT NUMBERS SHOULD NOT BE USED. THE IANA WILL ASSIGN THE NUMBER FOR THE PORT AFTER YOUR APPLICATION HAS BEEN APPROVED. 2. ASSIGNMENT OF A PORT NUMBER DOES NOT IN ANY WAY IMPLY AN ENDORSEMENT OF AN APPLICATION OR PRODUCT, AND THE FACT THAT NETWORK TRAFFIC IS FLOW- ING TO OR FROM A REGISTERED PORT DOES NOT MEAN THAT IT IS "GOOD" TRAFFIC. FIREWALL AND SYSTEM ADMINISTRATORS SHOULD CHOOSE HOW TO CONFIGURE THEIR SYSTEMS BASED ON THEIR KNOWLEDGE OF THE TRAFFIC IN QUESTION, NOT WHETHER THERE IS A PORT NUMBER REGISTERED OR NOT. Socket: è costituito dal concatenamento di un indirizzo IP con il numero di porta di una specifica applicazione (p.es. 10.65.10.13:2001) TCP/IP protocols Port Name Alias 0 IP IP 1 icmp ICMP 3 ggp GGP 6 tcp TCP 8 egp EGP 12 pup PUP 17 udp UDP 20 hmp HMP 22 xns-idp XNS-IDP 27 rdp RDP 66 rvd RVD 1 last updated 2007-01-24 2 MarkOne Tools Porte TCP/IP 19/09/2021 WELL KNOWN PORT NUMBERS The Well Known Ports are assigned by the IANA and on most systems can only be used by system (or root) processes or by programs executed by privileged users.
    [Show full text]
  • List of NMAP Scripts Use with the Nmap –Script Option
    List of NMAP Scripts Use with the nmap –script option Retrieves information from a listening acarsd daemon. Acarsd decodes ACARS (Aircraft Communication Addressing and Reporting System) data in real time. The information retrieved acarsd-info by this script includes the daemon version, API version, administrator e-mail address and listening frequency. Shows extra information about IPv6 addresses, such as address-info embedded MAC or IPv4 addresses when available. Performs password guessing against Apple Filing Protocol afp-brute (AFP). Attempts to get useful information about files from AFP afp-ls volumes. The output is intended to resemble the output of ls. Detects the Mac OS X AFP directory traversal vulnerability, afp-path-vuln CVE-2010-0533. Shows AFP server information. This information includes the server's hostname, IPv4 and IPv6 addresses, and hardware type afp-serverinfo (for example Macmini or MacBookPro). Shows AFP shares and ACLs. afp-showmount Retrieves the authentication scheme and realm of an AJP service ajp-auth (Apache JServ Protocol) that requires authentication. Performs brute force passwords auditing against the Apache JServ protocol. The Apache JServ Protocol is commonly used by ajp-brute web servers to communicate with back-end Java application server containers. Performs a HEAD or GET request against either the root directory or any optional directory of an Apache JServ Protocol ajp-headers server and returns the server response headers. Discovers which options are supported by the AJP (Apache JServ Protocol) server by sending an OPTIONS request and lists ajp-methods potentially risky methods. ajp-request Requests a URI over the Apache JServ Protocol and displays the result (or stores it in a file).
    [Show full text]
  • 17 Basic Networking Clients
    Certification Basic Networking Clients UNIT 17 Basic Networking Clients 1 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. UNIT 16: Objectives ? Learn basic network commands ? Learn how to communicate securely with remote hosts ? Understand the use of rsync and wget 2 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. UNIT 17: Agenda ? ssh / scp / telnet ? lftp ? links ? mutt ? rsync / wget ? ping / traceroute / host 3 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. ssh: Secure Shell ? Public-key encryption technology replacement for various unsecure services ? Allows secure access to remote systems · $ ssh joe@barney -or- · $ ssh -l joe barney joe@barney's password: · $ ssh barney ls /tmp 4 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. scp: Secure copy ? Secure replacement for rcp ? Layered on top of ssh · $ scp source destination ? Remote files can be specified using: · user@host:/path/to/file · -r option enables recursion · -p preserves times and permissions · -C compresses datastream 5 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. telnet and the “r” services ? Insecure protocols ? telnet: Login names and passwords pass over the network in clear text ? “r” services (rsh, rlogin, rcp): generally insecure authentication mechanism ? telnet client can be used to connect to services running on arbitrary ports ? Example: testing your mail server: $ telnet localhost 25 6 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc. lftp ? Versatile command-line FTP client ? Anonymous or real-user sessions $ lftp ftp.cdrom.com $ lftp -u joe ftp.myserver.com ? Automated transfers with lftpget 7 Rev RH033-RHEL3-1 Copyright © 2003 Red Hat, Inc.
    [Show full text]
  • IT Acronyms.Docx
    List of computing and IT abbreviations /.—Slashdot 1GL—First-Generation Programming Language 1NF—First Normal Form 10B2—10BASE-2 10B5—10BASE-5 10B-F—10BASE-F 10B-FB—10BASE-FB 10B-FL—10BASE-FL 10B-FP—10BASE-FP 10B-T—10BASE-T 100B-FX—100BASE-FX 100B-T—100BASE-T 100B-TX—100BASE-TX 100BVG—100BASE-VG 286—Intel 80286 processor 2B1Q—2 Binary 1 Quaternary 2GL—Second-Generation Programming Language 2NF—Second Normal Form 3GL—Third-Generation Programming Language 3NF—Third Normal Form 386—Intel 80386 processor 1 486—Intel 80486 processor 4B5BLF—4 Byte 5 Byte Local Fiber 4GL—Fourth-Generation Programming Language 4NF—Fourth Normal Form 5GL—Fifth-Generation Programming Language 5NF—Fifth Normal Form 6NF—Sixth Normal Form 8B10BLF—8 Byte 10 Byte Local Fiber A AAT—Average Access Time AA—Anti-Aliasing AAA—Authentication Authorization, Accounting AABB—Axis Aligned Bounding Box AAC—Advanced Audio Coding AAL—ATM Adaptation Layer AALC—ATM Adaptation Layer Connection AARP—AppleTalk Address Resolution Protocol ABCL—Actor-Based Concurrent Language ABI—Application Binary Interface ABM—Asynchronous Balanced Mode ABR—Area Border Router ABR—Auto Baud-Rate detection ABR—Available Bitrate 2 ABR—Average Bitrate AC—Acoustic Coupler AC—Alternating Current ACD—Automatic Call Distributor ACE—Advanced Computing Environment ACF NCP—Advanced Communications Function—Network Control Program ACID—Atomicity Consistency Isolation Durability ACK—ACKnowledgement ACK—Amsterdam Compiler Kit ACL—Access Control List ACL—Active Current
    [Show full text]