Adding space to ext3/LVM partitions without losing data

I've recently ran out of space on a server and decided to write a tutorial about this. There are some resources out there but this is a more complete guide of doing this. Mostly I wrote it for me to have a procedure in the future.
Let's assume we add a new disk on the system and we want to increase the space on the existing partitions without having to delete and recreate them. This would be a nighmare when you have partitions streching on 2-3 1TB disks - lost time and also you need to have the space on some other disk to copy the files.
First of all, add the new disk on the machine. Best would be to boot a live CD (e.g. Knoppix) so that we can make the lvm operations "offline". Create a new partition on the disk using fdisk of type "8e" - Linux LVM.
Next, create the physical volume within the new partition. We'll take as example partition /dev/sde1:

# pvcreate /dev/sde1

Extend the existing volume with the newly created physical volume:

# vgextend VolGroup00 /dev/sde1

Next, extend the logical volume to use the space made available by extending the volume group:

# lvextend -L 1000G /dev/VolGroup00/LogVol00

The final step is to enlarge the ext3 partition to fill up the free space. First you'll have to run a check on the filesyste. These operations will take some time, proportional with the size of the partition:

# e2fsck -f /dev/VolGroup00/LogVol00
# resize2fs /dev/VolGroup00/LogVol00

Routing subnets on PIX/ASA interface

Generally is not a good ideea to have your firewall do the job of other devices like routers. However there are situations where is not feasible to invest in a router only to do a small task.
The PIX/ASA does not support the secondary ip address on their interfaces. There is a workaround:

• add a static ARP entry so that your firewall replies to ARP requests; use the MAC of the respective interface:

  arp interface 192.168.2.1 1234.5678.90ab alias

• add a route to your network (in this example 192.168.1.1 is the IP of the interface):

  route interface 192.168.2.0 255.255.255.0 192.168.1.1

Securing Cisco LANs

Security at Layer 2 is often neglected. Yet, having an open data link layer is like sending an invitation to everybody to hack into your network. Here are some simple "best practice" measures (also some not related to Layer 2) you can take so that attacks don't do damage to your network.

Disable Telnet and enable SSH; secure the management protocol
Telnet is a management protocol that should never be used on production environments. It's main weakness is that it's not encrypted. Someone sniffing your traffic could gain knowledge about your credentials and network configuration.
Example for doing this on a Catalyst switch running IOS:

router(config)# hostname router
router(config)# ip domain-name domain
router(config)# aaa new-model
router(config)# username cisco password cisco
router(config)# crypto key generate rsa
router(config)# access-list 10 permit 192.168.23.45 # the IP of your management console
router(config)# line vty 0 4
router(config-line)# transport input ssh
router(config-line)# access-class 10 in

This also permits only your management station to login to the switch (access-list 10).
Don't use other unencrypted protocols eighter, like SNMP v1 or v2, FTP of TFTP.

Software updates
Keep your switch/router/firewall software updated. In every update security holes are resolved. IOS images or ASA/PIX software can be found in http://www.cisco.com/kobayashi/sw-center/index.shtml. You need a CCO account though; this isn't a problem if your organisation is a Cisco customer.

Don't use VLAN 1 for any purpose
VLAN 1 is the VLAN where switch ports are asigned by default, protocols like CDP, VTP and PAgP where designed to communicate. That's why sometimes VLAN 1 spans across the whole network if not carefully pruned. A few recommendations:

• don't use VLAN for regular traffic. Prune VLAN 1 (including shutdown and not connected ports):

  switchport trunk pruning vlan {add | except | none | remove} vlan-list [,vlan[,vlan[,,,]]

• don't use VLAN for inband management; dedicate another VLAN for management. Apply ACLs to this VLAN to allow SSH traffic only from the administrator's management systems;
  
• don't configure the management VLAN on ports that don't require it;
• the most secure, yet expensive, is out-of-band management. Deploy it where it's worth;
• use a VLAN other than VLAN 1 as native vlan:

  switchport trunk native vlan vlan-id

Disable unused services that can favour attacks
Disable Dynamic Trunking Protocol (DTP). If enabled can permit VLAN hopping attacks:

switch(config-if)# switchport nonegotiate

Disable Cisco Discovery Protocol (CDP). Besides the information this could give to an attacker there were some IOS versions that had a vulnerability that allowed Cisco devices to run out of memory or even crash. Here's how to disable it:

switch(config-if)# no cdp enable

Turn off VLAN Trunking Protocol (VTP) if not used. If you must use it use MD5 authentication to protect the message exchange between switches. To turn it off put it in transparent mode on all switches:

switch(config)# vtp mode transparent

To set the VTP password:

switch(config)# vtp password your_password

Use port security
In ARP attacks the intruder obtains IP addresses and other information and then uses it to issue the attack. Using port security you are able to specify the number of MAC addresses or the specific MAC address allowed to connect through the port. Enabling port security and example:

switch(config)# set port security port enable
switch(config)# switchport port-security maximum 5
switch(config)# switchport port-security aging time 2
switch(config)# switchport port-security aging type inactivity

This prenvents also CAM table attacks.
As the functionality/security ratio drops significantly you may want to use this only on server ports.

Use DHCP snooping
The easiest way of doing a Denial Of Service attack on a LAN is to activate a DHCP server that intercepts legitimate user's DHCP requests. In most cases though this happens when an inocent user mistakingly activates the DHCP server on his host. DHCP snooping is a feature that filters untrusted DHCP messages and builds a DHCP snooping binding table.
You can find out how to configure it here: http://crazyvlan.blogspot.com/2008/03/protecting-your-network-against-rogue.html

Dynamic ARP inspection
A client is allowed to send an unsolicited ARP reply thus poisoning the ARP tables of the routers. The information is stored by other hosts in the subnet. An attacker could use this behaviour to "hijack" the traffic. The countermeasure to this attack is to use dynamic ARP inspection.
Dynamic ARP inspection uses the DHCP snooping binding table to allow only those IP-MAC pairs found in the table. Of course you must configure first DHCP snooping otherwise there would be no binding table to use.
To enable ARP inspection:

switch(config)# ip arp inspection vlan vlan-range

Trust interfaces connected to other switches:

switch(config)# ip arp inspection trust

Mitigate spoofing attacks - IP source guard
If IP source guard is activated the switch doesn't learn the MAC address from the device, but from the DHCP snooping binding table. It operates like dynamic ARP inspection but it looks at every packet not just ARP packets.
To activate IP source guard with source IP address filtering:

switch(config-if)# ip verify source

To activate IP source guard with source IP and MAC filtering:

switch(config-if)# ip verify source port-security

STP attack mitigation - BPDU Guard, Root Guard
BPDU guard - disables ports using portfast upon detection of a BPDU message on the port:

switch(config-if)# spanning-tree bpduguard enable

Root guard - disables ports who would become the root bridge due to their BPDU
advertisement

switch(config-if)# spanning-tree guard root

BPDU filter - ports configured with BPDU filter will not send BPDUs and drop all received BDPUs:

switch(config-if)# spanning-tree bpdufilter enable

Preventing broadcast storms
A broadcast storm occurs when broadcast or multicast packets flood a subnet degrading network performance. Enabling broadcast supression:

switch(config-if)# broadcast suppression threshold

Implement 802.1x
802.1x provides an authentication system for devices wishing to attach to a LAN port. Basically only authenticated systems can access the network; the authentication could be even Windows domain credentials. I won't detail it here; this would be the subject of a later article.

Filtering routing protocol updates
Routing protocol updates towards the LAN make no sense as you don't have any routers requiring them. Only hackers could make use of them gaining knowledge of your network. This can be activated on all interfaces by default and disabled only on those interfaces that need it. Here's an example of OSPF:

router(config-router)#passive-interface default
router(config-router)#no passive-interface fastEthernet 0/2

With this only interface f0/2 will exchange routing updates.

If you think of other attacks and measures to mitigate them please post it and I can update the article with new stuff.

Multiple-IP static NAT/port mapping with PIX/ASA

This is the scenario:


When there is a need of mapping an inside IP address to an outside IP we can do static NAT; you can also do only a port redirection. Here's how it's done in ASDM:


But what there is to be done when you have multiple inside IP's that need to be mapped to multiple addresses on the outside? Sure, you can choose a port forward for every inside host, but sometimes this is not enough - the hosts need to have outside "correspondents". ASA/PIX doesn't support adding multiple IPs on the interfaces ("secondary", like you would do on a router). A solution to this is to add a static ARP entry:


Now you can add your new IP for static NAT:

Speedy sh run

Did you ever had to wait 10 seconds until your router config shows up after "show running-config"? Cisco enhaced your routing configuration experience by introducing a command that caches the configuration in memory:

Router(config)# parser config cache interface

After issuing this you have to do a "sh run" to cache the config.
This works on devices with the 12.2 and 12.3 release.

More info:

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtinvgen.html

QoS on PIX/ASA - policing, traffic shaping, priority queuing

I'll try not to make a habit by posting someone else's articles but this is really intreresting and useful:

QoS on the PIX/ASA - Part 1:What Tools are Available?

QoS on the PIX/ASA – Part 2:The Modular Policy Framework

QoS on the PIX/ASA – Part 3:Priority Queuing

QoS on the PIX/ASA – Part 4:Traffic Shaping and Traffic Policing