AdSchellevis
commented
4 years ago I need to check the ja3 stuff, but have you updated to the latests 20.7 version? (released yesterday if I'm not mistaken)
Closed L1ghtn1ng closed 3 years ago
AdSchellevis
commented
4 years ago I need to check the ja3 stuff, but have you updated to the latests 20.7 version? (released yesterday if I'm not mistaken)
L1ghtn1ng
commented
4 years ago Yes as I have the new php version 7.3.14 and 5.0.3 of suricata etc
From: Ad Schellevis notifications@github.com Sent: Saturday, May 9, 2020 8:58:12 AM To: opnsense/core core@noreply.github.com Cc: J.Townsend townsend891@hotmail.com; Author author@noreply.github.com Subject: Re: [opnsense/core] 20.7 devel suricata issues (#4095)
I need to check the ja3 stuff, but have you updated to the latests 20.7 version? (released yesterday if I'm not mistaken)
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/opnsense/core/issues/4095#issuecomment-626125087, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AA3V2QX6VST2HIXWPNK6SBTRQUEJJANCNFSM4M4QIXUQ.
AdSchellevis
commented
4 years ago Just tried the same on a test machine over here, seems to be working like a charm:
# curl -o /dev/null http://pkg.opnsense.org/test/eicar.com.txt
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
ja3 support isn't enabled on our suricata version, but we probably should consider that for 20.7, I expect the same messages on 20.1 by the way it wasn't enabled there either
L1ghtn1ng
commented
4 years ago Okay will try what you did and yeah would be good to ja3 support enabled
From: Ad Schellevis notifications@github.com Sent: Saturday, May 9, 2020 2:40:08 PM To: opnsense/core core@noreply.github.com Cc: J.Townsend townsend891@hotmail.com; Author author@noreply.github.com Subject: Re: [opnsense/core] 20.7 devel suricata issues (#4095)
Just tried the same on a test machine over here, seems to be working like a charm:
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
[image]https://user-images.githubusercontent.com/9783985/81475162-ba3b5400-920a-11ea-8800-77c519233c39.png
ja3 support isn't enabled on our suricata version, but we probably should consider that for 20.7, I expect the same messages on 20.1 by the way it wasn't enabled there either
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/opnsense/core/issues/4095#issuecomment-626177835, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AA3V2QQH2NN5G4K6Z5CTI4TRQVMLRANCNFSM4M4QIXUQ.
L1ghtn1ng
commented
4 years ago So doing your command works, but if doing it from https://www.eicar.org/?page_id=3950 does not when it use to before they updated the site/page
L1ghtn1ng
commented
4 years ago You are also only getting 1 alert in your screenshot where as I get 2 for 1 instance of running your command. This issue is not new but can there be something done about this?
mimugmail
commented
4 years ago Do you download via HTTPS?
J.Townsend notifications@github.com schrieb am Sa., 9. Mai 2020, 17:02:
You are also only getting 1 alert in your screenshot where as I get 2 for 1 instance of running your command. This issue is not new but can there be something done about this?
[image: image] https://user-images.githubusercontent.com/3628354/81477207-6c284f80-920e-11ea-984a-0b14fc5a0cc7.png
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/opnsense/core/issues/4095#issuecomment-626189036, or unsubscribe https://github.com/notifications/unsubscribe-auth/AE355IMXYFDBTLG6WLPNF73RQVWAFANCNFSM4M4QIXUQ .
L1ghtn1ng
commented
4 years ago Nope http
L1ghtn1ng
commented
4 years ago The download area has HTTP and HTTPS sections even though the main page is HTTPS I picked the HTTP
AdSchellevis
commented
4 years ago maybe it redirects to https, either way it's not something we can fix. the duplicate messages are a result of drop/alert log if I'm not mistaken, also doesn't seem to be related to our configuration.
L1ghtn1ng
commented
4 years ago I have just noticed that the interface is not showing in the screenshot and have also just confirmed that with the standard theme as well
lordraiden
commented
4 years ago Just tried the same on a test machine over here, seems to be working like a charm:
# curl -o /dev/null http://pkg.opnsense.org/test/eicar.com.txt % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
ja3 support isn't enabled on our suricata version, but we probably should consider that for 20.7, I expect the same messages on 20.1 by the way it wasn't enabled there either
Could you confirm if ja3 will be available in 20.7 or is too early to know? thanks
AdSchellevis
commented
4 years ago @lordraiden it's scheduled, yes https://github.com/opnsense/tools/commit/cc731dcc812d19758e1db4ce93e0f02b793e99a9 . Although this obviously doesn't make a difference for the https/eicar question (the rule needs content to process).
AdSchellevis
commented
3 years ago This issue has been automatically timed-out (after 180 days of inactivity).
For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.
If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.
On my test VM(in virtualbox) of Opnsense 20.7(Using the devel iso) fully up to date it does not block anything in IPS mode.
Using the test rule that has eicar in it does not get blocked and no alerts. This is not an issue on 20.1
The following is from what I have seen in the logs
There is also issues with ja3 support not being enabled due to issues with LibNSS not having MD5 support