This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About deanm
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About deanm
02-17-2022
21Posts
7Likes
0Solutions
Feb 17, 2022Last Visited
User
Activity
User
Profile
Latest posts by deanm
| Subject | Views | Posted |
|---|---|---|
| 15600 | 02-17-2022 07:36 PM | |
| 17255 | 12-23-2021 07:43 AM | |
| 8253 | 11-29-2021 07:00 AM | |
| 19191 | 06-26-2021 02:40 PM | |
| 19419 | 06-22-2021 08:59 PM | |
| 2898 | 01-17-2020 10:24 PM | |
| 3321 | 01-08-2020 08:22 AM | |
| 2677 | 03-11-2018 09:14 AM | |
| 5150 | 11-19-2017 08:46 AM | |
| 5170 | 11-18-2017 07:06 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 11-29-2021 07:00 AM | |
| 2 Likes | 06-26-2021 02:40 PM | |
| 1 Like | 01-17-2020 10:24 PM | |
| 2 Likes | 01-08-2020 08:22 AM | |
| 1 Like | 05-08-2017 07:29 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 01-13-2016 06:19 PM |
| Date Last Visited | 02-17-2022 11:00 PM |
| Posts | 21 |
| Total Likes Received | 7 |
02-17-2022
07:36 PM
@sonet I do not recall, but I think I created the directory after the fact, in order to use custom certs. I suggest creating the directory and changing the permissions, if not already set, to: drwxr-xr-x 3 root root 4096 Dec 21 08:47 minemeld/ The other directories, with the "crazy long numbers" are, on the system, the physical location of the container parts (best I can explain, still a beginner in containers). From there, the rest of the content above should fall into place. If not, I'm happy to help in this conversation or you can send me a DM. From th
... View more
12-23-2021
07:43 AM
This post falls under the category of "I'm a dork" or "DUH". First, thanks to @stangri-la for the post and reminding me I wanted to get back to this issue. I've been running my EDLs without a certificate profile because I could not get my Docker MM instance to take the certificate I generated from my PAN 220, with the PAN as the root CA. I had exported and re-exported the cert from the PAN multiple times, tried various command line switches, all to no avail. This week, coming back to this, instead of simply stripping out the text between ---- BEGIN PRIVATE KEY ---- and the start of the key, I actually looked at it. And, DUH, the PAN exports the private key in encrypted form! Using openssl (openssl rsa -in <source .key file> -out <outfile>), I stripped the password from the key file, copied it and the cert file, without adding the PAN root cert to the cert file, stopped, deleted and restarted MM per above (thanks again!) and it worked like a charm. Morale of the story, slow down and look at what you are doing instead of just doing what you have always done.
... View more
11-29-2021
07:00 AM
1 Kudo
I recently set up the DDNS function with No-IP, registering/setting the address for an address that had a cert (for the DDNS name) from No-IP. The firewall kept returning a "bad" status and the error "Server response: Peer certificate cannot be authenticated with given CA certificates'". I used the information above to grab the correct chain and the top level cert for the chain was already trusted in the "Default Trusted Certificate Authorities" section of the firewall. Although it was trusted already, I could not add it to the cert profile and the firewall did not use it as part of the check. In order to fix the error, I had to export the top level CA cert from the default trusted CA list and re-import to the firewall. The top level CA cert was then shown in the chain, I was able to add it to the cert profile and the address registration to the DDNS name was successful. Mike
... View more
06-26-2021
02:40 PM
2 Kudos
I've made some progress. I can get Minemeld to start with, supposedly, my certs. The issue was the -v option, which apparently, at this point is only used for volumes/directories. For files, --mount is needed instead (https://docs.docker.com/storage/bind-mounts/). My run command now looks like this:
sudo docker run -dit \ --name minemeld \ --restart unless-stopped \ --tmpfs /run \ -v minemeld-local:/opt/minemeld/local \ -v minemeld-logs:/opt/minemeld/log \ --mount type=bind,source=/var/lib/minemeld/real-cert.crt,target=/etc/nginx/minemeld.cer,readonly \ --mount type=bind,source=/var/lib/minemeld/real-cert.pem,target=/etc/nginx/minemeld.pem,readonly \ -p 443:443 -p 80:80 \ paloaltonetworks/minemeld
Docker starts Minemeld without any errors returned, but the site is still not accessible. I first assumed that it did not like my root CA, which is a local CA from my PAN firewall. I added the CA to the file
/var/lib/docker/volumes/minemeld-local/_data/certs/bundle.crt (I also tried simply copying the root CA file into that directory and restarting docker).
Unfortunately, although it appears that Minemeld is running, the internal nginx server resets my HTTPS connection attempt and I cannot load the site.
Still searching ......
... View more
06-22-2021
08:59 PM
All, thanks for the info on the thread, it has been very helpful. Like others, I am stuck on replacing the certificates in a docker installation. Where do I copy the "real certs" and how do I update the nginx CA chain to include my internal CA (Docker appears to be using an internal nginx server)?
Based on the sample command, I thought the real certs would go in /var/lib/minemeld. I have to create the /var/lib/minemeld directory and when I do and run the command above, after putting the real certs in /var/lib/minemeld, I receive this error:
docker: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:545: container init caused: rootfs_linux.go:76: mounting "/var/lib/minemeld/real-cert.pem" to rootfs at "/etc/nginx/minemeld.pem" caused: mount through procfd: not a directory: unknown: Are you trying to mount a directory onto a file (or vice-versa)? Check if the specified host path exists and is the expected type.
Thanks,
Mike
... View more
01-17-2020
10:24 PM
1 Kudo
Bump for visibility
... View more
01-08-2020
08:22 AM
2 Kudos
I was receiving feed information from the Zeus tracker miners which was discontinued earlier this year. I removed the miners and deleted them from the aggregators, but the data is still in the feeds.
How do I remove/expire the data?
Attached a screen shot of one of the data entries in the feed.
Thanks!
Mike
... View more
03-11-2018
09:14 AM
Coming back to this, I see the option was closed back in Sep, 2017, but I find that the DNS white list is still case sensitive (I white listed aol.com, the domain feed has AOL.COM, still in the feed as a suspicious domain).
Is it going to remain this way?
Thank you.
... View more
11-18-2017
07:06 PM
My Minemeld system is failing to start, giving an engine error. The last it,e in the log is
2017-11-18T17:38:06 (2843)launcher._run_chassis ERROR: Exception in chassis main procedure Traceback (most recent call last): File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/run/launcher.py", line 53, in _run_chassis c.configure(fts) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/chassis.py", line 102, in configure config=ftconfig.get('config', {}) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/__init__.py", line 10, in factory config=config File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 321, in __init__ super(BasePollerFT, self).__init__(name, chassis, config) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/base.py", line 206, in __init__ self.read_checkpoint() File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/base.py", line 257, in read_checkpoint if contents[0] == '{': IndexError: string index out of range Process Process-1: Traceback (most recent call last): File "/usr/lib/python2.7/multiprocessing/process.py", line 258, in _bootstrap self.run() File "/usr/lib/python2.7/multiprocessing/process.py", line 114, in run self._target(*self._args, **self._kwargs) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/run/launcher.py", line 53, in _run_chassis c.configure(fts) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/chassis.py", line 102, in configure config=ftconfig.get('config', {}) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/__init__.py", line 10, in factory config=config File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 321, in __init__ super(BasePollerFT, self).__init__(name, chassis, config) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/base.py", line 206, in __init__ self.read_checkpoint() File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/base.py", line 257, in read_checkpoint if contents[0] == '{': IndexError: string index out of range 2017-11-18T17:38:16 (2837)launcher.main ERROR: Exception initializing graph Traceback (most recent call last): File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/run/launcher.py", line 284, in main mbusmaster.wait_for_chassis(timeout=10) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/mgmtbus.py", line 141, in wait_for_chassis raise RuntimeError('Timeout waiting for chassis') RuntimeError: Timeout waiting for chassis 2017-11-18T17:38:16 (2837)mgmtbus.checkpoint_graph INFO: checkpoint_graph called, checking current state 2017-11-18T17:38:16 (2837)mgmtbus.checkpoint_graph INFO: graph status None, checkpoint_graph ignored Traceback (most recent call last): File "/opt/minemeld/engine/current/bin/mm-run", line 11, in <module> sys.exit(main()) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/run/launcher.py", line 284, in main mbusmaster.wait_for_chassis(timeout=10) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/mgmtbus.py", line 141, in wait_for_chassis raise RuntimeError('Timeout waiting for chassis') RuntimeError: Timeout waiting for chassis
The only change on my side was to apply am OS X update (running VMWare Fusion, Ubuntu v14)
thank you,
Mike
... View more
05-10-2017
07:46 AM
Thanks again and that definitely makes sense on why you are so versed in the commands :-).
The tool is great, it has made my job of managing my EDLs much, much easier (I am testing it at home and will deploy at work soon).
Is there a way to validate the number of addresses matched? Meaning, if I look at the current reputation.data file and use a regex such as
" egrep -ce '(\d{1,3}\.){3}\d{1,3}\#\d{1,}#\d{1,}\#.*Malicious.*\#(CA|US)' reputation.data"
and that returns a count of 3356, should I see a similar or same number in Minemeld's Update TX counter for that miner? At least, for the first run after an engine start
... View more
05-08-2017
07:29 AM
1 Kudo
Sorry, the output looked like an error so I did not check.
I do have the file and an engine restart shows the issue resolved.
Thanks again!
... View more
05-08-2017
07:08 AM
This is what I get when I run that command:
017-05-08T07:04:14 (13103)cacert_merge.main INFO: config: {'cafile': ['/opt/minemeld/local/certs/site/'], 'dst': '/opt/minemeld/local/certs/bundle.crt', 'config': '/opt/minemeld/local/certs/cacert-merge-config.yml', 'no_merge_certifi': False}
WARNING: old python version (< 2.7.9) - certificate verification not performed
I did try manually running the auto update once as well.
I had to add the .xml extension to the log file in order for the post to be accepted.
... View more
05-07-2017
08:33 PM
After the minemeld update, feeds that I added myself (Zeus tracker, ransomwaretracker) now have a cert error. I have attached the error message.
Mike
... View more
05-07-2017
08:22 AM
How does the contains change things? It did add more, but this time too many (go figure).
Is there a way to see what it is matching?
As always, thanks for the help!
And how did you figure out all of the commands?
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks