Android Apps

Updated list available at https://techpain.com/android-apps-march2017/

My favorite System and Network related Android apps. At the time of this post they are all free and none of them require a rooted device.

  • Mocha VNC Lite: Mocha VNC provides access to VNC Servers. Windows and Mac OS X compatible.
  • uNagi: A Nagios and Incinga client. My favorite features: Allows connections over https, acknowledge notifications, view service and host problems, no additional Nagios plugins required.
  • 2Xclient: An easy to use RDP client.
  • OpenVPN Connect: VPN client for the OpenVPN Access Server, Private Tunnel and OpenVPN Community.
  • Lookout Security & Antivirus: Protection against malware and viruses.
  • FoxFi: Wifi tethering without a rooted device.
  • Fing – Network Tools: Network discover, ping, traceroute, DNS lookup, port scan, and more.
  • Glympse: Not necessarily an app for just tech types, but great for letting people know where you are and when you’ll get to your destination.
  • Quickoffice: View and edit Word, Excel, and PowerPoint files, view PDF’s.
  • Wifi Analyzer: Show information about wifi networks; Channels, stength, and more.
  • WordPress: Easily, write, edit, and publish WordPress posts on WordPress.com AND self-hosted WordPress sites.
  • OpenSignal: Locate better cellular coverage or wi-fi, report dropped calls, and much more.
  • Speedtest.net: Ookla speedtest shows upload and download speeds, as well as ping times.
  • Name.com for Android: Name.com is one of the best registrars out there. This app allows you to manage your Name.com registered domains, including renewal and DNS management. Check domain name availability, register new domain names, and search for domain names based on your geographical location.
  • Servers Ultimate: Turn your Android phone in to a multipurpose server.
  • AndFTP: FTP client that manages multiple FTP connections
  • AirDroid: Connect to your Android phone from your computer to manages SMS and more – with no wires.
Share

RADIUS Windows Server for a Cisco ASA VPN

Connect to your Cisco ASA VPN by authenticating against a Windows RADIUS server

Thanks to FixingIT.wordpress.com. I pulled most of this post from there, made some tweaks, and added the Cisco CLI as an alternative to ASDM.

The following steps are a walk through of configuring a Windows 2008 Server Domain Controller as a RADIUS server for an ASA, and configuring that ASA as the RADIUS client. This will allow VPN users to authenticate against Active Directory instead of locally on the ASA.

These steps assume the following:

  • Windows Server 2008: 192.168.0.10
  • Cisco ASA: 192.168.0.5

 

Configure the ASA

CLI

The applicable parts of the config are as follows:

interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.5 255.255.255.0

aaa-server SERVER protocol radius
accounting-mode simultaneous
aaa-server SERVER host 192.168.0.10
key mysecretkey
radius-common-pw mysecretkey

ASDM

Create an IP Name object for the target

  1. Under the Firewall section, expand the Objects link and select the IP Names.
  2. Click the Add button at the top.
  3. Enter a descriptive name, the IP address of the DC/RADIUS server and a description of the server.
  4. Click OK and then Apply

Create a new AAA Server Group

  1. Click the Remote Access VPN section.
  2. Expand AAA Setup and select AAA Server Groups.
  3. Click the Add button to the right of the AAA Server Groups section.
  4. Give the server group a name, like TEST-AD, and make sure the RADIUS protocol is selected.
  5. Accept the default for the other settings. And click OK

Add the RADIUS server to the Server Group

  1. Select the server group created in the step above.
  2. Click the Add button to the right of Servers in the Select Group.
  3. Under the Interface Name select the interface on the ASA that will have access to the RADIUS server, most likely inside.
  4. Under Server Name or IP Address enter the IP Name you created for the RADIUS server above.
  5. Skip to the Server Secret Key field and create a complex password. Make sure you document this as it is required when configuring the RADIUS server. Re-enter the secret in the Common Password field.
  6. Leave the rest of the settings at the defaults and click Ok.

 

Configuring the Windows 2008 DC/RADIUS Server

*requires domain admin privileges

Add the Network Policy Server function

  1. Connect to the Windows Server 2008 server and launch Server Manager.
  2. Click the Roles object and then click the Add Roles link on the right.
  3. Click Next on the Before You Begin page.
  4. Select the Network Policy and Access Services role and click Next.
  5. Under Role Service select only the Network Policy Server service and click Next.
  6. Click Install.

After the role finishes installing you will need to set up the server using the Network Policy Server (NPS) management tool found under Administrative Tools.

Registering the server

After launching the NPS tool right-click on the entry NPS(Local) and click the Register Server in Active Directory. Follow the default prompts.

Create a RADIUS client entry for the ASA

  1. Expand the RADIUS Clients and Servers folder.
  2. Right-click on RADIUS Clients and select New RADIUS Client.
  3. Create a Friendly Name for the ASA device. I used “CiscoASA” but if you had more than one you might want to make it more unique and identifiable. Make sure you document the Friendly Name used as it will be used later in some of the policies created.
  4. Enter the Server Secret Key specified on during the ASA configuration in the Shared secret and Confirm shared secret field.
  5. Leave the default values for the other settings and click OK. See Figure 1 for all the complete RADIUS Client properties.

Create a Connection Request Policy

  1. Expand the Policies folder.
  2. Right-click on the Connection Request Policies and click New.
  3. Set the Policy Nameto something meaningful. I used CiscoASA because this policy is geared specifically for that RADIUS client. Leave the Type of network access server as Unspecified and click Next.
  4. Under Conditions click Add. Scroll down and select the Client Friendly Name condition and click Add
  5. Specify the friendly name that you used when creating the RADIUS Client above. Click OK and Next.
  6. On the next two pages leave the default settings and click Next.
  7. Under the Specify a Realm Name select the Attribute option on the left. From the drop down menu next to Attribute: on the right select User-Name. Click Next again.
  8. Review the settings on the next page and click Finish.

Create a Network Policy

  1. Right-click the Network Policy folder and click New.
  2. Set the Policy Name to something meaningful. Leave the Type of network access server as Unspecified and click Next.
  3. Under Conditions click Add.
  4. Add a UsersGroup condition to limit access to a specific AD user group. You can use a generic group like Domain Users or create a group specifically to restrict access.
  5. Add a Client Friendly Name condition and again specify the Friendly Name you used for your RADIUS client.
  6. Click Next. Leave Access granted selected and click Next again.
  7. (Important Step) On the authentication methods leave the default selection and add Unencrypted authentication (PAP, SPAP).
  8. Accept the default Constraints and click Next.
  9. Accept the default Radius Settings and click Next. Review the settings and click Finish.

Restart the Network Policy Server service. Probably not be necessary, but not a bad idea.

Test Your RADIUS Authentication

CLI

test-fw# test aaa authentication SERVER host 192.168.0.10 username testuser password mypassword 
INFO: Attempting Authentication test to IP address <192.168.0.10> (timeout: 12 seconds)
INFO: Authentication Successful

ASDM

The ASDM utility includes functionality to test RADIUS Authentication.

  1. If necessary re-launch the ASDM utility.
  2. Return to Configuration > Remote Access VPN > AAA Setup > AAA Server Groups.
  3. Select the new Server Group you created.
  4. From the Servers in the Selected Group section highlight the server you created. Click the Test button on the right.
  5. Select the Authentication radio button. Enter the Username and Password of a user that meets the conditions specified in the Network Policy created above then click OK.
  6. If everything works as designed you should see something similar to “Authentication test to host is successful”
Share

Decrypt a Cisco VPN Client Pre-Shared Key

Cisco - Decrypt a pre-shared key

There is an old article at spiration.co.uk that covers how to setup a VPN client on Ubuntu. It includes details on how to decrypt an obfuscated pre-shared key from a .pcf:
You will then need to compile the cisco-decrypt.c utility which is downloadable from here: http://www.unix-ag.uni-kl.de/~massar/soft/cisco-decrypt.c Note that when you come to compile the program you will need to use the following compile options:

gcc -Wall -o cisco-decrypt cisco-decrypt.c $(libgcrypt-config --libs --cflags)

This will result in a working binary in ./cisco-decrypt:

$./cisco-decrypt encyptedpre-sharedkey
pre-sharedkey

In case you’re curious, here is what cisco-decrypt.c looks like:

/* Decoder for password encoding of Cisco VPN client.
Copyright (C) 2005 Maurice Massar
Thanks to HAL-9000@evilscientists.de for decoding and posting the algorithm!

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/

/*
Requires libgcrypt version 1.1.90 or newer
Compile with:
gcc -Wall -o cisco-decrypt cisco-decrypt.c $(libgcrypt-config --libs --cflags)
Usage:
./cisco-decrypt DEADBEEF...012345678 424242...7261
*/

#include
#include
#include
#include

int hex2bin_c(unsigned int c)
{
if ((c >= '0')&&(c <= '9')) return c - '0'; if ((c >= 'A')&&(c <= 'F')) return c - 'A' + 10; if ((c >= 'a')&&(c <= 'f')) return c - 'a' + 10; return -1; } int hex2bin(const char *str, char **bin, int *len) { char *p; int i, l; if (!bin) return EINVAL; for (i = 0; str[i] != ''; i++) if (hex2bin_c(str[i]) == -1) return EINVAL; l = i; if ((l & 1) != 0) return EINVAL; l /= 2; p = malloc(l); if (p == NULL) return ENOMEM; for (i = 0; i < l; i++) p[i] = hex2bin_c(str[i*2]) << 4 | hex2bin_c(str[i*2+1]); *bin = p; if (len) *len = l; return 0; } int c_decrypt(char *ct, int len, char **resp, char *reslenp) { const char *h1 = ct; const char *h4 = ct + 20; const char *enc = ct + 40; char ht[20], h2[20], h3[20], key[24]; const char *iv = h1; char *res; gcry_cipher_hd_t ctx; int reslen; if (len < 48) return 0; len -= 40; memcpy(ht, h1, 20); ht[19]++; gcry_md_hash_buffer(GCRY_MD_SHA1, h2, ht, 20); ht[19] += 2; gcry_md_hash_buffer(GCRY_MD_SHA1, h3, ht, 20); memcpy(key, h2, 20); memcpy(key+20, h3, 4); /* who cares about parity anyway? */ gcry_md_hash_buffer(GCRY_MD_SHA1, ht, enc, len); if (memcmp(h4, ht, 20) != 0) return -1; res = malloc(len); if (res == NULL) return -1; gcry_cipher_open(&ctx, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_CBC, 0); gcry_cipher_setkey(ctx, key, 24); gcry_cipher_setiv(ctx, iv, 8); gcry_cipher_decrypt(ctx, (unsigned char *)res, len, (unsigned char *)enc, len); gcry_cipher_close(ctx); reslen = len - res[len-1]; res[reslen] = ''; if (resp) *resp = res; if (reslenp) *reslenp = reslen; return 0; } int main(int argc, char *argv[]) { int i, len, ret = 0; char *bin, *pw; gcry_check_version(NULL); for (i = 1; i < argc; i++) { ret = hex2bin(argv[i], &bin, &len); if (ret != 0) { perror("decoding input"); continue; } ret = c_decrypt(bin, len, &pw, NULL); free(bin); if (ret != 0) { perror("decrypting input"); continue; } printf("%sn", pw); free(pw); } exit(ret != 0); }

Share