Jump to content

Christian Stück

Members
  • Content Count

    28
  • Joined

  • Last visited

Profile Information

  • Location
    Germany

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. Hi Forum! We use squid proxy in our dmz for remote users to talk to esmc without vpn. log files show, the service is attacked very often (no surprise opening that port in the internet). Anyone got any ideas hardening the proxy eg 1. by using a different port 2. by using the Agent-Certificate to authenticate against the proxy service? Could the not be done by just adding the CA-cert to squid? Thanks in advance! Christian
  2. Hello Forum, my AV-sceptic Colleagues brought up a Problem with ERAAgent i found on some Machines: ERAAgent opens TCP-Connections up to the OS-Limit so no more connections e.g. for DNS or other services are left. Example: ERAAgent 7.0.577.0 on Windows Server 2012 R2 Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending Count Name ProcessName Group ----- ---- -----
  3. Hello Forum, something everybody knows i think: Customer says Application XY runs slower since Installation of ESET... With Realtime-Scanner it was quite easy so see which files it touched. Is there a way do do something similar with hips, network protection and so on? On Example is an application that uses a webserver and local database and i want to find out what might be affected by eset. customer dreams of a report like "everything eset touched on that system today". Thanks for any ideas! Christian
  4. Hi everyone, i am doing ESETv7 Workshops withs Admins from time to time and want to show them how to troubleshoot / react to security issues. For Antivirus i use EICAR for demonstration. Are there any ways to do this for HIPS, Ransomware-Shield, Network-Protection and other v7-Features? Thanks in Advance! Christian
  5. Hello Nates, i don't want to outsmart ESET and this is a bit dirty but it worked for me once going from ESMC1 (VA) to ESMC2 (Windows) My old database crashed, so it was not a bit loss anyway. Export Certs on ESMC1 Setup ESMC2 from Scratch (with new ip / hostname) Import Certs from ESMC1 in ESMC2 Set ESMC2 to use old Server Cert from ESMC1 (in Server Settings) Resetup Policies in ESMC2 (or maybe export/import), set groups etc. Create Policy on ESMC1 with ESMC2 as Server Address Clients will connect to ESMC2
  6. Hey Forums, i am planning to migrate ERA6 to ESMC on a new Server with different ip (kb) i did similar things before but now kb says to set all clients to new ESMC first and then migrate database to new server. i have quite a big environment and would prefer to run ERA and ESMC side by side for some weeks while switching over the clients in blocks. Are there any thoughts why this could be a bad idea? Thanks in advance! Christian
  7. Hmm, i would think if you do "clean install with same ip" it should work. Of course thats more a manual move than a migration because you have to reconfigure everything like polices etc. Did this once for a customer who wanted to move from VA to Windows and ist was less effort than i thougth. By my experience its easier to keep all clients when you choose "same ip, same certs".
  8. Support helped: There seems to be a bug in ESA when the realm in radius client settings is set to anything except "Current AD Domain". When set to "current AD Domain", the radius auth is working.
  9. Hello Forum, i have two Installations with Sonicwall and ESA using Radius. One is working fine, the other Sonicwall keeps telling me "Failed to decode RADIUS reply (check the shared secret)". There is not that much you can do wrong with the Shared Secret so i'm a bit out of ideas. If i remove the Sonicwall as a client, ESA Radius logs "INFO EIP.Radius.EsaRadiusServer Invalid Auth. packet received from :" and Sonicwall gets a timeout. If i have the client, ESA Radius logs nothing. Is anyone using this or has any ideas for RADIUS? Thanks in advance.
  10. Hello Forum, after some work i got my first iPhone registered at mdm 😄 But it only connects once and i get the error "APNS service certificate validation failed" I allready checked kb for mdm troubleshooting and investigated root certs: grep Entrust /etc/pki/tls/certs/ca-bundle.crt # Entrust Root Certification Authority # Entrust Root Certification Authority - G3 # Entrust.net Certification Authority (2048) # Entrust Root Certification Authority - EC1 # Entrust Root Certification Authority - G2 i tried openssl: openssl s_client -connect gateway.push.apple.com:2195 [..
  11. i think i figured it out. i changed multiple things, so i don't know which one did it: - set server to advanced security (for ios12) - generated a new proxy-cert without a passphrase and with * as servername - works.
  12. Hello ESET, i have an issue with MDM and peer certificates (not https): Agent on MDM (based on VA) is replicating to ESMC-Server. MDMCore is not replicating, gets "SSL Error" MDMCore is using a proxy certificate provided by ESMC-Server. At first i should say that i created a new CA and server/agent-certificates after installation of ESMC and configured the new server-cert in server-settings. Everything is running fine except MDM. While installing MDM with webconsole-connection it got a proxy-certificate from old CA. I tried to change this (unneccessarily while hunting othe
  13. Hi Marcos, hi Michalj, do you have any news on this? Thanks! Christian
  14. Any Agent not reporting to ESMC any more could be defeated by some malware .... but maybe thats paranoid ? Actually i am thinking of events and triggers to tell it-support if any action is required (besides any outbreaks): 0% red Computers less than 10% yellow computers no Computers that were seen > 4 weeks ago (you can not just delete them, you have to investigate.) 0% of computers that where never seen
  15. Hi Kieran, wow, good work! My most common Problems are: computer replaced but not deactivated, user on vacation, laptop offline. We have multiple admin-teams on multiple locations and not all are devoted to ESET the same amount ? Good to hear, that it IS possible to get 100% Regards, Christian
×
×
  • Create New...