Security analysts constantly need to move files around; be it logs, ISO’s or VM’s, in Windows this is pretty easy. But how about in Linux? There are many way’s do move files between Linux machines and today we will discuss one of the most popular. SCP offers speed and versatility when it comes to moving files and allows analysts to seamlessly transfer files to and from a remote machine. Let’s see if we can get it done in two minutes!Continue reading “SCP for Securely transferring files between Linux hosts”
How to use Maxmind GeoLite2 to obtain GeoIP data from the command line
Today let’s talk about how to use Maxmind’s Geolite2 to get geoip data from the command line in Linux. This post is an update to the original “using GeoIP data from the command line” post from September. Maxmind GeoLite legacy databases were discontinued on January 2, 2019 and have moved to the new GeoLite2 format and makes the original article obsolete. The new format requires new tools and scripts so I will treat it as a new article from a technical perspective, however the practical use is still the same from a security analyst’s perspective. So let’s dive right in and get the new format setup and ready to use.Continue reading “How to use Maxmind GeoLite2 to obtain GeoIP data from the command line”
Vi, The Basics of Editing Text on the Command Line Without Pulling Your Hair Out.
Security Analyst’s spend a lot of time on the command line in Linux so it makes sense to have a utility for editing text available. Vi and it’s improved cousin VIM fit the bill nicely; however most folks are intimidated by all of the hot keys and modes. Text editing with Vi is really easy and quick once you learn the basics, and that is today’s topic.Continue reading “Vi, The Basics of Editing Text on the Command Line Without Pulling Your Hair Out.”
Using GeoIP data from the command line
Today’s topic is using GeoIP data from the command line. Security analysts often find they need to ascertain an IP addresses geographic location in order to make decisions. The most obvious use would be around geofencing, i.e. blocking IP’s from certain countries or regions. GeoIP information is simple to acquire from the Linux command line with the tool geoiplookup and the Maxmind dat files. Here is an updated post and video on how to use Maxmind’s GeoLite2 database. How to use GeoLite2 on the command line.Continue reading “Using GeoIP data from the command line”