Cannot enroll client to server

[mariano kabakian]

hi Velocigurus!

I'm not able to enrol my client to server. I have aVM running velociratpro server and I can access to web mgmt without any problem. The thing is I cannot enrol my pc to the server.

This is the log

INFO] 2021-05-10T10:31:38-03:00 Ring Buffer: Creation {"filename":"C:\\Program Files\\Velociraptor\\Tools/Velociraptor_Buffer.bin","max_size":1073741874}
[INFO] 2021-05-10T10:31:38-03:00 Starting HTTPCommunicator: HTTP Connector to [https://192.168.232.15/velociraptor/]
[INFO] 2021-05-10T10:31:38-03:00 While getting https://192.168.232.15/velociraptor/: Get "https://192.168.232.15/velociraptor/server.pem": x509: certificate is valid for securityonion, not VelociraptorServer
[INFO] 2021-05-10T10:31:38-03:00 Waiting for a reachable server: 1m28s
[INFO] 2021-05-10T10:31:38-03:00 Compiled all artifacts.
[INFO] 2021-05-10T10:33:06-03:00 While getting https://192.168.232.15/velociraptor/: 

 

Any idea or help is welcome

Thanks

[Mike Cohen]

How did you generate the certificate? It looks like your server's certificate is created for the wrong name (securityonion).  Did you use the wizard with `velociraptor config generate -i`? Did you select the self signed option? Do you have another SSL server in front of the Velociraptor server?

When Velociraptor is configured in self signed mode, it expects the server to present a self signed cert with the SAN of "VelociraptorServer" which is exactly signed by the Velociraptor CA. This is a way of pinning the server cert. You can not present a different certificate or MITM proxy the connection or the client will not trust it.

Thanks

Mike

Mike Cohen  Digital Paleontologist,  Velocidex Enterprises M  ‭+61 470 238 491‬  E mi...@velocidex.com

--
You received this message because you are subscribed to the Google Groups "velociraptor-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to velociraptor-dis...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/velociraptor-discuss/394222c3-b085-4275-94f1-a4018bc2eacan%40googlegroups.com.

[mariano kabakian]

Hi Mike

Velociraptor is running into securityOnion server behind a nginx.the CA is the one that securityonion server generates. What shoud I do? generate a new cert?

[Mike Cohen]

Velociraptor clients support two modes of communication:

1. Self signed SSL means the certificate is generated by Velociraptor's internal CA and this is pinned so the clients will refuse to talk to anyone else

2. Non self signed mode requires the certificate to be issued by a proper public CA which chains through the SSL root store to the global root CAs. 

Those are the only safe modes of deploying SSL - specifically it is not supported to have a non-velociraptor self signed SSL certificate because the clients can not verify it. If you are trying to serve the Velociraptor clients through a self signed SSL proxy this is not going to work because the clients can not guarantee that the SSL communication is not being intercepted.

You can serve the Velociraptor SSL connections on a separate port (i.e. not go through the security onion server).

Technically you can switch SSL off completely but this is not a recommended setting because then you rely on Velociraptor's built in encryption for transport encryption.

Here is more information about encryption and communications

https://velociraptor.velocidex.com/velociraptor-network-communications-30568624043a

Thanks

Mike

Mike Cohen  Digital Paleontologist,  Velocidex Enterprises M  ‭+61 470 238 491‬  E mi...@velocidex.com

To view this discussion on the web visit https://groups.google.com/d/msgid/velociraptor-discuss/a8420027-c335-4d70-85a4-136a093ca60cn%40googlegroups.com.

[Wes Lambert]

Mariano,

You may want to try changing your server URL to be that of:

https://192.168.232.15:8000/

Thanks,

Wes

To view this discussion on the web visit https://groups.google.com/d/msgid/velociraptor-discuss/CACREbPBfz9OtWJN-R2thBdKRRAZKYDLcY%2BHzydzxMPspYEfWaw%40mail.gmail.com.

--

https://twitter.com/therealwlambert

https://securityonion.net/