topic Best Idea I can think of is in Network Security

Firepower and WINscp - how to get files off SFR module

evan.chadwick1 — Tue, 12 Mar 2019 13:01:57 GMT

Anyone able to use WINscp to get a file off a sourcefire module? I'm thinking WINscp has issues with the admin user not entering into expert mode by default.

I have a windows environment and can not get the scp secure-copy command to work from SFR to a windows server with port 22 open.

Best Idea I can think of is

evan.chadwick1 — Thu, 02 Jun 2016 01:18:05 GMT

Best Idea I can think of is using Firesight abilities to SCP.

You are right. sourcefire

yogdhanu — Thu, 02 Jun 2016 07:30:49 GMT

You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.

Example.

>expert

>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp

This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.

Rate if helps.

Yogesh

Re: You are right. sourcefire

mmccrack3n — Mon, 23 Sep 2019 15:49:03 GMT

Thanks you for this