cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

16073
Views
50
Helpful
3
Replies
Highlighted
Beginner

Firepower and WINscp - how to get files off SFR module

Anyone able to use WINscp to get a file off a sourcefire module? I'm thinking WINscp has issues with the admin user not entering into expert mode by default.

I have a windows environment and can not get the scp secure-copy command to work from SFR to a windows server with port 22 open.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.

Example.

>expert

>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp

This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.

Rate if helps.

Yogesh

View solution in original post

3 REPLIES 3
Highlighted
Beginner

Best Idea I can think of is using Firesight abilities to SCP. 

Highlighted

You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.

Example.

>expert

>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp

This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.

Rate if helps.

Yogesh

View solution in original post

Highlighted

Thanks you for this

Content for Community-Ad