Firepower and WINscp - how to get files off SFR module

[evan.chadwick1]

Anyone able to use WINscp to get a file off a sourcefire module? I'm thinking WINscp has issues with the admin user not entering into expert mode by default.

I have a windows environment and can not get the scp secure-copy command to work from SFR to a windows server with port 22 open.

[evan.chadwick1]

Best Idea I can think of is using Firesight abilities to SCP. 

[yogdhanu · Accepted solution]

You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.

Example.

>expert

>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp

This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.

Rate if helps.

Yogesh

[mmccrack3n]

Thanks you for this