cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
22304
Views
50
Helpful
3
Replies

Firepower and WINscp - how to get files off SFR module

evan.chadwick1
Level 1
Level 1

Anyone able to use WINscp to get a file off a sourcefire module? I'm thinking WINscp has issues with the admin user not entering into expert mode by default.

I have a windows environment and can not get the scp secure-copy command to work from SFR to a windows server with port 22 open.

1 Accepted Solution

Accepted Solutions

You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.

Example.

>expert

>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp

This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.

Rate if helps.

Yogesh

View solution in original post

3 Replies 3

evan.chadwick1
Level 1
Level 1

Best Idea I can think of is using Firesight abilities to SCP. 

You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.

Example.

>expert

>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp

This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.

Rate if helps.

Yogesh

Thanks you for this

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: