06-01-2016 02:39 PM - edited 03-12-2019 06:01 AM
Anyone able to use WINscp to get a file off a sourcefire module? I'm thinking WINscp has issues with the admin user not entering into expert mode by default.
I have a windows environment and can not get the scp secure-copy command to work from SFR to a windows server with port 22 open.
Solved! Go to Solution.
06-02-2016 12:30 AM
You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.
Example.
>expert
>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp
This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.
Rate if helps.
Yogesh
06-01-2016 06:18 PM
Best Idea I can think of is using Firesight abilities to SCP.
06-02-2016 12:30 AM
You are right. sourcefire module/sensor does not act as SCP server so you can't use winSC to connect to it. But it does act as SCP client so you can use either firesight or any other SCP server and copy the files to scp server first and then using winscp to get them out.
Example.
>expert
>sudo scp /var/common/file-to-be-copied admin@Firesight-IP:/var/tmp
This will copy the file to /var/tmp directory in firesight. You can use any other SCP server as well.
Rate if helps.
Yogesh
09-23-2019 08:49 AM
Thanks you for this
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide