diff --git a/relatorio.aux b/relatorio.aux index deabd36..8bb0df4 100644 --- a/relatorio.aux +++ b/relatorio.aux @@ -5,10 +5,9 @@ \babel@aux{portuguese}{} \@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {2}Firewall}{2}{}\protected@file@percent } -\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Packet fileter with NAT}{2}{}\protected@file@percent } -\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Packet filtering without NAT}{2}{}\protected@file@percent } -\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}External Network}{2}{}\protected@file@percent } -\@writefile{toc}{\contentsline {subsection}{\numberline {2.4}Internal Network}{2}{}\protected@file@percent } -\@writefile{toc}{\contentsline {section}{\numberline {3}Intrusion Detection}{2}{}\protected@file@percent } -\@writefile{toc}{\contentsline {section}{\numberline {4}Conclusion}{2}{}\protected@file@percent } -\gdef \@abspage@last{2} +\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Packet fileter without NAT}{2}{}\protected@file@percent } +\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Packet filtering with NAT}{3}{}\protected@file@percent } +\@writefile{toc}{\contentsline {section}{\numberline {3}Intrusion Detection}{4}{}\protected@file@percent } +\@writefile{toc}{\contentsline {section}{\numberline {4}Tests utilizados}{5}{}\protected@file@percent } +\@writefile{toc}{\contentsline {section}{\numberline {5}Conclusion}{5}{}\protected@file@percent } +\gdef \@abspage@last{5} diff --git a/relatorio.log b/relatorio.log index aa45a0d..9a48a28 100644 --- a/relatorio.log +++ b/relatorio.log @@ -1,4 +1,4 @@ -This is pdfTeX, Version 3.141592653-2.6-1.40.27 (TeX Live 2026/dev/Arch Linux) (preloaded format=pdflatex 2026.1.17) 16 MAR 2026 16:24 +This is pdfTeX, Version 3.141592653-2.6-1.40.27 (TeX Live 2026/dev/Arch Linux) (preloaded format=pdflatex 2026.1.17) 22 MAR 2026 22:25 entering extended mode \write18 enabled. %&-line parsing enabled. @@ -89,52 +89,80 @@ LaTeX Info: Redefining \textulc on input line 49. LaTeX Info: Redefining \oldstylenums on input line 163. LaTeX Info: Redefining \textsw on input line 173. ) +(/usr/share/texmf-dist/tex/latex/listings/listings.sty +\lst@mode=\count273 +\lst@gtempboxa=\box52 +\lst@token=\toks19 +\lst@length=\count274 +\lst@currlwidth=\dimen143 +\lst@column=\count275 +\lst@pos=\count276 +\lst@lostspace=\dimen144 +\lst@width=\dimen145 +\lst@newlines=\count277 +\lst@lineno=\count278 +\lst@maxwidth=\dimen146 + +(/usr/share/texmf-dist/tex/latex/listings/lstpatch.sty +File: lstpatch.sty 2024/09/23 1.10c (Carsten Heinz) +) +(/usr/share/texmf-dist/tex/latex/listings/lstmisc.sty +File: lstmisc.sty 2024/09/23 1.10c (Carsten Heinz) +\c@lstnumber=\count279 +\lst@skipnumbers=\count280 +\lst@framebox=\box53 +) +(/usr/share/texmf-dist/tex/latex/listings/listings.cfg +File: listings.cfg 2024/09/23 1.10c listings configuration +)) +Package: listings 2024/09/23 1.10c (Carsten Heinz) LaTeX Font Info: Trying to load font information for OT1+EBGaramond-LF on in -put line 11. +put line 28. (/usr/share/texmf-dist/tex/latex/ebgaramond/OT1EBGaramond-LF.fd File: OT1EBGaramond-LF.fd 2023/03/19 (autoinst) Font definitions for OT1/EBGara mond-LF. ) LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be -(Font) scaled to size 12.0pt on input line 11. +(Font) scaled to size 12.0pt on input line 28. (/usr/share/texmf-dist/tex/latex/l3backend/l3backend-pdftex.def File: l3backend-pdftex.def 2024-05-08 L3 backend support: PDF output (pdfTeX) -\l__color_backend_stack_int=\count273 -\l__pdf_internal_box=\box52 +\l__color_backend_stack_int=\count281 +\l__pdf_internal_box=\box54 ) (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux) \openout1 = `relatorio.aux'. -LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 11. -LaTeX Font Info: ... okay on input line 11. -LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 11. -LaTeX Font Info: ... okay on input line 11. -LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 11. -LaTeX Font Info: ... okay on input line 11. -LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 11. -LaTeX Font Info: ... okay on input line 11. -LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 11. -LaTeX Font Info: ... okay on input line 11. -LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 11. -LaTeX Font Info: ... okay on input line 11. -LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 11. -LaTeX Font Info: ... okay on input line 11. -\c@mv@tabular=\count274 -\c@mv@boldtabular=\count275 +LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 28. +LaTeX Font Info: ... okay on input line 28. +LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 28. +LaTeX Font Info: ... okay on input line 28. +LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 28. +LaTeX Font Info: ... okay on input line 28. +LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 28. +LaTeX Font Info: ... okay on input line 28. +LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 28. +LaTeX Font Info: ... okay on input line 28. +LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 28. +LaTeX Font Info: ... okay on input line 28. +LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 28. +LaTeX Font Info: ... okay on input line 28. +\c@mv@tabular=\count282 +\c@mv@boldtabular=\count283 +\c@lstlisting=\count284 LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be -(Font) scaled to size 20.74pt on input line 12. +(Font) scaled to size 20.74pt on input line 29. LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be -(Font) scaled to size 14.4pt on input line 12. +(Font) scaled to size 14.4pt on input line 29. LaTeX Font Info: External font `cmex10' loaded for size -(Font) <14.4> on input line 12. +(Font) <14.4> on input line 29. LaTeX Font Info: External font `cmex10' loaded for size -(Font) <7> on input line 12. +(Font) <7> on input line 29. LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be -(Font) scaled to size 17.28pt on input line 13. +(Font) scaled to size 17.28pt on input line 30. LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be -(Font) scaled to size 17.28pt on input line 13. +(Font) scaled to size 17.28pt on input line 30. (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.toc LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be @@ -155,31 +183,62 @@ LaTeX Font Info: External font `cmex10' loaded for size {/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}{/usr/share/texmf-dist/fonts /enc/dvips/ebgaramond/ebg_dacnth.enc}] +(/usr/share/texmf-dist/tex/latex/listings/lstlang1.sty +File: lstlang1.sty 2024/09/23 1.10c listings language file +) +(/usr/share/texmf-dist/tex/latex/listings/lstlang1.sty +File: lstlang1.sty 2024/09/23 1.10c listings language file +) +LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be +(Font) scaled to size 10.0pt on input line 37. + +Overfull \hbox (7.49481pt too wide) in paragraph at lines 42--44 +\OT1/EBGaramond-LF/m/n/12 As tr[]es re-des tem va-rios servi[]os, o DMZ tem dns +(23.214.219.130), mail(23.214.219.134), + [] + LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be -(Font) scaled to size 14.4pt on input line 19. +(Font) scaled to size 14.4pt on input line 45. -[2] (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux) +[2] + +[3] +LaTeX Font Info: Font shape `OT1/cmtt/bx/n' in size <10> not available +(Font) Font shape `OT1/cmtt/m/n' tried instead on input line 93. + + +[4{/usr/share/texmf-dist/fonts/enc/dvips/cm-super/cm-super-ts1.enc}] +Overfull \hbox (23.24622pt too wide) in paragraph at lines 125--126 +\OT1/EBGaramond-LF/m/n/12 Ao realizar-mos este pro-jeto apren-de-mos so-bre a c +ria[][]ao de sce-na-rios em VMs, a configura[][]ao + [] + + + +[5] (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux) *********** LaTeX2e <2024-11-01> patch level 2 L3 programming layer <2025-01-18> *********** ) Here is how much of TeX's memory you used: - 2577 strings out of 474546 - 48289 string characters out of 5749982 - 436453 words of memory out of 5000000 - 25628 multiletter control sequences out of 15000+600000 - 572213 words of font info for 55 fonts, out of 8000000 for 9000 + 4441 strings out of 474546 + 72785 string characters out of 5749982 + 967296 words of memory out of 5000000 + 27471 multiletter control sequences out of 15000+600000 + 573916 words of font info for 59 fonts, out of 8000000 for 9000 352 hyphenation exceptions out of 8191 - 57i,7n,65p,220b,231s stack positions out of 10000i,1000n,20000p,200000b,200000s + 57i,7n,99p,546b,1693s stack positions out of 10000i,1000n,20000p,200000b,200000s +r/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Regular.pfb> Output written on /home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/rela -torio.pdf (2 pages, 42851 bytes). +torio.pdf (5 pages, 78665 bytes). PDF statistics: - 22 PDF objects out of 1000 (max. 8388607) - 13 compressed objects within 1 object stream + 42 PDF objects out of 1000 (max. 8388607) + 26 compressed objects within 1 object stream 0 named destinations out of 1000 (max. 500000) 1 words of extra memory for PDF output out of 10000 (max. 10000000) diff --git a/relatorio.pdf b/relatorio.pdf index 36397ab..95d68b0 100644 Binary files a/relatorio.pdf and b/relatorio.pdf differ diff --git a/relatorio.synctex.gz b/relatorio.synctex.gz deleted file mode 100644 index 83c287c..0000000 Binary files a/relatorio.synctex.gz and /dev/null differ diff --git a/relatorio.tex b/relatorio.tex index d4f0e1e..bf591c6 100644 --- a/relatorio.tex +++ b/relatorio.tex @@ -1,6 +1,23 @@ \documentclass[12pt,a4paper]{article} \usepackage[portuguese]{babel} \usepackage[lining]{ebgaramond} +\usepackage{listings} + +\lstdefinestyle{mystyle}{ + basicstyle=\ttfamily\footnotesize, + breakatwhitespace=false, + breaklines=true, + captionpos=b, + keepspaces=true, + numbers=left, + numbersep=5pt, + showspaces=false, + showstringspaces=false, + showtabs=false, + tabsize=2 +} + +\lstset{style=mystyle} \title{Practical Assignment \#1} \author{ @@ -15,31 +32,32 @@ \section{Introduction} O objetivo principal deste trabalho era aprender IPTables e como configurar um com o Suricata um sistema de filtração e deteção de ataques. Para esse fim, foi simulado um sistema dividido em três redes e um router para conectar-las. As três redes são a DMZ (23.214.219.128/25, enp0s8), Internal network (192.168.10.0/24, enp0s9) e Internet (87.248.214.0/24, enp0s10). -\begin{verbatim} + +\begin{lstlisting}[language=bash] Rede,Interface,Gama IP DMZ,enp0s8,23.214.219.128/25 Internal,enp0s9,192.168.10.0/24 Internet,enp0s10,87.248.214.0/24 -\end{verbatim} +\end{lstlisting} As três redes tem varios serviços, o DMZ tem dns(23.214.219.130), mail(23.214.219.134), vpn-gw(23.214.219.133), www(23.214.219.132) e smpt(23.214.219.131). A Internal network tem ftp(192.168.10.2), datastore(192.168.10.3) e clientes (nos testes os clientes tem ip 192.168.10.4, mas está configurado para dar para qualquer edereço). Por fim a rede Internet tem dns2 (87.248.214.99) e eden (87.248.214.100), existe também outros serviços (87.248.214.98). Para facilitar a recriação deste sistema foi criado 4 ficheiros .sh (um para cada rede e o router), e disponibilizamos os ficheiros suricata.rules e suricata.yaml, para o suricata que estiver ligado ao Router. Os ficheiros .sh vão ter comandos para configurar o sistema para este exercicio. \section{Firewall} \subsection{Packet fileter without NAT} O policy que foi escolhido foi: -\begin{verbatim} +\begin{lstlisting}[language=bash] iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT -\end{verbatim} +\end{lstlisting} Foi escolhido porque é mais facil dar DROP a todos os pacotes que não foi criado regras do que criar uma regra de DROP para todos os protocolos e possibilidades, o OUTPUT ficou para ACCEPT porque não existe razão para dar DROP dos pacotes que estamos a enviar neste trabalho. Para o router conseguir resolver DNS requests e para aceitar coneções SSH da rede interna ou da VPN gateway foi utilizado estes comandos: -\begin{verbatim} +\begin{lstlisting}[language=bash] sudo iptables -A INPUT -i enp0s10 -p udp --dport 53 -j ACCEPT sudo iptables -A INPUT -i enp0s9 -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -i enp0s8 -s 23.214.219.133 -p tcp --dport 22 -j ACCEPT -\end{verbatim} +\end{lstlisting} Para conseguirmos a confirguração pedida entre redes foi utilizado estes commandos: -\begin{verbatim} +\begin{lstlisting}[language=bash] sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.130 -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --dport 53 -j ACCEPT @@ -51,64 +69,57 @@ sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --dport 44 sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --dport 1194 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.2 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.3 -j ACCEPT -\end{verbatim} +\end{lstlisting} Inicialmente as implementações de respostas a forward eram especificas para cada regra isto é por exemplo: -\begin{verbatim} +\begin{lstlisting}[language=bash] sudo iptables -A FORWARD -o enp0s8 -i enp0s10 -p udp --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT -\end{verbatim} +\end{lstlisting} No entanto isso facilmente originava confusão entre nós, então decimos utilizar estas duas regras: -\begin{verbatim} +\begin{lstlisting}[language=bash] sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT -\end{verbatim} +\end{lstlisting} Neste cenario o uso destas regras faz sentido, mas pode existir outros cenarios no futuro que não queremos uma resposta, e nesse caso temos de criar as regras necessarias. \subsection{Packet filtering with NAT} Para conecções com origem/destino na internet foi utilizado DNAT/SNAT e iptables para "esconder" o ip para a internet que querer aceder a rede interna para não terem acesso ao edereço ip e iproutes para bloquear certos pacotes de entrar, para conseguir a configuração utilizamos estes comandos: -\begin{verbatim} -sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2 --p tcp --dport 21 -j ACCEPT +\begin{lstlisting}[language=bash] +sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2 -p tcp --dport 21 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 20 -j ACCEPT -sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 - -j DNAT --to-destination 192.168.10.3 -sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 - -j DNAT --to-destination 192.168.10.3 -sudo iptables -t nat -A PREROUTING -i enp0s10 -p tcp --dport 21 - -j DNAT --to-destination 192.168.10.2 -sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2 - -p tcp --dport 22 -j ACCEPT -sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden - -p tcp --dport 22 -j ACCEPT -sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s10 -j SNAT - --to-source 87.248.214.97 +sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3 +sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3 +sudo iptables -t nat -A PREROUTING -i enp0s10 -p tcp --dport 21 -j DNAT --to-destination 192.168.10.2 +sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2 -p tcp --dport 22 -j ACCEPT +sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden -p tcp --dport 22 -j ACCEPT +sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s10 -j SNAT --to-source 87.248.214.97 sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 80 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 443 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 21 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 21 -j ACCEPT -\end{verbatim} +\end{lstlisting} \section{Intrusion Detection} As regras que utilizamos para o suricata foram estas: -\begin{verbatim} +\begin{lstlisting}[language=bash] drop tcp \$EXTERNAL\_NET any -> \$HOME\_NET any (msg:"ET"; flags:S; threshold:type both, track by\_src, count 5, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;) drop tcp any any -> any 80 (msg:"SQL injection"; content:"union"; nocase; content:"select"; nocase; classtype:web-application-attack; sid:1000002; rev:1;) drop tcp any any -> any 80 (msg:"SQl injection"; content:"'or 1=1"; nocase; classtype:web-application-attack; sid:1000003; rev:1;) drop tcp any any -> any 80 (msg:"XSS"; content:"" -\end{verbatim} +\end{lstlisting} \section{Conclusion} Ao realizar-mos este projeto aprendemos sobre a criação de scenarios em VMs, a configuração de uma firewall utilizando IPTables e a configuração de um IDS/IPS system utilizando Suricata diff --git a/relatorio.toc b/relatorio.toc index 437967a..20da808 100644 --- a/relatorio.toc +++ b/relatorio.toc @@ -1,9 +1,8 @@ \babel@toc {portuguese}{}\relax \contentsline {section}{\numberline {1}Introduction}{2}{}% \contentsline {section}{\numberline {2}Firewall}{2}{}% -\contentsline {subsection}{\numberline {2.1}Packet fileter with NAT}{2}{}% -\contentsline {subsection}{\numberline {2.2}Packet filtering without NAT}{2}{}% -\contentsline {subsection}{\numberline {2.3}External Network}{2}{}% -\contentsline {subsection}{\numberline {2.4}Internal Network}{2}{}% -\contentsline {section}{\numberline {3}Intrusion Detection}{2}{}% -\contentsline {section}{\numberline {4}Conclusion}{2}{}% +\contentsline {subsection}{\numberline {2.1}Packet fileter without NAT}{2}{}% +\contentsline {subsection}{\numberline {2.2}Packet filtering with NAT}{3}{}% +\contentsline {section}{\numberline {3}Intrusion Detection}{4}{}% +\contentsline {section}{\numberline {4}Tests utilizados}{5}{}% +\contentsline {section}{\numberline {5}Conclusion}{5}{}%