vasco/FSI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

relatorio

Browse Source
This commit is contained in:
vascoalvesxyz
2026-03-22 22:25:47 +00:00
parent 1db4072c19
commit 51c5d2acc1
6 changed files with 154 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
relatorio.aux
View File

@@ -5,10 +5,9 @@
\babel@aux{portuguese}{} \babel@aux{portuguese}{}
\@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {2}Firewall}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {2}Firewall}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Packet fileter with NAT}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Packet fileter without NAT}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Packet filtering without NAT}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Packet filtering with NAT}{3}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}External Network}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {3}Intrusion Detection}{4}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.4}Internal Network}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {4}Tests utilizados}{5}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}Intrusion Detection}{2}{}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {5}Conclusion}{5}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Conclusion}{2}{}\protected@file@percent } \gdef \@abspage@last{5}
\gdef \@abspage@last{2}

137
relatorio.log
View File

@@ -1,4 +1,4 @@
This is pdfTeX, Version 3.141592653-2.6-1.40.27 (TeX Live 2026/dev/Arch Linux) (preloaded format=pdflatex 2026.1.17) 16 MAR 2026 16:24 This is pdfTeX, Version 3.141592653-2.6-1.40.27 (TeX Live 2026/dev/Arch Linux) (preloaded format=pdflatex 2026.1.17) 22 MAR 2026 22:25
entering extended mode entering extended mode
\write18 enabled. \write18 enabled.
%&-line parsing enabled. %&-line parsing enabled.
@@ -89,52 +89,80 @@ LaTeX Info: Redefining \textulc on input line 49.
LaTeX Info: Redefining \oldstylenums on input line 163. LaTeX Info: Redefining \oldstylenums on input line 163.
LaTeX Info: Redefining \textsw on input line 173. LaTeX Info: Redefining \textsw on input line 173.
) )
(/usr/share/texmf-dist/tex/latex/listings/listings.sty
\lst@mode=\count273
\lst@gtempboxa=\box52
\lst@token=\toks19
\lst@length=\count274
\lst@currlwidth=\dimen143
\lst@column=\count275
\lst@pos=\count276
\lst@lostspace=\dimen144
\lst@width=\dimen145
\lst@newlines=\count277
\lst@lineno=\count278
\lst@maxwidth=\dimen146
(/usr/share/texmf-dist/tex/latex/listings/lstpatch.sty
File: lstpatch.sty 2024/09/23 1.10c (Carsten Heinz)
)
(/usr/share/texmf-dist/tex/latex/listings/lstmisc.sty
File: lstmisc.sty 2024/09/23 1.10c (Carsten Heinz)
\c@lstnumber=\count279
\lst@skipnumbers=\count280
\lst@framebox=\box53
)
(/usr/share/texmf-dist/tex/latex/listings/listings.cfg
File: listings.cfg 2024/09/23 1.10c listings configuration
))
Package: listings 2024/09/23 1.10c (Carsten Heinz)
LaTeX Font Info: Trying to load font information for OT1+EBGaramond-LF on in LaTeX Font Info: Trying to load font information for OT1+EBGaramond-LF on in
put line 11. put line 28.
(/usr/share/texmf-dist/tex/latex/ebgaramond/OT1EBGaramond-LF.fd (/usr/share/texmf-dist/tex/latex/ebgaramond/OT1EBGaramond-LF.fd
File: OT1EBGaramond-LF.fd 2023/03/19 (autoinst) Font definitions for OT1/EBGara File: OT1EBGaramond-LF.fd 2023/03/19 (autoinst) Font definitions for OT1/EBGara
mond-LF. mond-LF.
) )
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 12.0pt on input line 11. (Font) scaled to size 12.0pt on input line 28.
(/usr/share/texmf-dist/tex/latex/l3backend/l3backend-pdftex.def (/usr/share/texmf-dist/tex/latex/l3backend/l3backend-pdftex.def
File: l3backend-pdftex.def 2024-05-08 L3 backend support: PDF output (pdfTeX) File: l3backend-pdftex.def 2024-05-08 L3 backend support: PDF output (pdfTeX)
\l__color_backend_stack_int=\count273 \l__color_backend_stack_int=\count281
\l__pdf_internal_box=\box52 \l__pdf_internal_box=\box54
) )
(/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux) (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux)
\openout1 = `relatorio.aux'. \openout1 = `relatorio.aux'.
LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 11. LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 28.
LaTeX Font Info: ... okay on input line 11. LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 11. LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 28.
LaTeX Font Info: ... okay on input line 11. LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 11. LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 11. LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 11. LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 11. LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 11. LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 11. LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 11. LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 28.
LaTeX Font Info: ... okay on input line 11. LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 11. LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 11. LaTeX Font Info: ... okay on input line 28.
\c@mv@tabular=\count274 \c@mv@tabular=\count282
\c@mv@boldtabular=\count275 \c@mv@boldtabular=\count283
\c@lstlisting=\count284
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 20.74pt on input line 12. (Font) scaled to size 20.74pt on input line 29.
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 14.4pt on input line 12. (Font) scaled to size 14.4pt on input line 29.
LaTeX Font Info: External font `cmex10' loaded for size LaTeX Font Info: External font `cmex10' loaded for size
(Font) <14.4> on input line 12. (Font) <14.4> on input line 29.
LaTeX Font Info: External font `cmex10' loaded for size LaTeX Font Info: External font `cmex10' loaded for size
(Font) <7> on input line 12. (Font) <7> on input line 29.
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 17.28pt on input line 13. (Font) scaled to size 17.28pt on input line 30.
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be
(Font) scaled to size 17.28pt on input line 13. (Font) scaled to size 17.28pt on input line 30.
(/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.toc (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.toc
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be
@@ -155,31 +183,62 @@ LaTeX Font Info: External font `cmex10' loaded for size
{/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}{/usr/share/texmf-dist/fonts {/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}{/usr/share/texmf-dist/fonts
/enc/dvips/ebgaramond/ebg_dacnth.enc}] /enc/dvips/ebgaramond/ebg_dacnth.enc}]
(/usr/share/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2024/09/23 1.10c listings language file
)
(/usr/share/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2024/09/23 1.10c listings language file
)
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 10.0pt on input line 37.
Overfull \hbox (7.49481pt too wide) in paragraph at lines 42--44
\OT1/EBGaramond-LF/m/n/12 As tr[]es re-des tem va-rios servi[]os, o DMZ tem dns
(23.214.219.130), mail(23.214.219.134),
[]
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be
(Font) scaled to size 14.4pt on input line 19. (Font) scaled to size 14.4pt on input line 45.
[2] (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux) [2]
[3]
LaTeX Font Info: Font shape `OT1/cmtt/bx/n' in size <10> not available
(Font) Font shape `OT1/cmtt/m/n' tried instead on input line 93.
[4{/usr/share/texmf-dist/fonts/enc/dvips/cm-super/cm-super-ts1.enc}]
Overfull \hbox (23.24622pt too wide) in paragraph at lines 125--126
\OT1/EBGaramond-LF/m/n/12 Ao realizar-mos este pro-jeto apren-de-mos so-bre a c
ria[][]ao de sce-na-rios em VMs, a configura[][]ao
[]
[5] (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux)
*********** ***********
LaTeX2e <2024-11-01> patch level 2 LaTeX2e <2024-11-01> patch level 2
L3 programming layer <2025-01-18> L3 programming layer <2025-01-18>
*********** ***********
) )
Here is how much of TeX's memory you used: Here is how much of TeX's memory you used:
2577 strings out of 474546 4441 strings out of 474546
48289 string characters out of 5749982 72785 string characters out of 5749982
436453 words of memory out of 5000000 967296 words of memory out of 5000000
25628 multiletter control sequences out of 15000+600000 27471 multiletter control sequences out of 15000+600000
572213 words of font info for 55 fonts, out of 8000000 for 9000 573916 words of font info for 59 fonts, out of 8000000 for 9000
352 hyphenation exceptions out of 8191 352 hyphenation exceptions out of 8191
57i,7n,65p,220b,231s stack positions out of 10000i,1000n,20000p,200000b,200000s 57i,7n,99p,546b,1693s stack positions out of 10000i,1000n,20000p,200000b,200000s
</usr/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Bold.pfb></us </usr/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Bold.pfb></us
r/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Regular.pfb> r/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Regular.pfb></usr/s
hare/texmf-dist/fonts/type1/public/amsfonts/cm/cmtt10.pfb></usr/share/texmf-dis
t/fonts/type1/public/cm-super/sftt1000.pfb>
Output written on /home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/rela Output written on /home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/rela
torio.pdf (2 pages, 42851 bytes). torio.pdf (5 pages, 78665 bytes).
PDF statistics: PDF statistics:
22 PDF objects out of 1000 (max. 8388607) 42 PDF objects out of 1000 (max. 8388607)
13 compressed objects within 1 object stream 26 compressed objects within 1 object stream
0 named destinations out of 1000 (max. 500000) 0 named destinations out of 1000 (max. 500000)
1 words of extra memory for PDF output out of 10000 (max. 10000000) 1 words of extra memory for PDF output out of 10000 (max. 10000000)

BIN
relatorio.pdf
View File

Binary file not shown.

BIN
relatorio.synctex.gz
View File

Binary file not shown.

79
relatorio.tex
View File

@@ -1,6 +1,23 @@
\documentclass[12pt,a4paper]{article} \documentclass[12pt,a4paper]{article}
\usepackage[portuguese]{babel} \usepackage[portuguese]{babel}
\usepackage[lining]{ebgaramond} \usepackage[lining]{ebgaramond}
\usepackage{listings}
\lstdefinestyle{mystyle}{
basicstyle=\ttfamily\footnotesize,
breakatwhitespace=false,
breaklines=true,
captionpos=b,
keepspaces=true,
numbers=left,
numbersep=5pt,
showspaces=false,
showstringspaces=false,
showtabs=false,
tabsize=2
}
\lstset{style=mystyle}
\title{Practical Assignment \#1} \title{Practical Assignment \#1}
\author{ \author{
@@ -15,31 +32,32 @@
\section{Introduction} \section{Introduction}
O objetivo principal deste trabalho era aprender IPTables e como configurar um com o Suricata um sistema de filtração e deteção de ataques. Para esse fim, foi simulado um sistema dividido em três redes e um router para conectar-las. As três redes são a DMZ (23.214.219.128/25, enp0s8), Internal network (192.168.10.0/24, enp0s9) e Internet (87.248.214.0/24, enp0s10). O objetivo principal deste trabalho era aprender IPTables e como configurar um com o Suricata um sistema de filtração e deteção de ataques. Para esse fim, foi simulado um sistema dividido em três redes e um router para conectar-las. As três redes são a DMZ (23.214.219.128/25, enp0s8), Internal network (192.168.10.0/24, enp0s9) e Internet (87.248.214.0/24, enp0s10).
\begin{verbatim}
\begin{lstlisting}[language=bash]
Rede,Interface,Gama IP Rede,Interface,Gama IP
DMZ,enp0s8,23.214.219.128/25 DMZ,enp0s8,23.214.219.128/25
Internal,enp0s9,192.168.10.0/24 Internal,enp0s9,192.168.10.0/24
Internet,enp0s10,87.248.214.0/24 Internet,enp0s10,87.248.214.0/24
\end{verbatim} \end{lstlisting}
As três redes tem varios serviços, o DMZ tem dns(23.214.219.130), mail(23.214.219.134), vpn-gw(23.214.219.133), www(23.214.219.132) e smpt(23.214.219.131). A Internal network tem ftp(192.168.10.2), datastore(192.168.10.3) e clientes (nos testes os clientes tem ip 192.168.10.4, mas está configurado para dar para qualquer edereço). Por fim a rede Internet tem dns2 (87.248.214.99) e eden (87.248.214.100), existe também outros serviços (87.248.214.98). As três redes tem varios serviços, o DMZ tem dns(23.214.219.130), mail(23.214.219.134), vpn-gw(23.214.219.133), www(23.214.219.132) e smpt(23.214.219.131). A Internal network tem ftp(192.168.10.2), datastore(192.168.10.3) e clientes (nos testes os clientes tem ip 192.168.10.4, mas está configurado para dar para qualquer edereço). Por fim a rede Internet tem dns2 (87.248.214.99) e eden (87.248.214.100), existe também outros serviços (87.248.214.98).
Para facilitar a recriação deste sistema foi criado 4 ficheiros .sh (um para cada rede e o router), e disponibilizamos os ficheiros suricata.rules e suricata.yaml, para o suricata que estiver ligado ao Router. Os ficheiros .sh vão ter comandos para configurar o sistema para este exercicio. Para facilitar a recriação deste sistema foi criado 4 ficheiros .sh (um para cada rede e o router), e disponibilizamos os ficheiros suricata.rules e suricata.yaml, para o suricata que estiver ligado ao Router. Os ficheiros .sh vão ter comandos para configurar o sistema para este exercicio.
\section{Firewall} \section{Firewall}
\subsection{Packet fileter without NAT} \subsection{Packet fileter without NAT}
O policy que foi escolhido foi: O policy que foi escolhido foi:
\begin{verbatim} \begin{lstlisting}[language=bash]
iptables -P INPUT DROP iptables -P INPUT DROP
iptables -P FORWARD DROP iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT iptables -P OUTPUT ACCEPT
\end{verbatim} \end{lstlisting}
Foi escolhido porque é mais facil dar DROP a todos os pacotes que não foi criado regras do que criar uma regra de DROP para todos os protocolos e possibilidades, o OUTPUT ficou para ACCEPT porque não existe razão para dar DROP dos pacotes que estamos a enviar neste trabalho. Foi escolhido porque é mais facil dar DROP a todos os pacotes que não foi criado regras do que criar uma regra de DROP para todos os protocolos e possibilidades, o OUTPUT ficou para ACCEPT porque não existe razão para dar DROP dos pacotes que estamos a enviar neste trabalho.
Para o router conseguir resolver DNS requests e para aceitar coneções SSH da rede interna ou da VPN gateway foi utilizado estes comandos: Para o router conseguir resolver DNS requests e para aceitar coneções SSH da rede interna ou da VPN gateway foi utilizado estes comandos:
\begin{verbatim} \begin{lstlisting}[language=bash]
sudo iptables -A INPUT -i enp0s10 -p udp --dport 53 -j ACCEPT sudo iptables -A INPUT -i enp0s10 -p udp --dport 53 -j ACCEPT
sudo iptables -A INPUT -i enp0s9 -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -i enp0s9 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -i enp0s8 -s 23.214.219.133 -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -i enp0s8 -s 23.214.219.133 -p tcp --dport 22 -j ACCEPT
\end{verbatim} \end{lstlisting}
Para conseguirmos a confirguração pedida entre redes foi utilizado estes commandos: Para conseguirmos a confirguração pedida entre redes foi utilizado estes commandos:
\begin{verbatim} \begin{lstlisting}[language=bash]
sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.130 -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.130 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --dport 53 -j ACCEPT
@@ -51,64 +69,57 @@ sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --dport 44
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --dport 1194 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --dport 1194 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.2 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.2 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.3 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.3 -j ACCEPT
\end{verbatim} \end{lstlisting}
Inicialmente as implementações de respostas a forward eram especificas para cada regra isto é por exemplo: Inicialmente as implementações de respostas a forward eram especificas para cada regra isto é por exemplo:
\begin{verbatim} \begin{lstlisting}[language=bash]
sudo iptables -A FORWARD -o enp0s8 -i enp0s10 -p udp --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A FORWARD -o enp0s8 -i enp0s10 -p udp --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
\end{verbatim} \end{lstlisting}
No entanto isso facilmente originava confusão entre nós, então decimos utilizar estas duas regras: No entanto isso facilmente originava confusão entre nós, então decimos utilizar estas duas regras:
\begin{verbatim} \begin{lstlisting}[language=bash]
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
\end{verbatim} \end{lstlisting}
Neste cenario o uso destas regras faz sentido, mas pode existir outros cenarios no futuro que não queremos uma resposta, e nesse caso temos de criar as regras necessarias. Neste cenario o uso destas regras faz sentido, mas pode existir outros cenarios no futuro que não queremos uma resposta, e nesse caso temos de criar as regras necessarias.
\subsection{Packet filtering with NAT} \subsection{Packet filtering with NAT}
Para conecções com origem/destino na internet foi utilizado DNAT/SNAT e iptables para "esconder" o ip para a internet que querer aceder a rede interna para não terem acesso ao edereço ip e iproutes para bloquear certos pacotes de entrar, para conseguir a configuração utilizamos estes comandos: Para conecções com origem/destino na internet foi utilizado DNAT/SNAT e iptables para "esconder" o ip para a internet que querer aceder a rede interna para não terem acesso ao edereço ip e iproutes para bloquear certos pacotes de entrar, para conseguir a configuração utilizamos estes comandos:
\begin{verbatim} \begin{lstlisting}[language=bash]
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2 sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2 -p tcp --dport 21 -j ACCEPT
-p tcp --dport 21 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 20 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 20 -j ACCEPT
sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3
-j DNAT --to-destination 192.168.10.3 sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3
sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 sudo iptables -t nat -A PREROUTING -i enp0s10 -p tcp --dport 21 -j DNAT --to-destination 192.168.10.2
-j DNAT --to-destination 192.168.10.3 sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2 -p tcp --dport 22 -j ACCEPT
sudo iptables -t nat -A PREROUTING -i enp0s10 -p tcp --dport 21 sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden -p tcp --dport 22 -j ACCEPT
-j DNAT --to-destination 192.168.10.2 sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s10 -j SNAT --to-source 87.248.214.97
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2
-p tcp --dport 22 -j ACCEPT
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden
-p tcp --dport 22 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s10 -j SNAT
--to-source 87.248.214.97
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 80 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 443 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 443 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 21 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 21 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 21 -j ACCEPT sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 21 -j ACCEPT
\end{verbatim} \end{lstlisting}
\section{Intrusion Detection} \section{Intrusion Detection}
As regras que utilizamos para o suricata foram estas: As regras que utilizamos para o suricata foram estas:
\begin{verbatim} \begin{lstlisting}[language=bash]
drop tcp \$EXTERNAL\_NET any -> \$HOME\_NET any (msg:"ET"; flags:S; threshold:type both, track by\_src, count 5, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;) drop tcp \$EXTERNAL\_NET any -> \$HOME\_NET any (msg:"ET"; flags:S; threshold:type both, track by\_src, count 5, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;)
drop tcp any any -> any 80 (msg:"SQL injection"; content:"union"; nocase; content:"select"; nocase; classtype:web-application-attack; sid:1000002; rev:1;) drop tcp any any -> any 80 (msg:"SQL injection"; content:"union"; nocase; content:"select"; nocase; classtype:web-application-attack; sid:1000002; rev:1;)
drop tcp any any -> any 80 (msg:"SQl injection"; content:"'or 1=1"; nocase; classtype:web-application-attack; sid:1000003; rev:1;) drop tcp any any -> any 80 (msg:"SQl injection"; content:"'or 1=1"; nocase; classtype:web-application-attack; sid:1000003; rev:1;)
drop tcp any any -> any 80 (msg:"XSS"; content:"<script"; nocase; classtype:web-application-attack; sid:1000004; rev:1;) drop tcp any any -> any 80 (msg:"XSS"; content:"<script"; nocase; classtype:web-application-attack; sid:1000004; rev:1;)
\end{verbatim} \end{lstlisting}
A primeira é para port scaning, a segunda e a terceira é para o caso de SQL injection, e a ultima é para XSS atacks. A primeira é para port scaning, a segunda e a terceira é para o caso de SQL injection, e a ultima é para XSS atacks.
Também atualizamos o iptables para passar para o suricata os pacotes para analizar e bloquear com: Também atualizamos o iptables para passar para o suricata os pacotes para analizar e bloquear com:
\begin{verbatim} \begin{lstlisting}[language=bash]
sudo iptables -I FORWARD -j NFQUEUE --queue-bypass sudo iptables -I FORWARD -j NFQUEUE --queue-bypass
sudo iptables -I INPUT -j NFQUEUE --queue-bypass sudo iptables -I INPUT -j NFQUEUE --queue-bypass
\end{verbatim} \end{lstlisting}
\section{Tests utilizados} \section{Tests utilizados}
Netcat foi utilizado para maior parte dos testes excepto para FTP, em que devido ás suas caracteristicas especificas, utilizamos os serviços para ter a certeza que funcionava com a nossa configuração. Utilizamos estes comandos curl para testar se eram bloqueados: Netcat foi utilizado para maior parte dos testes excepto para FTP, em que devido ás suas caracteristicas especificas, utilizamos os serviços para ter a certeza que funcionava com a nossa configuração. Utilizamos estes comandos curl para testar se eram bloqueados:
\begin{verbatim} \begin{lstlisting}[language=bash]
curl -i "http://23.214.219.132/index.php?id=1%20union%20select%201,2,3" curl -i "http://23.214.219.132/index.php?id=1%20union%20select%201,2,3"
curl -i "http://23.214.219.132/login.php?user='or%201=1" curl -i "http://23.214.219.132/login.php?user='or%201=1"
curl -i "http://23.214.219.132/search.php?q=<script>alert('XSS')</script>" curl -i "http://23.214.219.132/search.php?q=<script>alert('XSS')</script>"
\end{verbatim} \end{lstlisting}
\section{Conclusion} \section{Conclusion}
Ao realizar-mos este projeto aprendemos sobre a criação de scenarios em VMs, a configuração de uma firewall utilizando IPTables e a configuração de um IDS/IPS system utilizando Suricata Ao realizar-mos este projeto aprendemos sobre a criação de scenarios em VMs, a configuração de uma firewall utilizando IPTables e a configuração de um IDS/IPS system utilizando Suricata

11
relatorio.toc
View File

@@ -1,9 +1,8 @@
\babel@toc {portuguese}{}\relax \babel@toc {portuguese}{}\relax
\contentsline {section}{\numberline {1}Introduction}{2}{}% \contentsline {section}{\numberline {1}Introduction}{2}{}%
\contentsline {section}{\numberline {2}Firewall}{2}{}% \contentsline {section}{\numberline {2}Firewall}{2}{}%
\contentsline {subsection}{\numberline {2.1}Packet fileter with NAT}{2}{}% \contentsline {subsection}{\numberline {2.1}Packet fileter without NAT}{2}{}%
\contentsline {subsection}{\numberline {2.2}Packet filtering without NAT}{2}{}% \contentsline {subsection}{\numberline {2.2}Packet filtering with NAT}{3}{}%
\contentsline {subsection}{\numberline {2.3}External Network}{2}{}% \contentsline {section}{\numberline {3}Intrusion Detection}{4}{}%
\contentsline {subsection}{\numberline {2.4}Internal Network}{2}{}% \contentsline {section}{\numberline {4}Tests utilizados}{5}{}%
\contentsline {section}{\numberline {3}Intrusion Detection}{2}{}% \contentsline {section}{\numberline {5}Conclusion}{5}{}%
\contentsline {section}{\numberline {4}Conclusion}{2}{}%