relatorio

This commit is contained in:
vascoalvesxyz
2026-03-22 22:25:47 +00:00
parent 1db4072c19
commit 51c5d2acc1
6 changed files with 154 additions and 86 deletions

View File

@@ -5,10 +5,9 @@
\babel@aux{portuguese}{}
\@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {2}Firewall}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Packet fileter with NAT}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Packet filtering without NAT}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}External Network}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.4}Internal Network}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}Intrusion Detection}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Conclusion}{2}{}\protected@file@percent }
\gdef \@abspage@last{2}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Packet fileter without NAT}{2}{}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Packet filtering with NAT}{3}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}Intrusion Detection}{4}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Tests utilizados}{5}{}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {5}Conclusion}{5}{}\protected@file@percent }
\gdef \@abspage@last{5}

View File

@@ -1,4 +1,4 @@
This is pdfTeX, Version 3.141592653-2.6-1.40.27 (TeX Live 2026/dev/Arch Linux) (preloaded format=pdflatex 2026.1.17) 16 MAR 2026 16:24
This is pdfTeX, Version 3.141592653-2.6-1.40.27 (TeX Live 2026/dev/Arch Linux) (preloaded format=pdflatex 2026.1.17) 22 MAR 2026 22:25
entering extended mode
\write18 enabled.
%&-line parsing enabled.
@@ -89,52 +89,80 @@ LaTeX Info: Redefining \textulc on input line 49.
LaTeX Info: Redefining \oldstylenums on input line 163.
LaTeX Info: Redefining \textsw on input line 173.
)
(/usr/share/texmf-dist/tex/latex/listings/listings.sty
\lst@mode=\count273
\lst@gtempboxa=\box52
\lst@token=\toks19
\lst@length=\count274
\lst@currlwidth=\dimen143
\lst@column=\count275
\lst@pos=\count276
\lst@lostspace=\dimen144
\lst@width=\dimen145
\lst@newlines=\count277
\lst@lineno=\count278
\lst@maxwidth=\dimen146
(/usr/share/texmf-dist/tex/latex/listings/lstpatch.sty
File: lstpatch.sty 2024/09/23 1.10c (Carsten Heinz)
)
(/usr/share/texmf-dist/tex/latex/listings/lstmisc.sty
File: lstmisc.sty 2024/09/23 1.10c (Carsten Heinz)
\c@lstnumber=\count279
\lst@skipnumbers=\count280
\lst@framebox=\box53
)
(/usr/share/texmf-dist/tex/latex/listings/listings.cfg
File: listings.cfg 2024/09/23 1.10c listings configuration
))
Package: listings 2024/09/23 1.10c (Carsten Heinz)
LaTeX Font Info: Trying to load font information for OT1+EBGaramond-LF on in
put line 11.
put line 28.
(/usr/share/texmf-dist/tex/latex/ebgaramond/OT1EBGaramond-LF.fd
File: OT1EBGaramond-LF.fd 2023/03/19 (autoinst) Font definitions for OT1/EBGara
mond-LF.
)
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 12.0pt on input line 11.
(Font) scaled to size 12.0pt on input line 28.
(/usr/share/texmf-dist/tex/latex/l3backend/l3backend-pdftex.def
File: l3backend-pdftex.def 2024-05-08 L3 backend support: PDF output (pdfTeX)
\l__color_backend_stack_int=\count273
\l__pdf_internal_box=\box52
\l__color_backend_stack_int=\count281
\l__pdf_internal_box=\box54
)
(/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux)
\openout1 = `relatorio.aux'.
LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 11.
LaTeX Font Info: ... okay on input line 11.
LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 11.
LaTeX Font Info: ... okay on input line 11.
LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 11.
LaTeX Font Info: ... okay on input line 11.
LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 11.
LaTeX Font Info: ... okay on input line 11.
LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 11.
LaTeX Font Info: ... okay on input line 11.
LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 11.
LaTeX Font Info: ... okay on input line 11.
LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 11.
LaTeX Font Info: ... okay on input line 11.
\c@mv@tabular=\count274
\c@mv@boldtabular=\count275
LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 28.
LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 28.
LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 28.
LaTeX Font Info: ... okay on input line 28.
LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 28.
LaTeX Font Info: ... okay on input line 28.
\c@mv@tabular=\count282
\c@mv@boldtabular=\count283
\c@lstlisting=\count284
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 20.74pt on input line 12.
(Font) scaled to size 20.74pt on input line 29.
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 14.4pt on input line 12.
(Font) scaled to size 14.4pt on input line 29.
LaTeX Font Info: External font `cmex10' loaded for size
(Font) <14.4> on input line 12.
(Font) <14.4> on input line 29.
LaTeX Font Info: External font `cmex10' loaded for size
(Font) <7> on input line 12.
(Font) <7> on input line 29.
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 17.28pt on input line 13.
(Font) scaled to size 17.28pt on input line 30.
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be
(Font) scaled to size 17.28pt on input line 13.
(Font) scaled to size 17.28pt on input line 30.
(/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.toc
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be
@@ -155,31 +183,62 @@ LaTeX Font Info: External font `cmex10' loaded for size
{/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}{/usr/share/texmf-dist/fonts
/enc/dvips/ebgaramond/ebg_dacnth.enc}]
(/usr/share/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2024/09/23 1.10c listings language file
)
(/usr/share/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2024/09/23 1.10c listings language file
)
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/m/n' will be
(Font) scaled to size 10.0pt on input line 37.
Overfull \hbox (7.49481pt too wide) in paragraph at lines 42--44
\OT1/EBGaramond-LF/m/n/12 As tr[]es re-des tem va-rios servi[]os, o DMZ tem dns
(23.214.219.130), mail(23.214.219.134),
[]
LaTeX Font Info: Font shape `OT1/EBGaramond-LF/b/n' will be
(Font) scaled to size 14.4pt on input line 19.
(Font) scaled to size 14.4pt on input line 45.
[2] (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux)
[2]
[3]
LaTeX Font Info: Font shape `OT1/cmtt/bx/n' in size <10> not available
(Font) Font shape `OT1/cmtt/m/n' tried instead on input line 93.
[4{/usr/share/texmf-dist/fonts/enc/dvips/cm-super/cm-super-ts1.enc}]
Overfull \hbox (23.24622pt too wide) in paragraph at lines 125--126
\OT1/EBGaramond-LF/m/n/12 Ao realizar-mos este pro-jeto apren-de-mos so-bre a c
ria[][]ao de sce-na-rios em VMs, a configura[][]ao
[]
[5] (/home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/relatorio.aux)
***********
LaTeX2e <2024-11-01> patch level 2
L3 programming layer <2025-01-18>
***********
)
Here is how much of TeX's memory you used:
2577 strings out of 474546
48289 string characters out of 5749982
436453 words of memory out of 5000000
25628 multiletter control sequences out of 15000+600000
572213 words of font info for 55 fonts, out of 8000000 for 9000
4441 strings out of 474546
72785 string characters out of 5749982
967296 words of memory out of 5000000
27471 multiletter control sequences out of 15000+600000
573916 words of font info for 59 fonts, out of 8000000 for 9000
352 hyphenation exceptions out of 8191
57i,7n,65p,220b,231s stack positions out of 10000i,1000n,20000p,200000b,200000s
57i,7n,99p,546b,1693s stack positions out of 10000i,1000n,20000p,200000b,200000s
</usr/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Bold.pfb></us
r/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Regular.pfb>
r/share/texmf-dist/fonts/type1/public/ebgaramond/EBGaramond-Regular.pfb></usr/s
hare/texmf-dist/fonts/type1/public/amsfonts/cm/cmtt10.pfb></usr/share/texmf-dis
t/fonts/type1/public/cm-super/sftt1000.pfb>
Output written on /home/vasco/EngenhariaInformatica/3ano/sem2/fsi/trabalho/rela
torio.pdf (2 pages, 42851 bytes).
torio.pdf (5 pages, 78665 bytes).
PDF statistics:
22 PDF objects out of 1000 (max. 8388607)
13 compressed objects within 1 object stream
42 PDF objects out of 1000 (max. 8388607)
26 compressed objects within 1 object stream
0 named destinations out of 1000 (max. 500000)
1 words of extra memory for PDF output out of 10000 (max. 10000000)

Binary file not shown.

Binary file not shown.

View File

@@ -1,6 +1,23 @@
\documentclass[12pt,a4paper]{article}
\usepackage[portuguese]{babel}
\usepackage[lining]{ebgaramond}
\usepackage{listings}
\lstdefinestyle{mystyle}{
basicstyle=\ttfamily\footnotesize,
breakatwhitespace=false,
breaklines=true,
captionpos=b,
keepspaces=true,
numbers=left,
numbersep=5pt,
showspaces=false,
showstringspaces=false,
showtabs=false,
tabsize=2
}
\lstset{style=mystyle}
\title{Practical Assignment \#1}
\author{
@@ -15,31 +32,32 @@
\section{Introduction}
O objetivo principal deste trabalho era aprender IPTables e como configurar um com o Suricata um sistema de filtração e deteção de ataques. Para esse fim, foi simulado um sistema dividido em três redes e um router para conectar-las. As três redes são a DMZ (23.214.219.128/25, enp0s8), Internal network (192.168.10.0/24, enp0s9) e Internet (87.248.214.0/24, enp0s10).
\begin{verbatim}
\begin{lstlisting}[language=bash]
Rede,Interface,Gama IP
DMZ,enp0s8,23.214.219.128/25
Internal,enp0s9,192.168.10.0/24
Internet,enp0s10,87.248.214.0/24
\end{verbatim}
\end{lstlisting}
As três redes tem varios serviços, o DMZ tem dns(23.214.219.130), mail(23.214.219.134), vpn-gw(23.214.219.133), www(23.214.219.132) e smpt(23.214.219.131). A Internal network tem ftp(192.168.10.2), datastore(192.168.10.3) e clientes (nos testes os clientes tem ip 192.168.10.4, mas está configurado para dar para qualquer edereço). Por fim a rede Internet tem dns2 (87.248.214.99) e eden (87.248.214.100), existe também outros serviços (87.248.214.98).
Para facilitar a recriação deste sistema foi criado 4 ficheiros .sh (um para cada rede e o router), e disponibilizamos os ficheiros suricata.rules e suricata.yaml, para o suricata que estiver ligado ao Router. Os ficheiros .sh vão ter comandos para configurar o sistema para este exercicio.
\section{Firewall}
\subsection{Packet fileter without NAT}
O policy que foi escolhido foi:
\begin{verbatim}
\begin{lstlisting}[language=bash]
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
\end{verbatim}
\end{lstlisting}
Foi escolhido porque é mais facil dar DROP a todos os pacotes que não foi criado regras do que criar uma regra de DROP para todos os protocolos e possibilidades, o OUTPUT ficou para ACCEPT porque não existe razão para dar DROP dos pacotes que estamos a enviar neste trabalho.
Para o router conseguir resolver DNS requests e para aceitar coneções SSH da rede interna ou da VPN gateway foi utilizado estes comandos:
\begin{verbatim}
\begin{lstlisting}[language=bash]
sudo iptables -A INPUT -i enp0s10 -p udp --dport 53 -j ACCEPT
sudo iptables -A INPUT -i enp0s9 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -i enp0s8 -s 23.214.219.133 -p tcp --dport 22 -j ACCEPT
\end{verbatim}
\end{lstlisting}
Para conseguirmos a confirguração pedida entre redes foi utilizado estes commandos:
\begin{verbatim}
\begin{lstlisting}[language=bash]
sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.130 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --dport 53 -j ACCEPT
@@ -51,64 +69,57 @@ sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --dport 44
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --dport 1194 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.2 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.3 -j ACCEPT
\end{verbatim}
\end{lstlisting}
Inicialmente as implementações de respostas a forward eram especificas para cada regra isto é por exemplo:
\begin{verbatim}
\begin{lstlisting}[language=bash]
sudo iptables -A FORWARD -o enp0s8 -i enp0s10 -p udp --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
\end{verbatim}
\end{lstlisting}
No entanto isso facilmente originava confusão entre nós, então decimos utilizar estas duas regras:
\begin{verbatim}
\begin{lstlisting}[language=bash]
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
\end{verbatim}
\end{lstlisting}
Neste cenario o uso destas regras faz sentido, mas pode existir outros cenarios no futuro que não queremos uma resposta, e nesse caso temos de criar as regras necessarias.
\subsection{Packet filtering with NAT}
Para conecções com origem/destino na internet foi utilizado DNAT/SNAT e iptables para "esconder" o ip para a internet que querer aceder a rede interna para não terem acesso ao edereço ip e iproutes para bloquear certos pacotes de entrar, para conseguir a configuração utilizamos estes comandos:
\begin{verbatim}
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2
-p tcp --dport 21 -j ACCEPT
\begin{lstlisting}[language=bash]
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2 -p tcp --dport 21 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 20 -j ACCEPT
sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22
-j DNAT --to-destination 192.168.10.3
sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22
-j DNAT --to-destination 192.168.10.3
sudo iptables -t nat -A PREROUTING -i enp0s10 -p tcp --dport 21
-j DNAT --to-destination 192.168.10.2
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2
-p tcp --dport 22 -j ACCEPT
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden
-p tcp --dport 22 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s10 -j SNAT
--to-source 87.248.214.97
sudo iptables -t nat -A PREROUTING -s $dns2 -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3
sudo iptables -t nat -A PREROUTING -s $eden -p tcp --dport 22 -j DNAT --to-destination 192.168.10.3
sudo iptables -t nat -A PREROUTING -i enp0s10 -p tcp --dport 21 -j DNAT --to-destination 192.168.10.2
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2 -p tcp --dport 22 -j ACCEPT
sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden -p tcp --dport 22 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s10 -j SNAT --to-source 87.248.214.97
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 443 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 21 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --dport 21 -j ACCEPT
\end{verbatim}
\end{lstlisting}
\section{Intrusion Detection}
As regras que utilizamos para o suricata foram estas:
\begin{verbatim}
\begin{lstlisting}[language=bash]
drop tcp \$EXTERNAL\_NET any -> \$HOME\_NET any (msg:"ET"; flags:S; threshold:type both, track by\_src, count 5, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;)
drop tcp any any -> any 80 (msg:"SQL injection"; content:"union"; nocase; content:"select"; nocase; classtype:web-application-attack; sid:1000002; rev:1;)
drop tcp any any -> any 80 (msg:"SQl injection"; content:"'or 1=1"; nocase; classtype:web-application-attack; sid:1000003; rev:1;)
drop tcp any any -> any 80 (msg:"XSS"; content:"<script"; nocase; classtype:web-application-attack; sid:1000004; rev:1;)
\end{verbatim}
\end{lstlisting}
A primeira é para port scaning, a segunda e a terceira é para o caso de SQL injection, e a ultima é para XSS atacks.
Também atualizamos o iptables para passar para o suricata os pacotes para analizar e bloquear com:
\begin{verbatim}
\begin{lstlisting}[language=bash]
sudo iptables -I FORWARD -j NFQUEUE --queue-bypass
sudo iptables -I INPUT -j NFQUEUE --queue-bypass
\end{verbatim}
\end{lstlisting}
\section{Tests utilizados}
Netcat foi utilizado para maior parte dos testes excepto para FTP, em que devido ás suas caracteristicas especificas, utilizamos os serviços para ter a certeza que funcionava com a nossa configuração. Utilizamos estes comandos curl para testar se eram bloqueados:
\begin{verbatim}
\begin{lstlisting}[language=bash]
curl -i "http://23.214.219.132/index.php?id=1%20union%20select%201,2,3"
curl -i "http://23.214.219.132/login.php?user='or%201=1"
curl -i "http://23.214.219.132/search.php?q=<script>alert('XSS')</script>"
\end{verbatim}
\end{lstlisting}
\section{Conclusion}
Ao realizar-mos este projeto aprendemos sobre a criação de scenarios em VMs, a configuração de uma firewall utilizando IPTables e a configuração de um IDS/IPS system utilizando Suricata

View File

@@ -1,9 +1,8 @@
\babel@toc {portuguese}{}\relax
\contentsline {section}{\numberline {1}Introduction}{2}{}%
\contentsline {section}{\numberline {2}Firewall}{2}{}%
\contentsline {subsection}{\numberline {2.1}Packet fileter with NAT}{2}{}%
\contentsline {subsection}{\numberline {2.2}Packet filtering without NAT}{2}{}%
\contentsline {subsection}{\numberline {2.3}External Network}{2}{}%
\contentsline {subsection}{\numberline {2.4}Internal Network}{2}{}%
\contentsline {section}{\numberline {3}Intrusion Detection}{2}{}%
\contentsline {section}{\numberline {4}Conclusion}{2}{}%
\contentsline {subsection}{\numberline {2.1}Packet fileter without NAT}{2}{}%
\contentsline {subsection}{\numberline {2.2}Packet filtering with NAT}{3}{}%
\contentsline {section}{\numberline {3}Intrusion Detection}{4}{}%
\contentsline {section}{\numberline {4}Tests utilizados}{5}{}%
\contentsline {section}{\numberline {5}Conclusion}{5}{}%