Erinevus lehekülje "Itx8071-task2" redaktsioonide vahel

Allikas: Kursused
Mine navigeerimisribale Mine otsikasti
(Lehekülg asendatud tekstiga 'To be announced.')
Märgis: Asendamine
 
(ei näidata sama kasutaja 181 vahepealset redaktsiooni)
1. rida: 1. rida:
−
 
+
To be announced.
−
This homework assignment requires the knowledge from Modules 6 and 7.
 
−
 
 
−
=== Create SEC rules that accomplish the following event correlation task: ===
 
−
 
 
−
1) the rules must process netfilter firewall syslog events about blocked
 
−
packets sent to local TCP and UDP ports. For example, the following two
 
−
events represent accesses to local ports 23/tcp and 25/tcp which were blocked
 
−
by the local firewall:
 
−
 
 
−
Nov  6 01:13:02 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=192.168.1.67 DST=192.168.1.107 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=20049 DF PROTO=TCP SPT=44963 DPT=23 WINDOW=49640 RES=0x00 SYN URGP=0
 
−
Nov  6 01:13:08 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=192.168.1.104 DST=192.168.1.107 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=36362 DF PROTO=TCP SPT=56918 DPT=25 WINDOW=29200 RES=0x00 SYN URGP=0
 
−
 
 
−
The rules must also process Apache web server syslog events with status codes
 
−
403 (Forbidden) and 404 (Not Found). For example, the following event
 
−
represents GET request from client 192.168.1.101 to URL /banner.png that was
 
−
not found (status code is 404):
 
−
 
 
−
Nov  6 19:05:37 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:05:37 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
 
 
−
2) if some URL is requested from 5 different clients within 5 minutes with
 
−
status code 403 or 404, this URL must be memorized as false positive for
 
−
the following 15 minutes. For example, if the following events appear in
 
−
the log, the URL /offers/sales-offer.html must be memorized as false positive
 
−
at Nov 6 19:06:17 for 15 minutes, since it has been accessed by 5 different
 
−
clients 192.168.1.101, 192.168.1.103, 192.168.1.104, 192.168.2.16, and
 
−
192.168.7.33 within 5 minutes (between Nov 6 19:03:49 and Nov 6 19:06:17):
 
−
 
 
−
Nov  6 19:03:48 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:03:48 +0200] "GET /images/poweredby.png HTTP/1.1" 200 3956 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:03:49 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:03:49 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:03:59 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:03:59 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:04:07 localhost apache: 192.168.1.102 - - [06/Nov/2016:19:04:07 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:04:22 localhost apache: 192.168.1.103 - - [06/Nov/2016:19:04:22 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:04:29 localhost apache: 192.168.1.103 - - [06/Nov/2016:19:04:29 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:04:40 localhost apache: 192.168.1.104 - - [06/Nov/2016:19:04:40 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:05:01 localhost apache: 192.168.2.16 - - [06/Nov/2016:19:05:01 +0200] "GET /offers/sales-offer.html HTTP/1.1" 403 225 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:06:17 localhost apache: 192.168.7.33 - - [06/Nov/2016:19:06:17 +0200] "GET /offers/sales-offer.html HTTP/1.1" 403 225 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 19:26:16 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:26:16 +0200] "GET /images/apache_pb.gif HTTP/1.1" 200 2326 "http://192.168.1.206/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
 
 
−
 
 
−
3) if some host probes 3 different ports and accesses 3 different URLs within
 
−
60 seconds, so that status codes for URL accesses are 403 and/or 404 and none
 
−
of the URLs has been previously memorized as false positive, send an e-mail
 
−
to root@localhost about offending activities from this host.
 
−
 
 
−
Note that ports in netfilter firewall messages must be distinguished not 
 
−
only by port number but also by transport protocol (in other words, ports
 
−
53/tcp and 53/udp must be considered different ports).
 
−
 
 
−
Also note that the detection should be done with a sliding window approach --
 
−
if the counting operation for some host has not seen enough events
 
−
during 60 seconds, the 60 second detection window should be moved forward.
 
−
 
 
−
After an e-mail alert has been issued about the host, disable further alerts
 
−
for this host for 2 hours.
 
−
 
 
−
For example, suppose the following events are observed and the URL
 
−
/offers/sales-offer.html has been previously memorized as false positive:
 
−
Nov  6 18:51:01 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=1881 DF PROTO=TCP SPT=16333 DPT=25 WINDOW=5840 RES=0x00 SYN URGP=0
 
−
Nov  6 18:51:07 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=23421 DF PROTO=TCP SPT=34342 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0
 
−
Nov  6 18:51:08 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:08 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 18:51:08 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:08 +0200] "GET /banner2.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 18:51:08 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=23421 DF PROTO=TCP SPT=34342 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0
 
−
Nov  6 18:51:09 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:09 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 18:51:12 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=31442 DF PROTO=TCP SPT=47846 DPT=21 WINDOW=49640 RES=0x00 SYN URGP=0
 
−
Nov  6 18:51:13 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:13 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 18:51:14 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.93 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=17209 DF PROTO=TCP SPT=11652 DPT=23 WINDOW=7290 RES=0x00 SYN URGP=0
 
−
Nov  6 18:51:52 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=31442 DF PROTO=TCP SPT=47846 DPT=445 WINDOW=49640 RES=0x00 SYN URGP=0
 
−
Nov  6 18:52:05 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:52:05 +0200] "GET /docs/report.doc HTTP/1.1" 403 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
 
−
Nov  6 18:52:14 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.93 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=17209 DF PROTO=TCP SPT=11652 DPT=23 WINDOW=7290 RES=0x00 SYN URGP=0
 
−
 
 
−
The event correlation rules must produce an alarm at Nov  6 18:52:05 about
 
−
offending host 10.1.1.7, since between Nov 6 18:51:07 and Nov 6 18:52:05
 
−
this host has:
 
−
1) probed 4 distinct ports 80/tcp, 21/tcp, 23/tcp, and 445/tcp,
 
−
2) accessed 3 distinct URLs /banner.png, /banner2.png, and /docs/report.doc
 
−
  with status codes 404 and 403.
 
−
 
 
−
Note that probe against port 25/tcp at Nov 6 18:51:01 does not fit into the
 
−
60 second window. Also, note that when the third distinct port 23/tcp is
 
−
probed at Nov 6 18:51:14, an alarm can not be produced, since at that moment
 
−
only two distinct URLs /banner.png and /banner2.png have been accessed
 
−
(access to /offers/sales-offer.html must be ignored, since it has been
 
−
previosly detected as false positive).
 
−
 
 
−
Some hints for accomplishing this assignment:
 
−
- don't try to solve the whole assignment with just one rule, but rather write
 
−
  several rules which interact,
 
−
- in order to accomplish subtask 2 (detection of port probes and URL accesses
 
−
  from the same host within 60 second window), use EventGroup2 rule.
 
−
 
 
−
Apart from studying the examples from the course slides, have a look at the SEC
 
−
man page (installed at the virtual machines or found at
 
−
http://simple-evcorr.github.io/man.html).
 

Viimane redaktsioon: 22. august 2026, kell 16:12

To be announced.

Pärit leheküljelt "http://courses.cs.taltech.ee/w/index.php?title=Itx8071-task2&oldid=12204"