Erinevus lehekülje "Itx8071-task2" redaktsioonide vahel

Viimane redaktsioon: 22. august 2026, kell 16:12

To be announced.

@@ 1. rida: / 1. rida: @@
-This homework assignment requires the knowledge from Modules 6 and 7.
+To be announced.
-==== Create SEC rules that accomplish the following event correlation task: ====
-) The rules must process netfilter firewall syslog events about blocked packets.
-For example, the following two events represent two packets from host 192.168.1.67
-which were blocked by the local firewall:
- Oct 25 01:13:02 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC='''192.168.1.67''' DST=192.168.1.107
-   LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=20049 DF PROTO=TCP SPT=44963 DPT=23 WINDOW=49640 RES=0x00 SYN URGP=0
- Oct 25 01:13:08 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC='''192.168.1.67''' DST=192.168.1.107
-   LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=36362 DF PROTO=TCP SPT=56918 DPT=25 WINDOW=29200 RES=0x00 SYN URGP=0
-The rules must also process Apache web server syslog events with status codes
-(Unauthorized), 403 (Forbidden), 404 (Not Found), and 405 (Method Not Allowed).
-For example, the following event represents GET request from client 192.168.1.101 to
-URL /banner.png that was not found (status code is 404):
- Nov  6 19:05:37 localhost apache: '''192.168.1.101''' - - [06/Nov/2016:19:05:37 +0200] "'''GET''' /banner.png HTTP/1.1" '''404''' 208 "-"
-   "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"
-) if netfilter firewall blocked packet events and/or Apache events with 401 status codes
-have been seen from the same host repeatedly during 5 minutes, so that time between two
-successive events does not exceed 60 seconds, memorize that host for the following 1 hour
-as suspicious host (the time between the last event and the end of the 5-minute window
-must also not exceed 60 seconds).
-For example, if the following events appear for host 10.1.1.7, this host should be
-memorized as suspicious, since in 5-minute window from 12:30:06 to 12:35:06 six events
-have been seen which are separated from each other by no more than 60 seconds
-(time gaps between events are 59, 55, 52, 58, and 51 seconds, while the gap between
-the last event and the end of the 5-minute window is 25 seconds).
- Nov 15 12:30:06 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC='''10.1.1.7''' DST=10.13.25.59
-   LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=1881 DF PROTO=TCP SPT=16333 DPT=21 WINDOW=5840 RES=0x00 SYN URGP=0
- Nov 15 12:31:05 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC='''10.1.1.7''' DST=10.13.25.59
-   LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=23421 DF PROTO=TCP SPT=34342 DPT=23 WINDOW=29200 RES=0x00 SYN URGP=0
- Nov 15 12:32:00 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC='''10.1.1.7''' DST=10.13.25.59
-   LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=31442 DF PROTO=TCP SPT=47846 DPT=25 WINDOW=49640 RES=0x00 SYN URGP=0
- Nov 15 12:32:52 localhost apache: '''10.1.1.7''' - - [15/Nov/2017:12:32:52 +0200] "GET / HTTP/1.1" '''401''' 489
- Nov 15 12:33:50 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC='''10.1.1.7''' DST=10.13.25.59
-   LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=17209 DF PROTO=TCP SPT=11652 DPT=143 WINDOW=7290 RES=0x00 SYN URGP=0
- Nov 15 12:34:41 localhost apache: '''10.1.1.7''' - - [15/Nov/2017:12:34:41 +0200] "GET / HTTP/1.1" '''401''' 489
-) if some host has been memorized as suspicious during the last 1 hour, and three Apache events with
-status codes 403, 404 and/or 405 are observed from this host within 60 seconds, so that HTTP method is
-different for all events, send an e-mail about the offending host to root@localhost.
-Note that the detection should be done with a sliding window approach --
-if the counting operation for some host has not seen enough events
-during 60 seconds, the 60 second detection window should be moved forward.
-After an e-mail alert has been issued about the host, disable further alerts
-for this host for 3 hours.
-For example, suppose the following events are observed and the host 192.168.56.1
-has been previously memorized as suspicious:
- Nov 15 13:46:12 localhost apache: 192.168.56.1 - - [15/Nov/2017:13:46:12 +0200] "GET / HTTP/1.1" 200 4897 "-"
-   "curl/7.29.0"
- Nov 15 13:46:31 localhost apache: '''192.168.56.1''' - - [15/Nov/2017:13:46:31 +0200] "'''GET''' /test.html HTTP/1.1" '''404''' 207 "-"
-   "curl/7.29.0"
- Nov 15 13:46:33 localhost apache: '''192.168.56.1''' - - [15/Nov/2017:13:46:33 +0200] "'''GET''' /test.html HTTP/1.1" '''404''' 207 "-"
-   "curl/7.29.0"
- Nov 15 13:46:41 localhost apache: '''192.168.56.1''' - - [15/Nov/2017:13:46:41 +0200] "'''PUT''' /test.html HTTP/1.1" '''405''' 230 "-"
-   "curl/7.29.0"
- Nov 15 13:46:42 localhost apache: 10.1.17.3 - - [15/Nov/2017:13:46:42 +0200] "GET / HTTP/1.1" 200 4897 "-"
-   "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
- Nov 15 13:46:47 localhost apache: '''192.168.56.1''' - - [15/Nov/2017:13:46:47 +0200] "'''DELETE''' /index.html HTTP/1.1" '''405''' 234 "-"
-   "curl/7.29.0"
-The event correlation rules must produce an alarm at Nov 15 13:46:47 about offending
-host 192.168.56.1, since this host has used three different HTTP methods (GET, PUT,
-and DELETE) within 60 seconds, so that HTTP status codes are either 403, 404, or 405.
-Note that the event at Nov 15 13:46:12 should be ignored, since its status code is 200.
-Some hints for accomplishing this assignment:
-* don't try to solve the whole assignment with just one rule, but rather write several rules which interact,
-* in order to accomplish subtask 2 (detection of 5 minute event sequence with max 60 second intervals), use Single rules that set up contexts with specific actions-on-expire.
-Apart from studying the examples from the course slides, have a look at the SEC
-man page (installed at the virtual machines or found at
-http://simple-evcorr.github.io/man.html).

Erinevus lehekülje "Itx8071-task2" redaktsioonide vahel

Viimane redaktsioon: 22. august 2026, kell 16:12

Navigeerimismenüü

Otsing