% !TeX spellcheck = en_US

\documentclass{../UTNetLab}

\title{Network Management and Security}
\labnumber{9}
\newcommand\reference{
   S. Panwar, S. Mao, J.-dong Ryoo, and Y. Li, “Network management and security,” in TCP/IP Essentials: A Lab-Based Approach, Cambridge: Cambridge University Press, 2004, pp. 187–213.
}

\begin{document}
\section*{Objectives}
\begin{itemize}
    \item SNMP and MIBs, using NET-SNMP as an example, and using NETSNMP utilities to query MIB objects.
    \item Encryption, confidentiality, and authentication, including DES, AES, RSA, MD5 and DSS.
    \item Application layer security, using SSH and Kerberos as examples.
    \item Transport layer security, including SSL and the secure Apache server.
    \item Network layer security, IPsec and Virtual Private Networks.
    \item Firewalls and IPTABLES.
    \item Accounting, auditing, and intrusion detection.
\end{itemize}

\part{SNMP Exercises}
For the exercises in this section, the network topology is given in \hyperref[fig:1.3]{Figure~1.3}, where all the hosts are connected in a single network segment using their IP addresses, i.e.\  from 128.238.66.100 to 128.238.66.102.

\begin{center}
    \begin{minipage}{0.48\textwidth}
        \begin{flushleft}
            \begin{table}[H]
                \caption{The IP addresses of the hosts (Table~1.2)}
                \centering
                \begin{tabular}{ c c c }
                    \hline \hline
                    Host & IP Address     & Subnet Mask   \\
                    \hline
                    h0   & 128.238.66.100 & 255.255.255.0 \\
                    h1   & 128.238.66.101 & 255.255.255.0 \\
                    h2   & 128.238.66.102 & 255.255.255.0 \\
                    h3   & 128.238.66.103 & 255.255.255.0 \\
                    h4   & 128.238.66.104 & 255.255.255.0 \\
                    h5   & 128.238.66.105 & 255.255.255.0 \\
                    h6   & 128.238.66.106 & 255.255.255.0 \\
                    h7   & 128.238.66.107 & 255.255.255.0 \\
                    \hline \hline
                \end{tabular}
            \end{table}
        \end{flushleft}
    \end{minipage}
    \begin{minipage}{0.48\textwidth}
        \begin{flushright}
            \begin{figure}[H]
                \centering
                \begin{tikzpicture}
                    \node[draw,align=center,rounded corners] (s) at (0,0){Core\\Switch};
                    \node[draw] (h0) at (0,2){h0};
                    \node[draw] (h1) at ({sqrt(2)},{sqrt(2)}){h1};
                    \node[draw] (h2) at (2,0){h2};
                    \node[draw] (h3) at (-{sqrt(2)},{sqrt(2)}){h3};
                    \node[draw] (h4) at (-2,0){h4};
                    \node[draw] (h5) at (-{sqrt(2)},-{sqrt(2)}){h5};
                    \node[draw] (h6) at (0,-2){h6};
                    \node[draw] (h7) at ({sqrt(2)},-{sqrt(2)}){h7};

                    \draw (h0) -- (s);
                    \draw (h1) -- (s);
                    \draw (h2) -- (s);
                    \draw (h3) -- (s);
                    \draw (h4) -- (s);
                    \draw (h5) -- (s);
                    \draw (h6) -- (s);
                    \draw (h7) -- (s);
                \end{tikzpicture}
                \caption{A single segment network (Figure~1.3)}\label{fig:1.3}
            \end{figure}
        \end{flushright}
    \end{minipage}
\end{center}

Before the lab, you should do this instructions on the \textit{h0}:
\begin{enumerate}
    \item Backup the original \lstbash{snmpd} configuration file:
          \lstbash{mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.save}\footnote{Shortest way: \lstbash{mv /etc/snmp/snmpd.conf\{,.save\}}}.
    \item Create a simple configuration file\footnote{Can use \lstbash{echo "some text" > otuput.file}} \path{/etc/snmp/snmpd.conf} with a single line defining a read-only community \textbf{guest}:
          \begin{lstlisting}[language={conf}, emph={guest},morekeywords={[3]rocommunity}]
rocommunity guest
        \end{lstlisting}
\end{enumerate}

\section{SNMP Service and MIB Struct}
Use \lstbash{pgrep snmpd} to check if \lstbash{snmpd} is started.
Try to stop and then start the SNMP agent daemon using \lstbash{service snmpd start|stop}.

Study the \lstbash{snmpd} configuration file \path{/etc/snmp/snmpd.conf}.
Also study the default configuration file \path{/etc/snmp/snmpd.conf.save}.
This file is well commented.
Read the comments and study the configuration options.

Study the MIB files in the \path{/usr/share/snmp/mibs} directory.
Examine the Interface MIB \path{IF-MIB.txt} and the TCP MIB \path{TCP-MIB.txt} to see the MIB objects and data types.
Save these two files for the lab report.

\begin{report}
    \item What is the community name used in this lab? What is the use of the
    community name?

    \item What is the data type for the MIB object \texttt{ifMtu.\textit{x}} ($x=1$ for \textit{loopback} and $x \in \{2,3,4,\cdots\}$ for other interfaces)? What is the definition of the MIB object \texttt{ifPhysAddress} and \texttt{ifInOctets}?

    \item What is the data type and definition of \texttt{tcpRtoAlgorithm}? What values are allowed for \texttt{tcpRtoAlgorithm}? What is the definition of \texttt{tcpMaxConn}?
\end{report}

\section{SNMP List Objects}
on the \textit{h0},
Use \lstbash[emph={guest}]{snmpwalk -v 2c -c guest localhost interface} to display the Interface MIB.

Use \lstbash[emph={guest}]{snmpwalk -v 2c -c guest localhost tcp} to display the TCP MIB.

You may run \lstbash{man snmpwalk} to find out the meanings of the options used in the commands.
Compare the outputs with the MIB files you saved in the previous exercise.
Also compare the outputs of the first command with that of \lstbash{ifconfig -a}.

Retry the \lstbash{snmpwalk} commands, but change \textbf{guest} to \textbf{public}.
Can you display the MIBs this time?

\begin{report}
    \item What is the MTU of the Ethernet interface? What is the MTU of the \textit{loopback} interface? Justify your answer with the \lstbash{snmpwalk} output and the \lstbash{ifconfig} output.

    \item Why did the \lstbash{snmpwalk} command with a community name public fail?
\end{report}

\section{SNMP Remote Access}
Execute \lstbash[morekeywords={[3]udp,port}]{tcpdump udp port 161} or \lstbash{wireshark} to capture SNMP messages.

Run from the \textit{h1} host \lstbash[emph={h0,netlab}]{telnet h0.netlab} \footnote{Use \textit{ctrl+]} to terminate \lstbash{telnet} and then \lstbash{quit}} and while telnet is running, try again to run on the \textit{h0}  \lstbash[breaklines=true,escapechar={\ }]{snmpwalk -v 2c -c guest localhost tcp}.

Try to run \lstbash[emph={h0,netlab,guest},morekeywords={[2]tcp}]{snmpwalk -v 2c -c guest h0.netlab tcp} from the \textit{h2}.

Execute \lstbash[emph={your-host, h0,netlab,guest},morekeywords={[2]IF-MIB,ifMtu}]{snmpget -v 2c -c guest h0.netlab IF-MIB::ifMtu.1} to get the MIB object \textbf{IF-MIB::ifMTU.1} from a remote machine.

You can list all interfaces for the hosts by executing \lstbash[emph={guest,h0,netlab}]{snmpwalk -v 2c -c guest h0.netlab interface} command.

Save the \lstbash{snmpget} output and terminate \lstbash{tcpdump}.

Use \lstbash{wireshark} to analyze the format of the captured SNMP Get and Response messages.
Print the messages for the lab report.

\begin{report}
    \item What is the port number used by the SNMP agent?

    \item What are the full text-based and numerical object ID’s of the MIB object \texttt{interface.ifMTU.\textit{x}} ($x \in \{2,3,4,\cdots\}$ that list in \lstbash{snmpwalk ... interface})? What was the value returned? Justify the answer using \hyperref[fig:9.3]{Figure~9.3} of reference book and the \lstbash{ifconfig} output.

    \item Draw the format of one of the SNMP messages saved, including the name and value of each field.
\end{report}

\part{Exercises on Secure Applications}

\section{Plain Transfer}
Execute \lstbash{tcpdump -enX -s 100} or \lstbash{wireshark} to capture packets between the \textit{h0} machine and the \textit{h1} machine.

Execute \lstbash[emph={h0,netlab}]{ftp h0.netlab} on the \textit{h1}.
When prompted, type \textit{1111} for the login ID, and \textit{2222} for the login password.
Then terminate \lstbash{tcpdump} and \lstbash{ftp}.

Use \lstbash{wireshark} to analyze and print the packets that carry the login ID and the password for the lab report.

Repeat the above experiment, but use \lstbash{telnet} and the \lstbash{wireshark} to analyze and print output.

\begin{report}
    \item Can you see the login ID and the password in the \lstbash{ftp} experiment? Submit the two packets you printed.

    \item Can you see the login ID and the password in the \lstbash{telnet} experiment? Submit the packets you printed.

    \item What is the difference between \lstbash{ftp} and \lstbash{telnet} in their transmission of user ID’s and passwords? Which one is more secure?
\end{report}

\section{Secure Transfer}
Start \lstbash{ssh} service on the \textit{h0} by \lstbash{service ssh start}.

Execute \lstbash{tcpdump -enX -s 100} or \lstbash{wireshark} on the \textit{h1} host or the \textit{h0} host to capture packets between two machine.

Execute \lstbash[emph={1111,h0,1111@h0,netlab},escapechar=]{sftp 1111@h0.netlab} on the \textit{h1}.
When prompted for \textit{The authenticity of host}, type \textit{yes} to continue the connection and type \textit{2222} for the login password.
Then terminate \lstbash{tcpdump}.

Use \lstbash{wireshark} to analyze and print one or two \lstbash{ssh} packets for the lab report.

Repeat the above experiment, but use \lstbash{ssh} and the \lstbash{wireshark} to analyze and print output.

\begin{report}
    \item In each experiment, can you extract the password from the \lstbash{tcpdump} output?
    Can you read the IP, TCP, SSH headers?
    Can you read the SSH data?

    \item What is the client protocol (and version) used in both cases?

    \item What is the port number used by the \lstbash{ssh} server?
    What is the port number used by the sftp server?
    Justify your answer using the \lstbash{tcpdump} output and the \path{/etc/services} file.
\end{report}

\part{Exercises on Firewalls and \texttt{iptables}}
In this exercise using two hosts.
You can use Figure~1.3.

\section{Firewall Basic}
Execute \lstbash{iptables -L -v} to list the existing rules in the filter table on the \textit{h0}.
Save the output for the lab report.

Append a rule to the end of the \texttt{INPUT} chain, by executing on the \textit{h0}
\begin{lstlisting}[morekeywords={[3]INPUT,TCP,DROP}]
iptables -A INPUT -v -p TCP --dport 23 -j DROP
    \end{lstlisting}

Run \lstbash{iptables -L -v} again on the \textit{h0} and the \textit{h1} to display the filter table.
Save the output.

on the \textit{h0} and the \textit{h1}, execute \lstbash{tcpdump}.
Then, \lstbash{telnet} to the \textit{h0} host where the rule is set, from the \textit{h1} machine.
Save the \lstbash{tcpdump} output for the lab report.

\begin{report}
    \item Can you \lstbash{telnet} to \textit{h0} from the \textit{h1} machine?

    \item From the \lstbash{tcpdump} output, how many retries did \lstbash{telnet} make?
    Explain the exponential \textbf{backoff algorithm} of TCP timeout and retransmission.
\end{report}

\section{Firewall Action}
Delete the rule created in the last exercise in the \textit{h0} machine, by:
\begin{lstlisting}[morekeywords={[3]INPUT,TCP,DROP}]
iptables -D INPUT -v -p TCP --dport 23 -j DROP
    \end{lstlisting}

Then, append a new rule to the \texttt{INPUT} chain in the \textit{h0} machine:
\begin{lstlisting}[morekeywords={[3]INPUT,TCP,REJECT,tcp-reset}]
iptables -A INPUT -v -p TCP --dport 23 -j REJECT --reject-with tcp-reset
    \end{lstlisting}

Execute \lstbash{iptables -L -v} to display the new rule.

On both machines in your topology, restart \lstbash{tcpdump}, and then \lstbash{telnet} to the \textit{h0} host where the rule is set from the \textit{h1} machine.
Save the \lstbash{tcpdump} output for the lab report.

\begin{report}
    \item Explain the difference between the \lstbash{tcpdump} outputs of this exercise and the previous exercise.
    How many attempts did {TCP} make this time?
\end{report}

\part{Exercises on Secure Apache Server}
In the exercises in this section, using two hosts from \textit{server} and \textit{gui} hosts (also you can use {Figure~3.server.gui}).
Run \lstbash{apache2} service on \textit{server}

\section{Generate Certificate}
Run \lstbash{man openssl} to study the OpenSSL command line tool.

Create a new private key on \textit{server} for the Apache server, using:
\begin{lstlisting}[emph={server,key},morekeywords={[2]genrsa}]
cd /etc/apache2/ssl
openssl genrsa 4096 > server.key
    \end{lstlisting}
To create a self-signed certificate, go to the \path{/etc/apache2/ssl/} directory, and execute:
\begin{lstlisting}[emph={server,key,crt},morekeywords={[2]req}]
openssl req -new -x509 -sha256 -days 365 -key server.key -out server.crt
    \end{lstlisting}
Then you will be asked a number of questions, regarding the location, affiliation, etc.
of the Apache server.
After you type in the answers, a self-signed certificate is created at \path{/etc/apache2/ssl/server.crt}

You can generate private key and self-signed certificate whit one command by:
\footnote{You can use simple command as \lstbash{make-ssl-cert generate-default-snakeoil --force-overwrite} without editing default apache ssl config.}
\begin{lstlisting}[emph={server,key,crt},morekeywords={[2]req},escapechar={}]
cd /etc/apache2/ssl
openssl req -new -x509 -sha256 -days 365 -newkey rsa:4096 -nodes -keyout server.key -out server.crt \
-subj "/C=IR/ST=Tehran/L=Tehran/O=Tehran University/OU=Network Laboratory/CN=netlab.ut.ac.ir/emailAddress=netlab@ut.ac.ir"
    \end{lstlisting}

Let's go over exactly what this means.

\begin{itemize}
    \item \lstbash{openssl}: This is the basic command line tool provided by OpenSSL to create and manage certificates, keys, signing requests, etc.
    \item \lstbash{req}: This specifies a sub-command for X.509 certificate signing request (CSR) management.
          X.509 is a public key infrastructure standard that SSL adheres to for its key and certificate management.
          Since we are wanting to create a new X.509 certificate, this is what we want.
    \item \lstbash{-x509}: This option specifies that we want to make a self-signed certificate file instead of generating a certificate request.
    \item \lstbash{-nodes}: This option tells OpenSSL that we do not wish to secure our key file with a passphrase.
          Having a password protected key file would get in the way of Apache starting automatically as we would have to enter the password every time the service restarts.
    \item \lstbash{-days 365}: This specifies that the certificate we are creating will be valid for one year.
    \item \lstbash{-newkey rsa:4096}: This option will create the certificate request and a new private key at the same time.
          This is necessary since we didn't create a private key in advance.
          The rsa:4096 tells OpenSSL to generate an RSA key that is 4096 bits long.
    \item \lstbash{-keyout}: This parameter names the output file for the private key file that is being created.
    \item \lstbash{-out}: This option names the output file for the certificate that we are generating.
    \item \lstbash{-subj}: Sets subject name for new request or supersedes the subject name when processing a request.
\end{itemize}

The questions portion looks something like this:
{\small
\begin{lstlisting}[language={conf},emph={IR,Tehran,University, of, ECE, Department,ece,ut,ac,ir,netlab,netlab@ut},escapechar=]
Country Name (2 letter code) [AU]:IR 
State or Province Name (full name) [Some-State]:Tehran 
Locality Name (eg, city) []:Tehran 
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Tehran University 
Organizational Unit Name (eg, section) []:Network Laboratory 
Common Name (e.g. server FQDN or YOUR name) []:netlab.ut.ac.ir
Email Address []:netlab@ut.ac.ir
    \end{lstlisting}}

Save the output for the lab report.

\section{HTTPS Handshake and Request}
Restart the Apache server to load the new key and the new certification: \lstbash{service apache2 restart} on \textit{server}.

Execute \lstbash{wireshark} to capture the packets between the \textit{gui} host and the \textit{server} host.

On the \textit{gui} host, start the \textit{Mozilla} web browser.
After typing in the URL \url{https://server.netlab}, a dialog window titled \textit{Potential Security Risk Ahead} or \textit{Website Certified by an Unknown Authority} will pop up, reporting the reception of a certificate signed by an unknown authority and asking if you want to continue.
Add "Certificate" to exceptions and continue browsing in \textit{Advanced...} section and click on \textit{Accept the Risk and Continue}.

Click the \textit{View Certificate} button.
Then a \textit{Certificate Viewer} window pops up, displaying detailed information about the received certificate.
Examine the certificate and dump the window into a picture if necessary.
Save the pictures for the lab report.

Click the \textit{Continue} button in the \textit{Website Certified by an Unknown Authority} dialog window to accept the certificate.
Then terminate \lstbash{wireshark} and Mozilla.

Use \lstbash{wireshark} to examine the operation of SSL.

\begin{report}
    \item What is the port number used by the secure Apache server?

    \item Compare the general information of the received certificate with the \lstbash{openssl} output saved in the previous exercise.
    Are they consistent?

    \item What is the Subject of the received certificate? Who is the Issuer of this certificate? Are they the same?

    \item What is the \textit{Certificate Signature Algorithm} used to generate and distribute this certificate?

    \item When was the certificate signed? When will it expire?
\end{report}

\part{Exercises on Auditing and Intrusion Detection}
Start \lstbash{apache2} service and browse several page in the \textit{Mozilla}.
Open random URL that not exist on the web server to generate log for apache.
Browse again page as \path{secure http}.

\section{Trace Log}
Go to \path{log} folder at \path{/var/log/} to examine the log files in your host.
If a log (e.g. the \textit{Apache Access Log} at \path{/var/log/apache2/access.log}) is too long, use \lstbash[emph={keyword}]{grep keyword access.log | tail} (e.g. \textbf{GET}) in the {console} to display those log entries containing the keyword.
Enter the keyword \textbf{failed} or \textbf{404} to display logged failures.

See other log files.

\section{Log Analyzer}
Linux uses a utility called \lstbash{webalizer} to analyze the web server log files.
\lstbash{webalizer} reads the \lstbash{apache2} log files and creates a set of web reports on server statistics.
Another utility is \lstbash{goaccess} that analyze various access type and list it.

To analyze local log use this commands:
\begin{lstlisting}
webalizer
    \end{lstlisting}

To view the reports of the \lstbash{webalizer}, start \textit{Mozilla} and enter the URL \url{http://server.netlab/usage/index.html}.
Examine the web statistics displayed in the browser.
Also click on the month links in the Summary by Month table to see the statistics of each month.

To analyze local log use this commands:
\begin{lstlisting}
goaccess -a > /var/www/html/report.html
    \end{lstlisting}

To view the report of the \lstbash{goaccess}, start \textit{Mozilla} and enter the URL \url{http://server.netlab/report.html}.
Examine the web statistics displayed in the browser.
Also click on the side panel to see other section.

\begin{report}
    \item List the most frequently visited pages at the local Apache server during the most recent month, respectively.

    \item List the web pages that have the most number of bytes transferred by the local during the most recent month, respectively.
\end{report}

\section{System Status}
Execute \lstbash{netstat -l} to display the listening sockets in server host.

Execute this commands to see the system services info \footnote{The old Linux OS service loaded in\path{/etc/init.d/} and \path{/etc/init/} directories} and their status.
Save the output for the lab report.
\begin{itemize}
    \item \lstbash{service --status-all}
    \item \lstbash[morekeywords={[2]list-units}]{systemctl list-units --type=service --state=running} (\textit{Not work on} \lstbash{docker})
    \item \lstbash[morekeywords={[2]list-unit-files}]{systemctl list-unit-files --type service --state=enabled} (\textit{Not work on} \lstbash{docker})
\end{itemize}

\begin{report}
    \item Is the \lstbash{rlogin}, \lstbash{ssh} and \lstbash{apache2} services enabled and running in server host?
\end{report}
\end{document}