CS640 Assignment 2: Security Lab

Due: December 15, 2011, In class



Description

Network security is largely concerned with three distinct activities. The first is deploying systems that actively block unwanted traffic in an infrastructure. Common devices for active packet blocking include firewalls and Network Intrusion Prevention Systems. A firewall is a system which blocks traffic based on simple rules that specify different features in network packet headers. For example, a firewall rule might say "block all traffic with destination port 135". These simple rules end up being quite useful and firewalls are widely used devices. An NIPS has the ability to be much more discerning about which traffic is blocked. This is done through the use of signatures which typically specify a bit pattern in packet payloads. If a given packet matches a one of the signature patterns, that packet is dropped by the NIPS - which prevents the attack from being successful.

A second activity of network security is to monitor the infrastructure for malicious activity. A basic tenet of security is that it is essential to have as much information as possible about ones environment in order to effectively protect it. One of the most basic tools for monitoring a network infrastructure is a Network Intrusion Detection System (NIDS). Like NIPS, NIDS are used to monitor traffic streams to/from a network. They also use signatures of known malicious activity to detection attacks. When a NIDS identifies a packet that matches one of its signatures, it does not drop the packet (then it would be a NIPS). Instead, it generates an alert/alarm that warns the analyst that security has been breeched.

A third activity of network security is to mitigate the effects of successful attacks. One can never assume that one has sufficient defenses to counter all attacks forever. Thus, when an NIDS or other monitoring system indicates an attack took place, the security analyst must assess the damage and do whatever is necessary to recover from it.

The purpose of this laboratory experiment is to familiarize you with the first and second activity mentioned above using some security tools: Snort, Nessus, and firewall routers. We will use the Junosphere virtual networks and routers for this lab.

Reading Material

The following reading material are suggested before you start working on the lab assignment to get you familiar with the topics:

Lab Description

Here is the lab setup. The lab consists of the following sections:

Pre-lab Questions

Please enter the answers to the questions below in your lab report:

Snort and Nessus Experiments

Snort and Nessus are already installed for your experiment on the lab testbed. Please do not change the installation settings. Snort is installed on the PublicIDS machine and Nessus is installed on the PublicPC4.

Note that for the purposes of this assignment you should use the IP addresses that you get by running the "ifconfig" command on these 2 machines; and not the IP addresses shown in the lab setup.

Sharing the PCs

Once you login into any of the machines create a folder /root/<your color in CAPS> (ex. /root/RED) for your group's use.

Running Nessus

Nessus is installed on the PublicPC4 machine. You need to do the following:

Based on the results file answer the following questions:

  • Question: What kind of vulnerabilities does Nessus investigate?
  • Question: What kind of vulnerabilities does Nessus find?

    Running Snort

    We use snort as a "sniffer" in this experiment. This means that it captures all the packets that passes through it and logs them for future investigation.

    You run snort as follows:

  • snort -l <log folder>

    The snort log files will be stored in the specified log folder. Generate 2 logs:

    1) Let snort run for a while and then stop it.
    2) Let snort run, and then run the Nessus scanner. Once the scanner is done, stop Snort.

    Snort provides an output summary of the kind of packets that it captured and also logs the packets. The log can be opened with the Wireshark application installed on CS lab machines and also available online.

    Investigate the Snort output and the log files:

  • Copy the Snort output in both cases to your report.
  • Question: What kind of packets does Nessus send to do the scanning?
  • Provide a screenshot of the logs opened by Wireshark in both cases.
  • Question: In what ways are these logs different?
  • Question: Does the packet coloring have any interpretation? Explain your thoughts.
  • Question: Once you click on each packet, 4 categories of information (ex. Transmision Control Protocol) is displayed for that packet. Briefly explain what kind of information each category captures.

    Setup a Firewall

    You have a firewall router in your lab setup. You should use the IPs and interfaces specified in this setup for this section. Here you can find some examples of how to change the firewall policies in the firewall router.

    Your task is to modify the firewall router's configuration so that:

  • Include a copy of your configuration in your lab report. Explain clearly what each of the filters and/or terms inside the filter accomplishes.

    Sharing the Firewall router

    Create a folder /root/<your color in CAPS> Each time that you work with the router configuration, save your configuration in a file and move it to your group's folder.
    To save your configuration run in the edit mode:

  • Save <filename>

    If you want to take a copy off of the router, in command mode, type:

  • Start shell

    This will then place you into the directory where the configuration file was saved to. You can now ‘sftp’ or ‘scp’ the file out to a remote host just as you did in lab1.

    Each time before you start working with the configuration and after you are done run the following to restore the router to its original state:

  • load override /config/juniper.conf.vmm
  • commit

    You can also load back your configurations with the above commands. Just override the current configuration with "your" configuration file.

    Post-Lab Questions

    Please enter the answers to the questions below in your lab report:

    Accessing the Network

    Send the course TA an E-mail with your group members' names to get access to the network. You can find the schedule here.

    Assessment Criteria

    Your hard copy report, to be submitted at the start of the class on the due date, should include:

    Grading

    This assignment will be graded from a total of 50 points. Here is the grading criteria: