Snort rule, cyber security<\/p>\n
Scenario: You are responsible for security in a company and you need to protect the systems reviews. These are in a well-defined subnet and only specific systems can connect to it (jump points). Jump points allow two network maps. One is connected to the network (unprotected) and the second allows access to protected systems. You must introduce a honeypot into this network in order to detect lateral movements.<\/p>\n
What you need to do:<\/p>\n
Install a honeypot (OpenCanary). Refer to https:\/\/opencanary.readthedocs.io\/en\/latest\/starti…. On another system located in the same network, use a port other than 22 for connections via the SSH protocol (one of your choice).<\/p>\n
Via your Security Onion system, write a Snort rule that will generate an alert when it detects a connection to a honeypot coming from another network than that of jump points to the ports administration (ssh) or port knowcking. Implement the rule and ensure that it is hit.<\/p>\n
Instructions<\/p>\n
a. Create the honeypot (5p)<\/p>\n
b. Configure port knocking for honeypot (5p)<\/p>\n
c. Inside the snort.conf file activates a new variable that contains the IPs of the honeypots (ex HON_NET) (2.5p)<\/p>\n
d. Inside the snort.conf file activates a new variable that contains the ports administration of honeypots (ex HON_PORTS) (5p)<\/p>\n
e. Inside the snort.conf file activates a new variable which contains the list of IP addresses of jump points authorized to communicate with honeypots (ex JUMP_NET) (2.5p)<\/p>\n
f. Create a single Snort rule that will detect:<\/p>\n
– a. Communications (traffic) to a honeypot system (IP and Port via variables) (5p)<\/p>\n
– b. Communications (traffic) originating from a system other than the jump points (via<\/p>\n
variable) (5p)<\/p>\n
– c. The alert generated by your SNORT rule, must contain your last name \/ first name (5p)<\/p>\n
g. Generate traffic that will trigger\/hit the rule (5p)<\/p>\n
h. Document all the steps via explanations and screenshots (5p<\/p>\n
OpenCanary Lab and Port Knocking<\/p>\n
For this lab we will use an Ubuntu Server 20.04 virtual machine.<\/p>\n
Server Setup<\/p>\n
Install and configure an Ubuntu server 20.04.
\nIf you need help we can provide a document with all the steps<\/p>\n
Change SSH port<\/p>\n
Edit the \/etc\/ssh\/sshd_config file<\/p>\n
sudo nano \/etc\/ssh\/sshd_config<\/p>\n
Make the line active (delete the leading #) and modify the port. In my example I put it 22222<\/p>\n
Save the file and restart the ssh service and restart the machine<\/p>\n
service ssh restart
\nsudo reboot<\/p>\n
Installing OpenCanary<\/p>\n
Use the following commands to install OpenCanary<\/p>\n
sudo apt-get update<\/p>\n
sudo apt-get install python3-dev python3-pip python3-virtualenv python3-venv python3-scapy libssl-dev libpcap-dev<\/p>\n
pip install markupsafe==2.0.1<\/p>\n
virtualenv env\/<\/p>\n
. env\/bin\/activate<\/p>\n
pip install opencanary<\/p>\n
Once the installation is done, it’s time to configure the honeypot. We will create the configuration file and we will make a copy of the original file<\/p>\n
opencanaryd –copyconfig<\/p>\n
sudo cp \/etc\/opencanaryd\/opencanary.conf \/etc\/opencanaryd\/opencanary.conf.orig<\/p>\n
Then we will modify the configuration parameters<\/p>\n
sudo nano \/etc\/opencanaryd\/opencanary.conf<\/p>\n
Enable http, ssh and mysql services by changing the “false” to “true”<\/p>\n
Save the configuration file and start opencanary<\/p>\n
opencanaryd –start<\/p>\n
Now your Honeypot is functional. You can do an nmap scan to identify open ports<\/p>\n
\u2514\u2500$ nmap -p- IP_Honeypot
\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2022-11-14 20:06 EST
\nNmap scan report for 192.168.126.151
\nHost is up (0.00020s latency).
\nNot shown: 65530 closed ports
\nPORT STATE SERVICE
\n21\/tcp open ftp
\n22\/tcp open ssh
\n80\/tcp open http
\n3306\/tcp open mysql
\n22222\/tcp open easyengine<\/p>\n
Nmap done: 1 IP address (1 host up) scanned in 1.97 seconds<\/p>\n
Port 22222 is the real ssh. You can hide it using port knocking technique
\nhttps:\/\/www.tecmint.com\/port-knocking-to-secure-ssh\/<\/p>\n","protected":false},"excerpt":{"rendered":"
Snort rule, cyber security Scenario: You are responsible for security in a company and you need to protect the systems reviews. These are in a\u2026<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9443],"tags":[2226,9447],"class_list":["post-115558","post","type-post","status-publish","format-standard","hentry","category-phd-dissertation-help-service","tag-cyber-security","tag-snort-rule"],"_links":{"self":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/115558","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/comments?post=115558"}],"version-history":[{"count":0,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/115558\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/media?parent=115558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/categories?post=115558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/tags?post=115558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}