= Εργασία Χειμερινού Εξαμήνου 2020-21 // Metadata: :description: Intro and Install :keywords: sec, swarm. docker :data-uri: :toc: right :toc-title: Πίνακας περιεχομένων :toclevels: 4 :source-highlighter: highlight :icons: font :sectnums: Μάθημα: Ασφάλεια Δικτύων και Επικοινωνίων + Ονοματεπώνυμο: Χρυσούλα Κούτκου + Αριθμός Μητρώου: 71344742 {empty} + == Docker Installation (Ubuntu) ``` curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" sudo apt update sudo apt install -y docker-ce echo "or" sudo apt install docker* sudo systemctl status docker sudo usermod -aG docker username #οπου username το όνομα του χρήστη που θα δουλεύει με docker ``` [[cheat-compose]] == docker-compose ``` sudo curl -L "https://github.com/docker/compose/releases/download/1.24.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose sudo chmod +x /usr/local/bin/docker-compose sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose ``` [[cheat-error]] == On Error: - run ``` $ sudo su # touch set-ca.sh ``` - copy-paste lines ``` registry_address=registry.vlabs.uniwa.gr registry_port=5043 mkdir -p /etc/docker/certs.d/$registry_address:$registry_port openssl s_client -showcerts -connect $registry_address:$registry_port < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /etc/docker/certs.d/$registry_address:$registry_port/ca.crt registry_port=5080 mkdir -p /etc/docker/certs.d/$registry_address:$registry_port openssl s_client -showcerts -connect $registry_address:$registry_port < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /etc/docker/certs.d/$registry_address:$registry_port/ca.crt registry_address=hub.swarmlab.io registry_port=5443 mkdir -p /etc/docker/certs.d/$registry_address:$registry_port openssl s_client -showcerts -connect $registry_address:$registry_port < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /etc/docker/certs.d/$registry_address:$registry_port/ca.crt registry_port=5480 mkdir -p /etc/docker/certs.d/$registry_address:$registry_port openssl s_client -showcerts -connect $registry_address:$registry_port < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /etc/docker/certs.d/$registry_address:$registry_port/ca.crt ``` === exec file ``` sudo bash ./set-ca.sh ``` {empty} + == Install swarmlab-sec (Home PC) - Clone repo https://git.swarmlab.io:3000/swarmlab/swarmlab-sec[^] + == Usage (swarmlab-sec) - Open a console - cd to swarmlab-sec - Create a directory ``` cd ../install/usr/share/swarmlab.io/sec/swarmlab-sec create create project (swarmlab-sec create) up start swarmlab-sec (swarmlab-sec up size=10) scale resize swarmlab-sec (swarmlab-sec scale size=30) reload rebuild image (swarmlab-sec reload size=15) login login swarmlab-sec (swarmlab-sec login) exec execute command (swarmlab-sec exec [SHELL COMMAND]) down stop swarmlab-sec (swarmlab-sec down) clean clean project (swarmlab-sec clean) list show instances (swarmlab-sec swarmlab-sec list) help show help (swarmlab-sec help) ``` [[cheat-swarmlab-create]] == Create swarmlab project ``` mkdir project cd project ../install/usr/share/swarmlab.io/sec/swarmlab-sec create ``` .Relevant files: ``` Project ├── Dockerfile # Image specification ├── project # Sample program source code │ └── hello_world.c ├── ssh # keys for accessing │ ├── id_rsa # (could generate your own) │ └── id_rsa.pub ├── docker-compose.yml # Container orchestration ``` [[cheat-swarmlab-up]] == Spin up the swarmlab cluster ``` cd project ../install/usr/share/swarmlab.io/sec/swarmlab-sec up size=5 ``` [[cheat-swarmlab-up1]] == Login to the swarmlab cluster ``` cd project ../install/usr/share/swarmlab.io/sec/swarmlab-sec login ``` User password: docker Sudo password: docker == Inside on Docker Master First of all, type ifconfig to see your ip address. Then, create an inventory.yml with the IPs using nmap -sP 172.27.0.* | grep Nmap | cut -d' ' -f5-6 ``` [service] 172.27.0.2 172.27.0.3 172.27.0.4 172.27.0.5 172.27.0.6 ``` Afterwards, you have to create a test.yml file. ``` --- - hosts: service remote_user: docker gather_facts: no vars: user: "docker" tasks: # ----------------- # make directory # ----------------- - name: make dir for data become: true file: path: "/var/lab/playground/playground-readmongo" state: directory owner: docker group: docker mode: '0777' # - name: google.com # become: yes # become_user: "{{ user }}" # command: curl http://www.google.com # ignore_errors: yes # register: configwww # # - name: ls configwww # debug: var=configwww.stdout_lines - name: ls -al /var/lab/playground/playground-readmongo/ become: yes become_user: "{{ user }}" #command: ls -al /var/lab/playground/playground-readmongo command: ls -al /etc ignore_errors: yes register: config - name: ls config debug: var=config.stdout_lines # # - name: Refresh connection # meta: clear_host_errors ``` Then, create a run.sh script. ``` ansible-playbook -u docker -i inventory.yml test.yml -f 5 --ask-pass --ask-become-pass ``` In your command line, type: ``` chmod +x run.sh sudo apt install ansible ./run.sh (Somewhere here there would be some errors) sudo apt install sshpass cd /etc/ansible vi ansible.cfg (Add this line) host_key_checking = False (Exit and return back) ./run.sh ``` == Hping3 Attack {empty} + Here is a video about hping3, tcpdump, netstat and iptables rules. Feel free to press like button and subscribe! video::lErpyiAbsVs[youtube] {empty} + Firstly, connect to the worker that you wish to do the attack. Inside the worker create a script file with these: ``` #!/bin/sh #installation_of_hping3 sudo apt update sudo apt install hping3 -y #syn_flood_attack_with_hping3_on_docker_master_with_IP_172.27.0.2 #hping3 -i u1 -S -p 80 172.27.0.2 #hping3 172.27.0.2 -q -n -d 120 -S -p 80 --flood hping3 -S -p 80 172.127.0.2 ``` In your command line type: ``` chmod +x hping3.sh sudo ./hping3.sh ``` == Tcpdump on the victim After connecting to the victim's host, then create a script file tcpdump.sh ``` #!/bin/sh tcpdump port 80 #tcpdump -Nnn -i any -s0 'tcp[13] & 2 !=0' ``` In your command line type: ``` chmod +x tcpdump.sh sudo ./tcpdump.sh ``` == Netstat on the victim Create a netstat.sh script file and type the above: ``` #!/bin/sh netstat -npt | awk '{print $6}' | sort | uniq -c | sort -nr | head netstat -anp | grep 'tcp\udp' | awk '{print $6}' | cut -d: f1 | sort | uniq -c | sort -n netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n netstat -na netstat -tna netstat -antlupe netstat -n -p | grep SYN_REC | wc -l netstat -npt | awk '{print $6}' | sort | uniq -c | sort -nr | head ``` In your command line type: ``` chmod +x netstat.sh sudo ./netstat.sh ``` == Anti-Ddos protection using iptables Create an anti-ddos.sh file and type inside: ``` #!/bin/sh #drop invalid packets iptables -A INPUT -m state --state INVALID -j DROP iptables -A FORWARD -m state --state INVALID -j DROP iptables -A OUTPUT -m state --state INVALID -j DROP #Use SYNPROXY on all ports (disables connection limiting rule) ### iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 iptables -A INPUT -m conntrack --ctstate INVALID -j DROP ``` In your command line type: ``` chmod +x anti-ddos.sh sudo ./anti-ddos.sh ``` == SSH Brute Force Attack using Medusa {empty} + Here is a video about ssh brute force attack using medusa tool, detection using rsyslog and protection using fail2ban video::6C8suUjJBCA[youtube] {empty} + In order to do this attack, you have to create a password list file. For example, ``` 123password root admin-root acbdef2147 whatistherealpassword docker password 123456789 ``` The next step is to create a medusa.sh script file. ``` #!/bin/bash sudo apt update sudo apt install medusa medusa -u docker -P pass.txt -h 172.27.0.3 -M ssh ``` To accomplish the ssh brute force attack I connected as worker_4 and I will attack the worker_1. In your command line type: ``` chmod +x medusa.sh sudo ./medusa.sh ``` == Detection of SSH Brute Force using rsyslog tool I will connect as worker_1 and I will create a rsyslog.sh file. ``` #!/bin/bash sudo apt update sudo apt install rsyslog sudo service rsyslog start sudo service rsyslog status sudo grep "Failed password" /var/log/auth.log ``` In your command line type: ``` chmod +x rsyslog.sh sudo ./rsyslog.sh (After results are shown type the next line) sudo service rsyslog stop ``` == Fail2ban tool for SSH protection Create a fail2ban.sh file and type the below: ``` #!/bin/bash sudo apt update sudo apt install fail2ban ``` In your command line type: ``` chmod +x fail2ban.sh sudo ./fail2ban.sh ``` ``` sudo service fail2ban start sudo service fail2ban status cd /etc/fail2ban cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local (Inside the jail.local type the below) [DEFAULT] loglevel = DEBUG logtarget = path_to_log [sshd] enabled = true maxretry = 2 bantime = 600 findtime = 30 logpath = %(sshd_log)s backend = %(sshd_backend)s action = iptables-multiport[name=%(__name__)s, bantime="%(bantime)s, port=ssh, protocol="%(protocol)s", chain=INPUT] ``` In your command line type:` ``` sudo service fail2ban restart sudo service fail2ban status sudo fail2ban-client start sudo fail2ban-client status sudo fail2ban-client status sshd ``` == SSH Brute authentication only with keys To accomplish this brute force login with only key you have to connect to a container, for instance I connected to worker_5. In your command line type:` ``` (Our server is worker_5) mkdir .ssh cd .ssh ssh-keygen cat ~/.ssh/id_rsa.pub (You should do the below for every worker, but for this example I will do only about worker_4) ssh-copy-id docker@172.27.0.5 (Then it will ask you to connect) ssh docker@172.27.0.5 (After doing this to all remaining containers type the next below for each host) scp id_rsa docker@172.27.0.5 #copy id_rsa to every container sudo service ssh restart ``` Then you have to disable password authentication on you server. ``` (Being on server) cd /etc/ssh vi sshd_config (Inside sshd_config change the below) PasswordAuthentication no (After doing this return to your command line and type the below) sudo service ssh restart ``` And finally you are ready! == VPN {empty} + Here is a video about how you can create VPN and provide services to docker swarm. video::FnRMonM07yQ[youtube] {empty} + In this part, I will show you how you can create a VPN and and provide services to the docker swarm. Firstly, you shoudld be on the /swarmlab-sec/project folder and create a vpn folder. ``` cd swarmlab-sec/project mkdir vpn cd vpn ``` The next step is to create a create-vpn. script. ``` #!/bin/bash IP=127.0.0.1 # Server IP P=1194 # Server Port OVPN_SERVER='10.80.0.0/16' # VPN Network #vpn_data=/var/lib/swarmlab/openvpn/openvpn-services/ # Dir to save data ** this must exist ** vpn_data=$PWD/openvpn-services/ if [ ! -d $vpn_data ]; then mkdir -p $vpn_data fi NAME=swarmlab-vpn-services # name of docker service DOCKERnetwork=swarmlab-vpn-services-network # docker network docker=registry.vlabs.uniwa.gr:5080/myownvpn # docker image docker stop $NAME #stop container sleep 1 docker container rm $NAME #rm container # rm config files rm -f $vpn_data/openvpn.conf.*.bak rm -f $vpn_data/openvpn.conf rm -f $vpn_data/ovpn_env.sh.*.bak rm -f $vpn_data/ovpn_env.sh # create network sleep 1 docker network create --attachable=true --driver=bridge --subnet=172.50.0.0/16 --gateway=172.50.0.1 $DOCKERnetwork #run container see ovpn_genconfig docker run --net=none -it -v $vpn_data:/etc/openvpn -p 1194:1194 --rm $docker ovpn_genconfig -u udp://$IP:1194 \ -N -d -c -p "route 172.50.20.0 255.255.255.0" -e "topology subnet" -s $OVPN_SERVER # create pki see ovpn_initpki docker run --net=none -v $vpn_data:/etc/openvpn --rm -it $docker ovpn_initpki # see ovpn_copy_server_files #docker run --net=none -v $vpn_data:/etc/openvpn --rm $docker ovpn_copy_server_files #create vpn see --cap-add=NET_ADMIN sleep 1 docker run --detach --name $NAME -v $vpn_data:/etc/openvpn --net=$DOCKERnetwork --ip=172.50.0.2 -p $P:1194/udp --cap-add=NET_ADMIN $docker sudo sysctl -w net.ipv4.ip_forward=1 #show created docker ps ``` create-user.sh ``` USERNAME=user1 vpn_data=$PWD/openvpn-services/ docker=registry.vlabs.uniwa.gr:5080/myownvpn docker run -v $vpn_data:/etc/openvpn --rm -it $docker easyrsa build-client-full $USERNAME nopass docker run -v $vpn_data:/etc/openvpn --log-driver=none --rm $docker ovpn_getclient $USERNAME > $USERNAME.user ``` After the user is created add in the $USERNAME.user the below: ``` client nobind dev tun comp-lzo resolv-retry infinite keepalive 15 60 remote-cert-tls server remote 10.0.2.15 1194 udp #type your host IP address in every $USERNAME.user float ``` rm-user.sh ``` #!/bin/bash CLIENTNAME=test1 U=$CLIENTNAME vpn_data=$PWD/openvpn-services/ docker=registry.vlabs.uniwa.gr:5080/myownvpn rm -f $vpn_data/pki/reqs/$CLIENTNAME.req rm -f $vpn_data/pki/private/$CLIENTNAME.key rm -f $vpn_data/pki/issued/$CLIENTNAME.crt rm -f $vpn_data/server/ccd/$CLIENTNAME rm -f $vpn_data/ccd/$CLIENTNAME pem=$(sudo grep "CN=$U$" $vpn_data/pki/index.txt | cut -f4) rm -f $vpn_data/pki/certs_by_serial/$pem.pem sed -i "/CN=$U$/d" $vpn_data/pki/index.txt echo $pem docker run -v $vpn_data:/etc/openvpn --log-driver=none --rm -it $docker ovpn_revokeclient $CLIENTNAME remove rm -f $vpn_data_user_config/$CLIENTNAME.ovpn rm -f $vpn_data_user_config1/$CLIENTNAME.ovpn ``` show-user.sh ``` NAME=swarmlab-vpn-services # name of docker service docker exec -it $NAME ovpn_listclients ``` show-conn-user.sh ``` NAME=swarmlab-vpn-services # name of docker service docker exec -it $NAME cat /tmp/openvpn-status.log ``` Then you have to type in your command line: ``` chmod +x create-vpn.sh chmod +x create-user.sh chmod +x show-user.sh chmod +x rm-user.sh chmod +x show-conn-user.sh ./create-vpn.sh ./create-user.sh #for every user you have to use a different name ./show-user.sh #you can see all the users ./show-conn-user.sh #you can see all connected users to the vpn cp $USERNAME.user ../project #this user will be copied to the master ``` After doing these steps, connect to a docker host, for instance in docker master. ``` sudo apt update sudo apt install openvpn ls -al #to check if there is the user1.user file sudo su service openvpn start openvpn --config ./user1.user #client connection to the VPN ``` Don't close the window or do not stop the execution. Open a new window and connect to the same user and type ifconfig to check if the tun0 has created. Now connect to an other worker, for instance worker_1. You have to do the same thing in every worker. ``` ssh docker@172.27.0.3 sudo apt update sudo apt install openvpn touch user2.user vi user2.user #copy the user2.user file from the /swarmlab-sec/project/vpn/ and paste it here ls -al #to check if there is the user1.user file sudo su service openvpn start openvpn --config ./user2.user #client connection to the VPN ``` You have to do the same procedure for the other workers. Don't close the window or do not stop the execution. Open a new window and connect to the same user and type ifconfig to check if the tun0 has created. Then in docker master tab type: ``` sudo su tcpdump -i tun0 ``` Go to the new docker worker tab and type: ``` ping 10.80.0.2 #this is the new IP of master of tun0 ``` You are ready! == REMOTE/LOCAL SSH FORWARDING {empty} + Here is a video about how you can do ssh local and remote forwarding. video::gbegXj8pQxs[youtube] {empty} + On remote container ``` sudo apt install nginx curl localhost #to check if localhost is working hostname -i ``` On localhost host ``` curl localhost #to check if localhost is working hostname hostname -i sudo ssh -nNT -L 80:localhost:80 docker@172.27.0.2 ``` Then type on localhost host again in a new tab: ``` curl localhost #to check if localhost is working ``` And it works! + Please enjoy and thank you for reading my ascii doc and watching my youtube videos!