linuxexpert-practice-labs/labs/lpic-3-303/334-2-network-intrusion-detection/README.md

LPIC-3 334.2: Network intrusion detection

Snort with local rules, by hand and as a service, and bandwidth monitoring with ntopng and iftop. Snort and ntopng are packaged for Ubuntu, not for the RHEL family, so this lab runs on Ubuntu only.

Before you start

The peer, at 10.99.0.2 (name peer), plays the outside host that sends traffic. It sits on this VM's second network, 10.99.0.0/24, where this VM is 10.99.0.1 on interface le-host: watch that interface. Get a shell in the peer with sudo ip netns exec lepeer bash; it shares this VM's files and programs, so install nmap here to use it there.

The lab runs a small web server on 10.99.0.1:8080 (le-lab-app) with a large file, big.bin. Snort's installer would pick up the lab's le-host interface by a name it can't use and fail, so the lab writes /etc/snort/snort.debian.conf first, with your main interface. OpenVAS needs a large feed download and several gigabytes of memory, so it isn't part of this lab.

Tasks

1. Install Snort and stop the service the package starts. Write two local rules in /etc/snort/rules/local.rules: an alert for pings (ICMP type 8) to the home network, sid:1000001, and an alert for web requests to port 8080 whose URI contains /lab-admin, sid:1000002. Check that the configuration validates with HOME_NET set to 10.99.0.0/24 on le-host.
2. Run Snort by hand on le-host with console alerts going to /root/snort-console.txt. From the peer, ping this VM, ask for http://10.99.0.1:8080/lab-admin, and send an nmap Xmas scan. Stop Snort and read the alerts: your two rules, and the distributed rule 1228 for the scan.
3. Run Snort as the packaged service instead, on le-host with the home network 10.99.0.0/24, set in its Debian configuration file, so that pings from the peer land in /var/log/snort/snort.alert.fast. Summarize that file with snort-stat.
4. Install ntopng and iftop. Make ntopng watch le-host and answer on port 3000. Download big.bin over and over from the peer at a limited rate, and watch the traffic with an iftop text report.

Hints

• DEBIAN_FRONTEND=noninteractive apt-get install -y snort; systemctl stop snort. /etc/snort/snort.conf already includes $RULE_PATH/local.rules. alert icmp any any -> $HOME_NET any (msg:"..."; itype:8; sid:1000001; rev:1;); for the web rule, flow:to_server,established; content:"/lab-admin"; http_uri;. snort -T -c /etc/snort/snort.conf -i le-host -S HOME_NET=[10.99.0.0/24].
• setsid -f timeout 600 snort -A console -q -k none -c ... -i le-host -S ... > /root/snort-console.txt 2>&1; give it half a minute to load. ping -c 2, curl, nmap -sX -p 22,80 10.99.0.1 from the peer; pkill -x snort writes out what it buffered.
• /etc/snort/snort.debian.conf: DEBIAN_SNORT_HOME_NET, DEBIAN_SNORT_INTERFACE; systemctl restart snort, ps -o args= -C snort; snort-stat < /var/log/snort/snort.alert.fast.
• -i=le-host in /etc/ntopng.conf, systemctl restart ntopng; curl --limit-rate 5M; iftop -t -n -P -s 10 -i le-host.