牛角麵包 - 防禦入侵系統
牛角麵包 (Croissants) 是一項開源項目，但有一項同名的項目是商業版本的，開源版本的名字為牛角麵包 (社區版，Community Edition)。收費版本具有禦防網絡掃描器的偵測和推送更新的技術，其他的與開源版本大致是一樣的。
牛角麵包與統一威脅管理系統 (Unified Threat Management System, UTM) 和下世代防火牆 (Next Generation Firewall, NG Firewall) 有相當程度是相若的，不同的只是牛角麵包並沒有防火牆。
牛角麵包是由黑客設計與開發出來對付黑客的一個系統，不論他們是道德黑客或者是惡意黑客。
開源版的特性 ：
她具有統一威脅管理系統和下世代防火牆的大部份特性，例如防禦漏洞利用、防止病毒攻擊、惡意網絡地址黑名單、防禦惡意軟件攻擊、惡意網頁攻擊過濾、防止洋蔥網絡 (Tor) 瀏覽、防止有敵意的網絡流量、偵測網絡掃描器掃描等。
至於效能方面，她有極低延遲性的特點，有效地提高網絡遊戲的可玩性，而且能夠有效地播放 4K 的多媒體，她更能夠處理大約 40GB 或以上的流量，當然這也與硬件的規格有相當大的關係。
至於配置方面，她幾乎可以配置在網絡中的任何位置，包括網外和網內。如果再配合奧德拉 (Audra) (偵測入侵系統)，這樣每個網段都涵蓋得到。奧德拉也是基於牛角麵包 (社區版) 而設計的偵測入侵系統，其元件是完全一樣的。
收費版的特性 ：
除了具有社區版的功能外，她還有推送更新技術，如遇緊急情況，可以立刻對牛角麵包作出遠端更新，以求達到防禦入侵的最佳效果。
另外她還可以擋格所有網絡掃描器的偵測，令黑客不能有效地得到意圖入侵目標的資訊，從而未能有效地作出攻擊。如果盲目地作出攻擊，這是徒勞無功的。這樣就可以防止或延遲被入侵的可能性，這功能特別適合於有伺服器配置在網絡中的環境。
Samiux
OSCE OSCP OSWP
************
Croissants - Intrusion Detection and Prevention System
Croissants is an open source project and commercial project at the same time. Open source project is namely Croissants (Community Edition, CE) while commercial one is Croissants. Croissants and Croissants CE are almost the same. However, Croissants has some outstanding technique, such as push update and upgrade as well as blocking network scanning.
Croissants is very similar with Unified Threat Management System (UTM) and Next Generation Firewall (NG Firewall). However, Croissants does not have firewall anyway.
Croissants is designed by a hacker to defend against hackers. He knows what hackers are doing and thinking, regardless of whether they are ethical or malicious.
Croissants CE Features :
Croissants CE has similar features as UTM and NG Firewall, such as preventing vulnerabilities exploits, anti-virus, malicious IP address blacklisting, preventing malicious software, filtering web page attacks, preventing Tor network from being accessed, blocking malicious traffic, detecting network scanning, and etc.
It is an ultra-low latency system which is ideal for demanding online games and 4K video streaming. The maximum bandwidth of Croissants is over 40GB which is depending on the hardware configuration.
Croissants CE can be placed at any place in the network which is including outside and inside the network segments. When implemented with Audra (Intrusion Detection System), the traffic monitoring in the network can be covered completely. Meanwhile, Audra is designed based on Croissants CE.
Croissants Features :
Croissants has all the features as Croissants CE but it also has push update and upgrade features. It provides an emergency update or upgrade in order to provide a better protection to the network when needed.
In addition, it also can block network scanning. Once the scanning is blocked, hackers cannot obtain the information of the services and ports of the network/servers. They cannot launch any attack to the network blindly. You can be prevent from being attacked or delay of being attacked as a result. Croissants is ideal for network that providing connections to the public.
Samiux
OSCE OSCP OSWP
Reference
InfoSec Ninjas 资安忍者
Showing posts with label Croissants. Show all posts
Showing posts with label Croissants. Show all posts
Sunday, September 09, 2018
Wednesday, June 06, 2018
保衛橋頭堡
嚴格來說我身兼數職，我既是開源項目開發者、系統管理員、網絡滲透測試員、資訊科技安全硏究員、又是公司文員。我是一名資訊科技安全愛好者，擁有有關的專業認證，就是 OSCE，OSCP 及 OSWP。
我家裏有兩個網絡，一個是日常運作的網絡另一個是用作滲透測試和軟件測試之用。日常運作的網絡中有一台網頁伺服器，一台私人雲端檔案伺服器，一台虛擬系統伺服器，二台路由器和一台防禦入侵系統，網頁伺服器還有人工智能網頁防火牆。
我每日的例行工作是更新所有桌面系統及伺服器系統，閱讀有關資訊科技安全有關的新聞和硏究報告，開發資訊科技安全有關的開源軟件或系統，撰寫博客等，作為一個業餘的資訊科技安全人員來說真是工作煩多。
因為我有編程和資訊科技安全底子，所以我開發了一些資訊科技安全的開源項目，其中有防禦入侵系統 (Croissants，牛角麵包) 和人工智能網頁防火牆 (Longjing，龍井)，它們都是由我自主硏發的。
我所開發的防禦入侵系統能夠防止已知具有惡意的網絡地址存取我的網絡、可以防止已知的惡意軟件的下載或存取、可以防止網絡掃描軟件向我的網絡進行掃描、可以防止一些已知的安全漏洞被利用、防止我瀏覽一些已知的惡意網站。它具有極低的延遲特性，可以讓我流暢地觀看 4K 視頻及玩綫上遊戲，而且所有防禦入侵的安全規則都是免費的，更兼容各大常用電腦和手機系統。在硬件上的要求並不算高，建設成本極低，具有效率高和防禦性強及經濟的特性。
至於網頁防火牆，它是一個深度學習的人工智能網頁防火牆，這是一個開源項目。它主要是防禦資料庫注入 (SQL Injection, SQLi) 的攻擊，但它亦能夠防禦跨站腳本 (Cross Site Scripting, XSS) 和一些較低危險性的攻擊，它更具有迷惑網站漏洞掃描器的能力。若果有惡意的黑客利用網站漏洞掃描器來掃描我的網站，他們的掃描器會回報極多的漏洞，但是這些漏洞完全都是誤報的，這樣那些惡意的黑客就會被我的網頁防火牆誤導而浪費了很多時間去對每一個誤報的漏洞來查證。這個人工智能網頁防火牆極易安裝和維護，雖然效率並不十分高但其偵測準確率達到九十九巴仙以上，這是十分不錯的。
就是因為這兩個由我自主硏發的開源項目的應用，我可以比較安心地處理其他的資安事項而無需時常要親力親為地監察我的網絡安全。雖然這個世界上沒有絕對安全的電腦系統 (No System Is Safe)，但我的開源項目的確能夠分擔一些煩重的資安工作，這是非常理想的。再加上我在每一台 Linux 桌面系統及 Linux 伺服器都加固了，尤其是火狐瀏覽器，這樣我就更安心了。
我就是這樣保衛我的橋頭堡 - 網絡。
Bridgehead Defense
I am not only a clerk but also an open source project developer, system administrator, penetration tester, information security (infosec) researcher. I am an information security enthusiast with OSCE, OSCP and OSWP certificates.
I have two networks at home, one of them is for production and the other is for testing purpose. There are a web server, a private cloud server, a virtual machine hosting server, two routers, an intrusion detection and prevention system (IDPS) in the production network. Meanwhile, there is a web application firewall (WAF) for the web server too.
I update all my desktops and servers; read information security articles and research reports; developing infosec related open source projects and writing blog articles every day. It is a lot of work for a amateur information security guy indeed.
Since I have programming and infosec background, I develop some infosec related open source projects, such as IDPS (Croissants) and deep learning driven WAF (Longjing).
The IDPS prevents known IP addresses with malicious intention to access my network; it prevents known malware from being downloaded or accessed; it prevents my network from being scanned by vulnerability scanners; it prevents known vulnerabilities from being exploited; and it prevents me from accessing malicious web sites. Meanwhile, I can watch 4K video and play demanding online games due to the low latency of the IDPS. All the rules are free of charge and it is compatible with popular operating systems and smartphones. It is a low cost and high performance solution.
For the WAF, it is an open source deep learning driven WAF which is mainly designed for prevent the web application from being attacked by SQL Injection (SQLi). However, it also detects Cross Site Scripting (XSS) and other vulnerabilities too. It spoofs all the web application vulnerability scanners that causing it to produce a lot of false positive results. Malicious hackers will waste a lot of time to figure out what is happened. Although the WAF is not designed for performance, the SQLi detection rate is over 99%.
It is what my open source infosec projects implemented into my network for security purpose that allows me to do my researches and infosec projects development without worry. Although no system is safe, it helps me a lot for the network monitoring. Meanwhile, I also hardened all my Linux desktops and Linux servers and including browser - Firefox. As a result, I am feeling very good for that.
It is the story about my bridgehead defense - network.
我家裏有兩個網絡，一個是日常運作的網絡另一個是用作滲透測試和軟件測試之用。日常運作的網絡中有一台網頁伺服器，一台私人雲端檔案伺服器，一台虛擬系統伺服器，二台路由器和一台防禦入侵系統，網頁伺服器還有人工智能網頁防火牆。
我每日的例行工作是更新所有桌面系統及伺服器系統，閱讀有關資訊科技安全有關的新聞和硏究報告，開發資訊科技安全有關的開源軟件或系統，撰寫博客等，作為一個業餘的資訊科技安全人員來說真是工作煩多。
因為我有編程和資訊科技安全底子，所以我開發了一些資訊科技安全的開源項目，其中有防禦入侵系統 (Croissants，牛角麵包) 和人工智能網頁防火牆 (Longjing，龍井)，它們都是由我自主硏發的。
我所開發的防禦入侵系統能夠防止已知具有惡意的網絡地址存取我的網絡、可以防止已知的惡意軟件的下載或存取、可以防止網絡掃描軟件向我的網絡進行掃描、可以防止一些已知的安全漏洞被利用、防止我瀏覽一些已知的惡意網站。它具有極低的延遲特性，可以讓我流暢地觀看 4K 視頻及玩綫上遊戲，而且所有防禦入侵的安全規則都是免費的，更兼容各大常用電腦和手機系統。在硬件上的要求並不算高，建設成本極低，具有效率高和防禦性強及經濟的特性。
至於網頁防火牆，它是一個深度學習的人工智能網頁防火牆，這是一個開源項目。它主要是防禦資料庫注入 (SQL Injection, SQLi) 的攻擊，但它亦能夠防禦跨站腳本 (Cross Site Scripting, XSS) 和一些較低危險性的攻擊，它更具有迷惑網站漏洞掃描器的能力。若果有惡意的黑客利用網站漏洞掃描器來掃描我的網站，他們的掃描器會回報極多的漏洞，但是這些漏洞完全都是誤報的，這樣那些惡意的黑客就會被我的網頁防火牆誤導而浪費了很多時間去對每一個誤報的漏洞來查證。這個人工智能網頁防火牆極易安裝和維護，雖然效率並不十分高但其偵測準確率達到九十九巴仙以上，這是十分不錯的。
就是因為這兩個由我自主硏發的開源項目的應用，我可以比較安心地處理其他的資安事項而無需時常要親力親為地監察我的網絡安全。雖然這個世界上沒有絕對安全的電腦系統 (No System Is Safe)，但我的開源項目的確能夠分擔一些煩重的資安工作，這是非常理想的。再加上我在每一台 Linux 桌面系統及 Linux 伺服器都加固了，尤其是火狐瀏覽器，這樣我就更安心了。
我就是這樣保衛我的橋頭堡 - 網絡。
Bridgehead Defense
I am not only a clerk but also an open source project developer, system administrator, penetration tester, information security (infosec) researcher. I am an information security enthusiast with OSCE, OSCP and OSWP certificates.
I have two networks at home, one of them is for production and the other is for testing purpose. There are a web server, a private cloud server, a virtual machine hosting server, two routers, an intrusion detection and prevention system (IDPS) in the production network. Meanwhile, there is a web application firewall (WAF) for the web server too.
I update all my desktops and servers; read information security articles and research reports; developing infosec related open source projects and writing blog articles every day. It is a lot of work for a amateur information security guy indeed.
Since I have programming and infosec background, I develop some infosec related open source projects, such as IDPS (Croissants) and deep learning driven WAF (Longjing).
The IDPS prevents known IP addresses with malicious intention to access my network; it prevents known malware from being downloaded or accessed; it prevents my network from being scanned by vulnerability scanners; it prevents known vulnerabilities from being exploited; and it prevents me from accessing malicious web sites. Meanwhile, I can watch 4K video and play demanding online games due to the low latency of the IDPS. All the rules are free of charge and it is compatible with popular operating systems and smartphones. It is a low cost and high performance solution.
For the WAF, it is an open source deep learning driven WAF which is mainly designed for prevent the web application from being attacked by SQL Injection (SQLi). However, it also detects Cross Site Scripting (XSS) and other vulnerabilities too. It spoofs all the web application vulnerability scanners that causing it to produce a lot of false positive results. Malicious hackers will waste a lot of time to figure out what is happened. Although the WAF is not designed for performance, the SQLi detection rate is over 99%.
It is what my open source infosec projects implemented into my network for security purpose that allows me to do my researches and infosec projects development without worry. Although no system is safe, it helps me a lot for the network monitoring. Meanwhile, I also hardened all my Linux desktops and Linux servers and including browser - Firefox. As a result, I am feeling very good for that.
It is the story about my bridgehead defense - network.
Tuesday, May 01, 2018
HOWTO : upgrade Ubuntu 16.04 LTS to 18.04 LTS on Croissants
First of all make sure your Croissants box has sufficient free hard drive spaces, otherwise, the upgrade will fail.
Answer "Y" to all questiones asked.
After the upgrade, you need to run the following commands :
Remove the first
Remove the first
Then you can reboot your Croissants.
That's all! See you.
sudo apt install update-manager-core
sudo do-release-upgrade -dAnswer "Y" to all questiones asked.
After the upgrade, you need to run the following commands :
Remove the first
"# " from /etc/apt/sources.list.d/evebox.listRemove the first
"# " from /etc/apt/sources.list.d/elastic-5.x.listsudo update-java-alternatives -s java-1.8.0-openjdk-amd64
sudo systemctl enable logstash
sudo systemctl enable elasticsearch
sudo systemctl enable kibanaThen you can reboot your Croissants.
That's all! See you.
Monday, November 27, 2017
Zotac ZBox CI549/MI549 nano for Croissants
Croissants is Intrusion Detection and Prevention System (IDPS) which requires 3 network interfaces and CPU with AVX2, Zotac ZBox CI549 or MI549 is another good choice for home and/or SOHO users. It's small footprint and Intel Core i5-7300U (Dual Core/4 Hyperthreading) is suitable for home and/or SOHO users for IDPS, like Croissants.
It comes with 2 network interfaces and one Thunderbolt 3 Type-C port which can connect to an adaptor to become another network interface. It also can install up to 32GB DDR4 memory. In my opinion, it can handle up to 1000Mbps bandwidth with low to medium traffic flow even I did not test it at my side at the moment. However, I will purchase one for the test when it is available.
On the other hand, you can install pfsense with suricata plugin on it when Hyperscan is available for FreeBSD or pfsense. pfsense requires 2 network interfaces only.
Finally, the difference between CI549 and MI549 is that CI549 is passive cooling while MI549 is active.
That's all! See you.
Reference
Zotac ZBox Comparison 2017
It comes with 2 network interfaces and one Thunderbolt 3 Type-C port which can connect to an adaptor to become another network interface. It also can install up to 32GB DDR4 memory. In my opinion, it can handle up to 1000Mbps bandwidth with low to medium traffic flow even I did not test it at my side at the moment. However, I will purchase one for the test when it is available.
On the other hand, you can install pfsense with suricata plugin on it when Hyperscan is available for FreeBSD or pfsense. pfsense requires 2 network interfaces only.
Finally, the difference between CI549 and MI549 is that CI549 is passive cooling while MI549 is active.
That's all! See you.
Reference
Zotac ZBox Comparison 2017
Tuesday, November 14, 2017
VPN and IPS For Public Wifi
Many friends of mine always asking me how to protect themselves from being hacked. The most asked question is how to protect them from being hacked when using public wifi. They are asking if VPN can do it or not as they saw a lot of advertisement about it.
I recommend them to use their own VPN server with additional protestion, such as Intrusion Detection and Prevention System (IDPS), Next-Generation Firewall or Unified Thread Management System (UTM). It is because most of those products equipped with Anti-Virus/Malware, Exploit prevention and etc. It would be more better and more secure than just use commercial VPN alone.
Open source solutions will be very great for home users and small businesses. I recommend pfsense with suricata and Croissants. pfsense basically is a router and it can install suricata plugin that making it to be an inline IPS. pfsense also have build-in VPN. On the other hand, Croissants is designed for inline IPS and it does not comes with VPN. You need to setup your own.
Once the VPN and IPS are setup, when you are going to use the public wifi, you can connect to the public wifi hotspot and then connect to your VPN which is setup at your home or office. The traffic will be go through the inline IPS via VPN. As a result, you will be under the protection of the IPS. However, the downside is the battery of your mobile device (such as smartphone) will be drained out more quickly. Therefore, you can connect to your VPN when necessary.
Finally, when using pfsense with suricata, you need to fine tune the rules set in order to prevent some false positive alerts. However, Croissants is already tune for daily usage.
Reference
pfsense Official site
Youtube - Build a Router 2016 Q4 -- pfSense Build
pfsense Forum - Suricata true inline IPS mode coming with pfSense 2.3 -- here is a preview
Youtube - pfSense: Network Intrusion Detection w/Suricata (pt4)
Youtube - Suricata Network IDS/IPS System Installation, Setup and How To Tune The Rules & Alerts on pfSense
Croissants - Intrusion Detection and Prevention System
That's all! See you.
I recommend them to use their own VPN server with additional protestion, such as Intrusion Detection and Prevention System (IDPS), Next-Generation Firewall or Unified Thread Management System (UTM). It is because most of those products equipped with Anti-Virus/Malware, Exploit prevention and etc. It would be more better and more secure than just use commercial VPN alone.
Open source solutions will be very great for home users and small businesses. I recommend pfsense with suricata and Croissants. pfsense basically is a router and it can install suricata plugin that making it to be an inline IPS. pfsense also have build-in VPN. On the other hand, Croissants is designed for inline IPS and it does not comes with VPN. You need to setup your own.
Once the VPN and IPS are setup, when you are going to use the public wifi, you can connect to the public wifi hotspot and then connect to your VPN which is setup at your home or office. The traffic will be go through the inline IPS via VPN. As a result, you will be under the protection of the IPS. However, the downside is the battery of your mobile device (such as smartphone) will be drained out more quickly. Therefore, you can connect to your VPN when necessary.
Finally, when using pfsense with suricata, you need to fine tune the rules set in order to prevent some false positive alerts. However, Croissants is already tune for daily usage.
Reference
pfsense Official site
Youtube - Build a Router 2016 Q4 -- pfSense Build
pfsense Forum - Suricata true inline IPS mode coming with pfSense 2.3 -- here is a preview
Youtube - pfSense: Network Intrusion Detection w/Suricata (pt4)
Youtube - Suricata Network IDS/IPS System Installation, Setup and How To Tune The Rules & Alerts on pfSense
Croissants - Intrusion Detection and Prevention System
That's all! See you.
Thursday, August 18, 2016
HOWTO : Hardening and Tuning Ubuntu 16.04 LTS
This guide will lead you to hardening and tuning your Ubuntu 16.04 in a few steps without any expense. As an Information Security Enthusiast, my Ubuntu box is setting up like the following and I use the box every day.
Kernel Hardening and Tuning
Make sure you enabled the "No Execute (NX)" or "Execute Disable (XD)" in the BIOS/UEFI.
To make it looks like the following :
To reload it :
ARP Spoofing
One of the common attacks is Man In The Middle attack. It can use with browser attack too. This guide will help to protect your Ubuntu from being spoofing. Meanwhile, make sure to set ARP related settings in your router if the feature is available. Most home routers have no such feature.
HOWTO : ArpON on Ubuntu 16.04 LTS
Anti-Malware
Most Linux users (including advanced users) misunderstand that Linux will never and impossible to infect with malware. However, it is not true. Almost all operating systems are facing to the threats.
HOWTO : ClamAV 0.99 on Ubuntu 16.04 LTS
This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand".
Storage Performance Tuning
(A) SSD
Verify TRIM is supported :
If the output is similar to the below which is supported :
* Data Set Management TRIM supported (limit 1 block)
If you install your Ubuntu in LVM, the TRIM is usually enabled by default. You can confirm it :
If the output is similar to the below which is enabled :
issue_discards = 1
Then set the following to "deadline" if it is not done yet.
noop [deadline] cfq
If not, set it :
Insert the following before "exit 0" :
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
After that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
/dev/mapper/ubuntu--vg-root / ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
You can add "scsi_mod.use_blk_mq=1" to kernel parameter, such as "/etc/default/grub".
(B) Hard Drive
Insert the following before "exit 0" :
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
After that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
Firefox Hardening and Tuning
Most malicious attacks nowadays are via browsers. Therefore, we need to protect ourselves even we are using Linux.
(A) Apparmor For Firefox
AppArmor is a Linux Security Module implementation of name-based access controls.
To make it looks like the following and it is compatible to Firefox 51.0.1 or later :
Reload the rules :
(B) Firefox Add-ons
NoScript
Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
* You are not required to enable it as it will block the javascript that most modern websites are using. You need to disable it globally to make the XSS attack protection by default.
uBlock Origin (Optional)
Finally, an efficient blocker. Easy on CPU and memory. (Please refer to the official site for details)
WebRTC Control
Have control over WebRTC (disable or enable) and protect your IP address.
BetterPrivacy
Remove or manage a new and uncommon kind of cookies, better known as LSO's.The BetterPrivacy safeguard offers various ways to handle Flash-cookies set by Google, YouTube, Ebay and others...
HTTPS Everywhere
Encrypt the web! HTTPS Everywhere is a Firefox extension to protect your communications by enabling HTTPS encryption automatically on sites that are known to support it, even when you type URLs or follow links that omit the https: prefix.
Speed Tweaks (SpeedyFox)
This extension provides a list to almost all the settings that you may need to alter in order to enhance Firefox's speed.
(C) Optional
(1) Firefox Add-ons :
User-Agent Switcher
The User Agent Switcher extension adds a menu and a toolbar button to switch the user agent of a browser.
Youtube High Definition
YouTube High Definition is a powerful tool that will let you automatically play all YouTube videos in HD (High Definition), turn off annotations, change video player size, auto stop videos, auto mute videos, control embedded videos and much more.
Youtube Flash-Html5
Play YouTube Videos in Flash or HTML5 Player.
(2) Browse with "New Private Window" feature
Finally, you may consider to use Intrusion Detection and Prevention System (IDPS) to protect your network. My project "Almond Croissants" which is an IDPS that can deploy to your network (in front or/and behind the router). Or, you may also consider to use TOR to protect your privacy with my project "NightHawk".
Reference
WebRTC IPS
IP Leak
That's all! See you.
Kernel Hardening and Tuning
Make sure you enabled the "No Execute (NX)" or "Execute Disable (XD)" in the BIOS/UEFI.
sudo nano /etc/sysctl.confTo make it looks like the following :
To reload it :
sudo sysctl -pARP Spoofing
One of the common attacks is Man In The Middle attack. It can use with browser attack too. This guide will help to protect your Ubuntu from being spoofing. Meanwhile, make sure to set ARP related settings in your router if the feature is available. Most home routers have no such feature.
HOWTO : ArpON on Ubuntu 16.04 LTS
Anti-Malware
Most Linux users (including advanced users) misunderstand that Linux will never and impossible to infect with malware. However, it is not true. Almost all operating systems are facing to the threats.
HOWTO : ClamAV 0.99 on Ubuntu 16.04 LTS
This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand".
Storage Performance Tuning
(A) SSD
Verify TRIM is supported :
sudo hdparm -I /dev/sda | grep TRIMIf the output is similar to the below which is supported :
* Data Set Management TRIM supported (limit 1 block)
If you install your Ubuntu in LVM, the TRIM is usually enabled by default. You can confirm it :
cat /etc/lvm/lvm.conf | grep issue_discardsIf the output is similar to the below which is enabled :
issue_discards = 1
Then set the following to "deadline" if it is not done yet.
cat /sys/block/sda/queue/schedulernoop [deadline] cfq
If not, set it :
sudo nano /etc/rc.localInsert the following before "exit 0" :
echo 1024 > /sys/block/sda/queue/read_ahead_kb
echo 1024 > /sys/block/sda/queue/nr_requests
echo deadline > /sys/block/sda/queue/scheduler* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo /etc/rc.localAfter that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
/dev/mapper/ubuntu--vg-root / ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
sudo mount -a
sudo mount -o remount /If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
You can add "scsi_mod.use_blk_mq=1" to kernel parameter, such as "/etc/default/grub".
(B) Hard Drive
sudo nano /etc/rc.localInsert the following before "exit 0" :
echo 1024 > /sys/block/sda/queue/read_ahead_kb
echo 1024 > /sys/block/sda/queue/nr_requests* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo /etc/rc.localAfter that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
sudo mount -a
sudo mount -o remount /If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
Firefox Hardening and Tuning
Most malicious attacks nowadays are via browsers. Therefore, we need to protect ourselves even we are using Linux.
(A) Apparmor For Firefox
AppArmor is a Linux Security Module implementation of name-based access controls.
sudo apt-get update
sudo apt-get install apparmor-utils apparmor-profilessudo nano /etc/apparmor.d/usr.bin.firefoxTo make it looks like the following and it is compatible to Firefox 51.0.1 or later :
sudo rm /etc/apparmor.d/disable/usr.bin.firefoxReload the rules :
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox(B) Firefox Add-ons
NoScript
Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
* You are not required to enable it as it will block the javascript that most modern websites are using. You need to disable it globally to make the XSS attack protection by default.
uBlock Origin (Optional)
Finally, an efficient blocker. Easy on CPU and memory. (Please refer to the official site for details)
WebRTC Control
Have control over WebRTC (disable or enable) and protect your IP address.
BetterPrivacy
Remove or manage a new and uncommon kind of cookies, better known as LSO's.The BetterPrivacy safeguard offers various ways to handle Flash-cookies set by Google, YouTube, Ebay and others...
HTTPS Everywhere
Encrypt the web! HTTPS Everywhere is a Firefox extension to protect your communications by enabling HTTPS encryption automatically on sites that are known to support it, even when you type URLs or follow links that omit the https: prefix.
Speed Tweaks (SpeedyFox)
This extension provides a list to almost all the settings that you may need to alter in order to enhance Firefox's speed.
(C) Optional
(1) Firefox Add-ons :
User-Agent Switcher
The User Agent Switcher extension adds a menu and a toolbar button to switch the user agent of a browser.
Youtube High Definition
YouTube High Definition is a powerful tool that will let you automatically play all YouTube videos in HD (High Definition), turn off annotations, change video player size, auto stop videos, auto mute videos, control embedded videos and much more.
Youtube Flash-Html5
Play YouTube Videos in Flash or HTML5 Player.
(2) Browse with "New Private Window" feature
Finally, you may consider to use Intrusion Detection and Prevention System (IDPS) to protect your network. My project "Almond Croissants" which is an IDPS that can deploy to your network (in front or/and behind the router). Or, you may also consider to use TOR to protect your privacy with my project "NightHawk".
Reference
WebRTC IPS
IP Leak
That's all! See you.
Friday, March 18, 2016
HOWTO : Ubuntu Linux Kernel 4.4.0 (Xenial) on Ubuntu 14.04.4
We can use Linux Kernel 4.4.x on Ubuntu 14.04.4 LTS. Kernel 4.x has a good feature that it can live patching the Kernel without rebooting your box. However, it seems that Ubuntu 14.04.x users need to build the kpatch module themselves. Anyway, it is a good news for all Ubuntu 14.04 LTS users.
Meanwhile, the performance of the box will be improved a lot after the upgrade.
Step 1 :
Step 2 :
Step 3 :
Step 4 :
Step 5 :
Step 6 :
Reboot your box.
REMARK
If you are running Croissants (IPS) on Ubuntu 14.04 LTS, you can upgrade the Kernel to 4.4.0 as well. You just follow the captioned steps.
That's all! See you.
Meanwhile, the performance of the box will be improved a lot after the upgrade.
Step 1 :
sudo apt-get updateStep 2 :
sudo apt-get install linux-generic-lts-xenial linux-headers-generic-lts-xenial linux-image-generic-lts-xenial linux-tools-generic-lts-xenialStep 3 :
sudo apt-get remove linux-image-generic-lts-utopic linux-headers-generic-lts-utopic linux-image-generic-lts-vivid linux-headers-generic-lts-vividStep 4 :
sudo apt-get autoremove
sudo apt-get autocleanStep 5 :
sudo update-grubStep 6 :
Reboot your box.
REMARK
If you are running Croissants (IPS) on Ubuntu 14.04 LTS, you can upgrade the Kernel to 4.4.0 as well. You just follow the captioned steps.
That's all! See you.
Thursday, January 14, 2016
HOWTO : Network Security for Home and SOHO Users
Never think of Intrusion Prevention System (IPS) can be deployed at home or SOHO environment because of expensive cost? I have a good news for you that you can deploy IPS at home or SOHO with a very low price.
Croissants is an Intrusion Detection and Prevention System (IDPS) which is developed by me (Samiux). Its engine is next generation IDPS - Suricata. It is a very high performance engine.
Features of Croissants :
- Plug, Play and Forget!
- Suricata as IDPS Engine which is the Next Generation IDPS
- Based on ET Open rules (can use ET Pro rules with minimal settings)
- Work with ClamAV (Open Source Anti-Virus) MD5 signatures
- Work with LMD (Linux Malware Detect) MD5 signatures
- Work with IP Reputation blacklists
- Work with SSL Certificate blacklist
- Work with Denyhost SSH blacklist
- Work with Advertising Domains blacklist
- Drop certain traffic with minimal settings
- Disable and Enable rules with minimal settings
- Auto update ET Open rules, MD5 signatures and Blacklists
- Data analysis with charts on web interface
- 4K video streaming playback capable
- Can play common online games (but not ideal for playing demanding First Person Shooting games as it may has spikes) Demo videos
Zotac CI323 Nano Plus with Windows 10 equipped with 2 wired network interfaces and 1 wireless interface as well as 4GB RAM and onboard 32GB M.2 SSD.
Zotac CI323 Nano Plus is ideal to install Croissants when you insert extra 4GB RAM or replaced it with two 8GB RAM (total 16GB). I recommend to install 16GB RAM on it for better performance. Meanwhile, you need a wireless router. Croissants (special version for CI323) can be installed on the 32GB M.2 SSD with Ubuntu 14.04 LTS Server previously installed. However, it is better to install to hard drive or SSD drive.
You can get the special version at the following (the current version is 1.0-RELEASE). Please also note that the performance of 16GB version is higher than 8GB version :
8GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-home-ci323-1.0.1-RELEASE.tar.gz
sha256sum - a12f78ae571fa93dce0ee68f383c8b5af39a903ccaac09336dcaf0b9c5fd6278 croissants-home-ci323-1.0.1-RELEASE.tar.gz
16GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-smb-ci323-1.0.1-RELEASE.tar.gz
sha256sum - 759616b21235353953ab363f6ca8f6ecbe05e48a7988b0c771675596045959ba croissants-smb-ci323-1.0.1-RELEASE.tar.gz
Please refer to the Croissants website for the installation procedure. The procedure is similar to standard version of Croissants. Meanwhile, this special version will only keep 60 days data.
Make sure you connect Zotac CI323 between ISP and wireless rotuer and the monitoring cable should be connected to the router or switch (if any).
Before installing Croissants, you need to edit nsm.conf :
WIFI_SSID - The SSID of your wireless router
WIFI_PASSWORD - The password of your wireless router
The default monitoring IP will be x.x.x.180, such as 192.168.1.180.
To extend the security of your network, you may consider to add the following OpenDNS servers to your router.
OpenDNS FamilyShield DNS servers have build-in fraud and phishing protection as well as pre-configured to block adult content :
208.67.222.123
208.67.220.123
OpenDNS Home DNS servers have the captioned features but it can customized what content to be filtered. You can register to OpenDNS Home for the customization or just use the following servers without customization. They all use the following addresses :
208.67.222.222
208.67.220.220
OpenDNS DNS servers are compatible to Croissants.
REFERENCE
5 DNS Services to Block Porn Sites without Installing Software
HOWTO : Hardening and Tuning Ubuntu 14.04 LTS
That's all! See you.
Croissants is an Intrusion Detection and Prevention System (IDPS) which is developed by me (Samiux). Its engine is next generation IDPS - Suricata. It is a very high performance engine.
Features of Croissants :
- Plug, Play and Forget!
- Suricata as IDPS Engine which is the Next Generation IDPS
- Based on ET Open rules (can use ET Pro rules with minimal settings)
- Work with ClamAV (Open Source Anti-Virus) MD5 signatures
- Work with LMD (Linux Malware Detect) MD5 signatures
- Work with IP Reputation blacklists
- Work with SSL Certificate blacklist
- Work with Denyhost SSH blacklist
- Work with Advertising Domains blacklist
- Drop certain traffic with minimal settings
- Disable and Enable rules with minimal settings
- Auto update ET Open rules, MD5 signatures and Blacklists
- Data analysis with charts on web interface
- 4K video streaming playback capable
- Can play common online games (but not ideal for playing demanding First Person Shooting games as it may has spikes) Demo videos
Zotac CI323 Nano Plus with Windows 10 equipped with 2 wired network interfaces and 1 wireless interface as well as 4GB RAM and onboard 32GB M.2 SSD.
Zotac CI323 Nano Plus is ideal to install Croissants when you insert extra 4GB RAM or replaced it with two 8GB RAM (total 16GB). I recommend to install 16GB RAM on it for better performance. Meanwhile, you need a wireless router. Croissants (special version for CI323) can be installed on the 32GB M.2 SSD with Ubuntu 14.04 LTS Server previously installed. However, it is better to install to hard drive or SSD drive.
You can get the special version at the following (the current version is 1.0-RELEASE). Please also note that the performance of 16GB version is higher than 8GB version :
8GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-home-ci323-1.0.1-RELEASE.tar.gz
sha256sum - a12f78ae571fa93dce0ee68f383c8b5af39a903ccaac09336dcaf0b9c5fd6278 croissants-home-ci323-1.0.1-RELEASE.tar.gz
16GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-smb-ci323-1.0.1-RELEASE.tar.gz
sha256sum - 759616b21235353953ab363f6ca8f6ecbe05e48a7988b0c771675596045959ba croissants-smb-ci323-1.0.1-RELEASE.tar.gz
Please refer to the Croissants website for the installation procedure. The procedure is similar to standard version of Croissants. Meanwhile, this special version will only keep 60 days data.
Make sure you connect Zotac CI323 between ISP and wireless rotuer and the monitoring cable should be connected to the router or switch (if any).
Before installing Croissants, you need to edit nsm.conf :
WIFI_SSID - The SSID of your wireless router
WIFI_PASSWORD - The password of your wireless router
The default monitoring IP will be x.x.x.180, such as 192.168.1.180.
To extend the security of your network, you may consider to add the following OpenDNS servers to your router.
OpenDNS FamilyShield DNS servers have build-in fraud and phishing protection as well as pre-configured to block adult content :
208.67.222.123
208.67.220.123
OpenDNS Home DNS servers have the captioned features but it can customized what content to be filtered. You can register to OpenDNS Home for the customization or just use the following servers without customization. They all use the following addresses :
208.67.222.222
208.67.220.220
OpenDNS DNS servers are compatible to Croissants.
REFERENCE
5 DNS Services to Block Porn Sites without Installing Software
HOWTO : Hardening and Tuning Ubuntu 14.04 LTS
That's all! See you.
Friday, October 09, 2015
HOWTO : ClamAV For Suricata
Suricata is an Intrusion Detection and Prevention System and it can work with ClamAV too. One of the features of Suricata is using MD5 hash with the file. We can use ClamAV signature MD5 hash for every file download inspection. We can also save the malicious file for further analysis.
Install and Configure of ClamAV
We will not use ClamAV engine for Suricata but use ClamAV MD5 signature instead.
Prepare ClamAV MD5 Signature for Suricata
Create cron job :
* The cron job will run the script (nsm_clamav_md5) at 0300 hours every day and it should be earlier than the Suricata rules update script/procedure.
Create your Suricata Local Rule
Append the following to the file :
Configure suricata.yaml
Make the following settings as the following :
* If you do not like to save the malicious file for further analysis, you can disable the "file-store" setting at suricata.yaml and remove the "filestore" keyword from the local.rules.
Make It To Work Together
Restart suricata or reboot the box. For Croissants, you can restart the Suricata by issuing the following command :
The Suricata will block the malicious files from downloading when the MD5 hash is matched and the malicious files will be saved at /var/log/suricata/files for further inspection.
Known Issue
libhtp 0.5.x cannot handle the file download re-try with browser at the moment. It is recommended that all users should not re-try to download any file when it cannot be downloaded in the beginning. According to the developer of libhtp, 0.6.x can handle this problem.
Another limitation is that Suricata can detected the malicious files (MD5 hash) that known to ClamAV only.
Reference
Filemd5 and white or black listing with MD5 hashes
That's all! See you.
Install and Configure of ClamAV
sudo apt-get update
sudo apt-get install clamav
sudo update-rc.d clamav-freshclam disableWe will not use ClamAV engine for Suricata but use ClamAV MD5 signature instead.
Prepare ClamAV MD5 Signature for Suricata
sudo nano /usr/bin/nsm_clamav_md5sudo chmod +x /usr/bin/nsm_clamav_md5Create cron job :
sudo crontab -e
0 03 * * * /usr/bin/nsm_clamav_md5* The cron job will run the script (nsm_clamav_md5) at 0300 hours every day and it should be earlier than the Suricata rules update script/procedure.
Create your Suricata Local Rule
sudo nano /etc/suricata/rules/local.rulesAppend the following to the file :
# rules for file extraction
# this rule drop all the file that matches the clamav md5 hash
drop http any any -> any any (msg:"LOCAL Malicious file - Clamav MD5 Hash"; flow:established; filestore; filemd5:blacklist_md5; classtype: suspicious-filename-detect; sid:1000000; rev:1;)Configure suricata.yaml
sudo nano /etc/suricata/suricata.yamlMake the following settings as the following :
* If you do not like to save the malicious file for further analysis, you can disable the "file-store" setting at suricata.yaml and remove the "filestore" keyword from the local.rules.
Make It To Work Together
sudo nsm_clamav_md5Restart suricata or reboot the box. For Croissants, you can restart the Suricata by issuing the following command :
sudo restart suricataThe Suricata will block the malicious files from downloading when the MD5 hash is matched and the malicious files will be saved at /var/log/suricata/files for further inspection.
Known Issue
libhtp 0.5.x cannot handle the file download re-try with browser at the moment. It is recommended that all users should not re-try to download any file when it cannot be downloaded in the beginning. According to the developer of libhtp, 0.6.x can handle this problem.
Another limitation is that Suricata can detected the malicious files (MD5 hash) that known to ClamAV only.
Reference
Filemd5 and white or black listing with MD5 hashes
That's all! See you.
Wednesday, September 16, 2015
HOWTO : Hardening and Tuning Ubuntu 14.04 LTS
This guide will lead you to hardening and tuning your Ubuntu 14.04 in a few steps without any expense. As an Information Security Enthusiast, my Ubuntu box is setting up like the following and I use the box every day.
kernel Hardening and Tuning
Make sure you enabled the "No Execute (NX)" or "Execute Disable (XD)" in the BIOS/UEFI.
To make it looks like the following :
To reload it :
ARP Spoofing
One of the common attacks is Man In The Middle attack. It can use with browser attack too. This guide will help to protect your Ubuntu from being spoofing. Meanwhile, make sure to set ARP related settings in your router if the feature is available. Most home routers have no such feature.
HOWTO : ArpON on Ubuntu 14.04 LTS
Anti-Malware
Most Linux users (including advanced users) misunderstand that Linux will never and impossible to infect with malware. However, it is not ture. Almost all operating systems are similar to the threats.
HOWTO : ClamAV on Ubuntu 14.04 LTS
This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand".
Network Interface Tuning
Insert the following before "exit 0" :
* make sure your NICs are "eth0" and "wlan0" or else
Storage Performance Tuning
(A) SSD
Verify TRIM is supported :
If the output is similar to the below which is supported :
* Data Set Management TRIM supported (limit 1 block)
If you install your Ubuntu in LVM, the TRIM is usually enabled by default. You can confirm it :
If the output is similar to the below which is enabled :
issue_discards = 1
Then set the following to "deadline" if it is not done yet.
noop [deadline] cfq
If not, set it :
Insert the following before "exit 0" :
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
After that, you need to edit the partition table :
To make it looks like the following :
/dev/mapper/ubuntu--vg-root / ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
You can add "scsi_mod.use_blk_mq=1" to kernel parameter, such as "/etc/default/grub".
(B) Hard Drive
Insert the following before "exit 0" :
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
After that, you need to edit the partition table :
To make it looks like the following :
ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
Firefox Hardening and Tuning
Most malicious attacks nowadays are via browsers. Therefore, we need to protect ourselves even we are using Linux.
(A) Apparmor For Firefox
AppArmor is a Linux Security Module implementation of name-based access controls.
To make it looks like the following :
Reload the rules :
(B) Firefox Add-ons
NoScript
Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
* You are not required to enable it as it will block the javascript that most modern websites are using. You need to disable it globally to make the XSS attack protection by default.
uBlock Origin
Finally, an efficient blocker. Easy on CPU and memory. (Please refer to the official site for details)
Cyscon Security Shield
Enjoy enhanced protection from phishing threats and malicious sites while browsing the Internet.
WebRTC Control
Have control over WebRTC (disable or enable) and protect your IP address.
BetterPrivacy
Remove or manage a new and uncommon kind of cookies, better known as LSO's.The BetterPrivacy safeguard offers various ways to handle Flash-cookies set by Google, YouTube, Ebay and others...
HTTPS Everywhere
Encrypt the web! HTTPS Everywhere is a Firefox extension to protect your communications by enabling HTTPS encryption automatically on sites that are known to support it, even when you type URLs or follow links that omit the https: prefix.
Speed Tweaks (SpeedyFox)
This extension provides a list to almost all the settings that you may need to alter in order to enhance Firefox's speed.
ZenMate Security and Privacy VPN
ZenMate secures your browsing with encryption - protecting you from hackers, snoopers and data thieves who prey on unsecure connections.
(C) Optional
(1) Firefox Add-ons :
User-Agent Switcher
The User Agent Switcher extension adds a menu and a toolbar button to switch the user agent of a browser.
Youtube High Definition
YouTube High Definition is a powerful tool that will let you automatically play all YouTube videos in HD (High Definition), turn off annotations, change video player size, auto stop videos, auto mute videos, control embedded videos and much more.
Youtube Flash-Html5
Play YouTube Videos in Flash or HTML5 Player.
(2) Browse with "New Private Window" feature
Finally, you may consider to use Intrusion Detection and Prevention System (IDPS) to protect your network. My project "Croissants" which is an IDPS that can deploy to your network (in front or/and behind the router). Or, you may also consider to use TOR to protect your privacy with my project "NightHawk".
Reference
WebRTC IPS
IP Leak
That's all! See you.
kernel Hardening and Tuning
Make sure you enabled the "No Execute (NX)" or "Execute Disable (XD)" in the BIOS/UEFI.
sudo nano sysctl.confTo make it looks like the following :
To reload it :
sudo sysctl -pARP Spoofing
One of the common attacks is Man In The Middle attack. It can use with browser attack too. This guide will help to protect your Ubuntu from being spoofing. Meanwhile, make sure to set ARP related settings in your router if the feature is available. Most home routers have no such feature.
HOWTO : ArpON on Ubuntu 14.04 LTS
Anti-Malware
Most Linux users (including advanced users) misunderstand that Linux will never and impossible to infect with malware. However, it is not ture. Almost all operating systems are similar to the threats.
HOWTO : ClamAV on Ubuntu 14.04 LTS
This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand".
Network Interface Tuning
sudo nano /etc/rc.localInsert the following before "exit 0" :
/sbin/ifconfig eth0 txqueuelen 10000
/sbin/ifconfig wlan0 txqueuelen 10000* make sure your NICs are "eth0" and "wlan0" or else
Storage Performance Tuning
(A) SSD
Verify TRIM is supported :
sudo hdparm -I /dev/sda | grep TRIMIf the output is similar to the below which is supported :
* Data Set Management TRIM supported (limit 1 block)
If you install your Ubuntu in LVM, the TRIM is usually enabled by default. You can confirm it :
cat /etc/lvm/lvm.conf | grep issue_discardsIf the output is similar to the below which is enabled :
issue_discards = 1
Then set the following to "deadline" if it is not done yet.
cat /sys/block/sda/queue/schedulernoop [deadline] cfq
If not, set it :
sudo nano /etc/rc.localInsert the following before "exit 0" :
echo 1024 > /sys/block/sda/queue/read_ahead_kb
echo 1024 > /sys/block/sda/queue/nr_requests
echo deadline > /sys/block/sda/queue/scheduler* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo /etc/rc.localAfter that, you need to edit the partition table :
To make it looks like the following :
/dev/mapper/ubuntu--vg-root / ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
sudo mount -a
sudo mount -o remount /If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
You can add "scsi_mod.use_blk_mq=1" to kernel parameter, such as "/etc/default/grub".
(B) Hard Drive
sudo nano /etc/rc.localInsert the following before "exit 0" :
echo 1024 > /sys/block/sda/queue/read_ahead_kb
echo 1024 > /sys/block/sda/queue/nr_requests* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo /etc/rc.localAfter that, you need to edit the partition table :
To make it looks like the following :
ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
sudo mount -a
sudo mount -o remount /If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
Firefox Hardening and Tuning
Most malicious attacks nowadays are via browsers. Therefore, we need to protect ourselves even we are using Linux.
(A) Apparmor For Firefox
AppArmor is a Linux Security Module implementation of name-based access controls.
sudo apt-get update
sudo apt-get install apparmor-utils apparmor-profilesTo make it looks like the following :
sudo rm /etc/apparmor.d/disable/usr.bin.firefoxReload the rules :
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox(B) Firefox Add-ons
NoScript
Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
* You are not required to enable it as it will block the javascript that most modern websites are using. You need to disable it globally to make the XSS attack protection by default.
uBlock Origin
Finally, an efficient blocker. Easy on CPU and memory. (Please refer to the official site for details)
Cyscon Security Shield
Enjoy enhanced protection from phishing threats and malicious sites while browsing the Internet.
WebRTC Control
Have control over WebRTC (disable or enable) and protect your IP address.
BetterPrivacy
Remove or manage a new and uncommon kind of cookies, better known as LSO's.The BetterPrivacy safeguard offers various ways to handle Flash-cookies set by Google, YouTube, Ebay and others...
HTTPS Everywhere
Encrypt the web! HTTPS Everywhere is a Firefox extension to protect your communications by enabling HTTPS encryption automatically on sites that are known to support it, even when you type URLs or follow links that omit the https: prefix.
Speed Tweaks (SpeedyFox)
This extension provides a list to almost all the settings that you may need to alter in order to enhance Firefox's speed.
ZenMate Security and Privacy VPN
ZenMate secures your browsing with encryption - protecting you from hackers, snoopers and data thieves who prey on unsecure connections.
(C) Optional
(1) Firefox Add-ons :
User-Agent Switcher
The User Agent Switcher extension adds a menu and a toolbar button to switch the user agent of a browser.
Youtube High Definition
YouTube High Definition is a powerful tool that will let you automatically play all YouTube videos in HD (High Definition), turn off annotations, change video player size, auto stop videos, auto mute videos, control embedded videos and much more.
Youtube Flash-Html5
Play YouTube Videos in Flash or HTML5 Player.
(2) Browse with "New Private Window" feature
Finally, you may consider to use Intrusion Detection and Prevention System (IDPS) to protect your network. My project "Croissants" which is an IDPS that can deploy to your network (in front or/and behind the router). Or, you may also consider to use TOR to protect your privacy with my project "NightHawk".
Reference
WebRTC IPS
IP Leak
That's all! See you.
Monday, July 13, 2015
HOWTO : Performance Test on Croissants
Croissants is an Intrusion Detection and Prevention System and it is running AF_PACKET as inline mode.
Hardware
Croissants :
Motherboard : ASRock Rack C2750D4I server board
CPU : Intel Atom C2750
RAM : 4 x 8GB (32GB) DDR3-1600
The performance of C2750 is similar to Xeon E3-1220L. Please refer to the comparison page at here.
Laptop(A) :
Model : Lenovo Thinkpad X200
RAM : 4 GB
Laptop(B) :
Model : Lenovo Thinkpad X201s
RAM : 8 GB
Software
Croissants
Croissants is installed with nsm_install_4core_16ram (version 0.1.5 dated July 13, 2015).
Laptop(A) and Laptop(B)
Connection
Laptop(A) --- Croissants --- Laptop(B)
Laptop(A) is set to 111.111.111.111 IP address and it is acting as server of iperf.
Laptop(B) is set to 111.111.111.112 IP address and it is acting as client of iperf.
Make sure Laptop(A) and Laptop(B) are pingable.
Performance Test
Croissants
Laptop(A)
Laptop(B)
Result
Crossiants - about 920 Mbps
Laptop(B) - about 820 Mbps
That's all! See you.
Hardware
Croissants :
Motherboard : ASRock Rack C2750D4I server board
CPU : Intel Atom C2750
RAM : 4 x 8GB (32GB) DDR3-1600
The performance of C2750 is similar to Xeon E3-1220L. Please refer to the comparison page at here.
Laptop(A) :
Model : Lenovo Thinkpad X200
RAM : 4 GB
Laptop(B) :
Model : Lenovo Thinkpad X201s
RAM : 8 GB
Software
Croissants
Croissants is installed with nsm_install_4core_16ram (version 0.1.5 dated July 13, 2015).
sudo apt-get update
sudo apt-get install glancesLaptop(A) and Laptop(B)
sudo apt-get update
sudo apt-get install iperfConnection
Laptop(A) --- Croissants --- Laptop(B)
Laptop(A) is set to 111.111.111.111 IP address and it is acting as server of iperf.
Laptop(B) is set to 111.111.111.112 IP address and it is acting as client of iperf.
Make sure Laptop(A) and Laptop(B) are pingable.
Performance Test
Croissants
glancesLaptop(A)
sudo iperf -s -p 80Laptop(B)
sudo iperf -c 111.111.111.111 -p 80 -P 50Result
Crossiants - about 920 Mbps
Laptop(B) - about 820 Mbps
That's all! See you.
Thursday, July 02, 2015
HOWTO : Protect My Home Network With Croissants 2
What is Croissants?
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10Gbps traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low power consumption x86 computer, such as Intel Avoton C2750 Octa-Core CPU with 8GB RAM or more. This CPU is only running at 20W. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use Asrock Rack C2750D4I motherboard with one more Intel Gigabit Desktop LAN card as my IPS.
Since Asrock Rack C2750D4I motherboard comes with 2 network interfaces, I need one more Intel Gigabit Desktop network interface on each box for monitoring purpose.
I installed 32GB RAM and 320GB Hard Drive on each box as IPS.
Internet -- IPS -- router -- IPS -- switch -- PCs and Time Capsule (including web server)How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of Asrock Rack C2750D4I are Intel i210, the name of the interfaces on Ubuntu 14.04 is p119p1 and p121p1. While the Intel Gigabit Desktop network interface is eth0.
Install Ubuntu Server on the Asrock Rack C2750D4I as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables. Then, reboot the box. One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the Intel Gigabit Desktop network interfaces). The p119p1 and p121p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two boxes are in IDS mode. How to enable it to IPS mode?
You may need to change the name of the Intel Gigabit Desktop network interfaces when they are changed unexpected. You can change the name back to eth0 with the following command :
sudo nano /etc/udev/rules.d/70-persistent-net.rulesHow To Configure To IPS?
Log in to the two boxes via ssh or terminal. Then run the following command to configure the DROP rules.
sudo nano /etc/pulledpork/dropsid.confI suggest to append the following lines at the end of the files. They will block most unwanted traffic.
# HTTP request header invalid
1:2221013
# HTTP missing host header
1:2221014
# masscan port scanner
1:2017615,1:2017616
# DOS possible ssdp amplification scan
1:2019102
# DoS attacks -- UDP & ICMP Invalid checksum & packet too small
1:2200075,1:2200038,1:2200076,1:2200024
# IP & TCP Invalid checksum
1:2200073,1:2200074
# TCP packet too small
1:2200033
# stream established retransmission packet before last ack
#1:2210021
# stream established packet out of window
#1:2210020
# GPL attack response id check returned root
1:2100498
# COMPROMISED & DROP & CINS Active Threats
pcre:ET\sCOMPROMISED
pcre:ET\sDROP
pcre:ET\sCINS
# MALWARE, TROJAN, WORM, MOBILE_MALWARE, Amplification DoS, DDoS
pcre:ET\sMALWARE
pcre:ET\sTROJAN
pcre:WORM
pcre:ET\sMOBILE_MALWARE
pcre:ET\sSCAN
#pcre:ET\sSHELLCODE
pcre:Amplification
pcre:ET\sDOS
pcre:ET\sEXPLOIT
pcre:ET\sUSER_AGENTS
pcre:ET\sWEB_SERVER
pcre:GPL\sSNMP
#pcre:SURICATA\sSTREAM
pcre:ET\sCURRENT_EVENTS
pcre:ET\sWEB_SPECIFIC_APPS
# Outgoing basic auth base64 http password
1:2006380
# Quantum Insert Attack (by NSA)
# (SURICATA STREAM reassembly overlap with different data - 2210050)
# (LOCAL QI 302 and possible inject - 12345)
# https://github.com/fox-it/quantuminsert/tree/master/detection/suricata
1:2210050,1:12345
# GPL WEB_SERVER 403 Forbidden
1:2101201
# ET POLICY Suspicious inbound to MSSQL port 1433
1:2010935
# ET POLICY Suspicious inbound to mySQL port 3306
1:2010937
# SURICATA HTTP Host header ambiguous
1:2221015
# ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
1:2016149*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
sudo nano /etc/pulledpork/disablesid.confAppend the following at the end of the file, for example.
# TROJAN 1.1.1.1
1:2017000
# DELETED
pcre:ET\sDELETED
# MOBILE_MALWARE Google Android Device HTTP Request
1:2012251
# MALWARE WhenUClick.com Weather App Checkin (2)
1:2000915
# SURICATA STREAM alerts
#pcre:SURICATA\sSTREAM
# SURICATA STREAM
#1:2210000-1:2210049
#1:2210051-1:2210057
# SURICATA STREAM alert when downloading
1:2210021
1:2210020
1:2210029
1:2210045
1:2200074
1:2210038
1:2210044
# ET CURRENT_EVENTS Possible Dynamic DNS Exploit Pack
1:2014445
# ET WEB_SERVER WebShell
1:2016683
1:2016992
# ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
1:2009207
1:2009205
1:2009208
# ET TROJAN UPX compressed file download possible malware
1:2001046
# ET TROJAN VMProtect Packed Binary Inbound via HTTP
1:2009080
# ET WEB_SERVER Fake Googlebot UA 1 Inbound
#1:2015526After that, you can reload the rules by the following command.
sudo nsm_cronjob_rules_updateor
sudo nsm_rules_updateHow To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
sudo nsm_snorby_db_reinstallIn addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "
/etc/fstab".tmpfs /tmp tmpfs mode=1777,nosuid,nodev,noexec 0 0Then run the following commands before reboot. If you encountered any error, please do not reboot your boxes or you cannot boot them up.
sudo mount -a
sudo mount -o remount /Hope you enjoy your secured home network.
That's all! See you.
Monday, June 22, 2015
HOWTO : Flush IP Address From Network Interface On Ubuntu 14.04.2 LTS Server
I am running Croissants - Intrusion Detection and Prevention System on Ubuntu 14.04.2 LTS Server. Recently Ubuntu update kills the networking features that making no IP address interface to fetch IP address. Even making the interface in promiscuous mode still fetches IP address on that mode. That would drop the performance of the Croissants with more than one IP address with the same subnet in the same system. After try and error, the workaround is as the following.
* where p2p1 and p4p1 are the incoming and outgoing interfaces for Croissants
Create a cron job to flush the ipv4 and ipv6 address on every 15 minutes interval :
Append the following line to the file :
To double check the cron job entry :
The interfaces should be looking like this :
The ipv4 and ipv6 addresses of p2p1 and p4p1 have been deleted.
That's all! See you.
sudo nano /etc/network/flush-ipip addr flush dev p2p1
ip addr flush dev p4p1
ip -6 addr flush dev p2p1
ip -6 addr flush dev p4p1* where p2p1 and p4p1 are the incoming and outgoing interfaces for Croissants
sudo chmod +x /etc/network/flush-ipCreate a cron job to flush the ipv4 and ipv6 address on every 15 minutes interval :
sudo crontab -eAppend the following line to the file :
*/5 * * * * /etc/network/flush-ipTo double check the cron job entry :
sudo crontab -lThe interfaces should be looking like this :
The ipv4 and ipv6 addresses of p2p1 and p4p1 have been deleted.
That's all! See you.
Monday, March 30, 2015
HOWTO : Trouble Shooting for Croissants
There may be a chance that your Croissants not working. We now talking about how to trouble shoot it.
Step 1 :
To see if "
Step 2 :
If you encounter no alert on the Snorby, you can check if the "
If you find more than one
Step 2a :
One more area to check for no alert is at Snorby.
Open the browser and point to the Snorby. "
Step 3 :
If you encounter any error, you can try to reboot the sensor (Croissants) to see if the problem is gone or not.
Step 4 :
To check the suricata.log to see if there is any error.
That's all! See you.
Step 1 :
To see if "
suricata", "pigsty" and "snorby" are working (existing) or not.sudo ps aux | grep suricata
sudo ps aux | grep pigsty
sudo ps aux | grep delayedStep 2 :
If you encounter no alert on the Snorby, you can check if the "
unified2.alert.*" is there. Please also note that it should be only one "unified2.alert.*" file.ls /var/log/suricataIf you find more than one
unified2.alert.*, delete the oldest and keep the current. Or simply delete all and then reboot.Step 2a :
One more area to check for no alert is at Snorby.
Open the browser and point to the Snorby. "
Administration" -- "Worker & Job Queue" is showing "OK" at the "Status".Step 3 :
If you encounter any error, you can try to reboot the sensor (Croissants) to see if the problem is gone or not.
Step 4 :
To check the suricata.log to see if there is any error.
nano /var/log/suricata.logThat's all! See you.
Thursday, March 26, 2015
HOWTO : Protect My Home Network With Croissants
*** THE CURRENT VERSION OF CROISSANTS IS 0.1.2 (CROISSANTS-20150701.TAR.GZ) which is released on July 01, 2015 ***
What is Croissants?
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10GB traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low-end x86 computer, such as Intel ATOM D2550 CPU with 4GB or 8GB RAM. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use MINIX Mini HD PC as my IPS. You can watch its unboxing at YouTube.
Since MINIX Mini HD PC comes with 2 network interfaces, I need one more USB Gigabit Network interface on each box for monitoring purpose. You can either choose Level One USB-0401 USB Gigabit Ethernet Adapter or PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 as they are fully compatible to Linux.
I installed 8GB RAM and 4GB RAM on IPS for experiment purpose. I suggest you to install 8GB RAM as MINIX Mini HD PC supports up to 8GB RAM even the official does not claimed that.
For better performance, I suggest you to use this motherboard with one more Intel LAN card and at least 8 GB RAM.
How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of MINIX Mini HD PC are Broadcom, the name of the interfaces on Ubuntu 14.04 is p2p1 and p4p1. While the USB Gigabit network interface is eth0.
Install Ubuntu Server on the MINIX Mini HD PC as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables and the USB network interface. Then, reboot the MINIX Mini HD PC(s). One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the USB Gigabit network interfaces). The p2p1 and p4p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two MINIX Mini HD PC are in IDS mode. How to enable it to IPS mode?
How To Configure To IPS?
Log in to the MINIX Mini HD PC via ssh or terminal. Then run the following command to configure the DROP rules.
I suggest to append the following lines at the end of the files. They will block most unwanted traffic.
*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
Append the following at the end of the file, for example.
After that, you can reload the rules by the following command.
or
How To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
In addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "
Then run the following commands before reboot. If you encountered any error, please do not reboot your boxes or you cannot boot them up.
Hope you enjoy your secured home network.
That's all! See you.
What is Croissants?
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10GB traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low-end x86 computer, such as Intel ATOM D2550 CPU with 4GB or 8GB RAM. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use MINIX Mini HD PC as my IPS. You can watch its unboxing at YouTube.
Since MINIX Mini HD PC comes with 2 network interfaces, I need one more USB Gigabit Network interface on each box for monitoring purpose. You can either choose Level One USB-0401 USB Gigabit Ethernet Adapter or PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 as they are fully compatible to Linux.
I installed 8GB RAM and 4GB RAM on IPS for experiment purpose. I suggest you to install 8GB RAM as MINIX Mini HD PC supports up to 8GB RAM even the official does not claimed that.
Internet -- IPS -- router -- IPS -- switch -- PCs and Time Capsule (including web server)For better performance, I suggest you to use this motherboard with one more Intel LAN card and at least 8 GB RAM.
How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of MINIX Mini HD PC are Broadcom, the name of the interfaces on Ubuntu 14.04 is p2p1 and p4p1. While the USB Gigabit network interface is eth0.
Install Ubuntu Server on the MINIX Mini HD PC as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables and the USB network interface. Then, reboot the MINIX Mini HD PC(s). One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the USB Gigabit network interfaces). The p2p1 and p4p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two MINIX Mini HD PC are in IDS mode. How to enable it to IPS mode?
How To Configure To IPS?
Log in to the MINIX Mini HD PC via ssh or terminal. Then run the following command to configure the DROP rules.
sudo nano /etc/pulledpork/dropsid.confI suggest to append the following lines at the end of the files. They will block most unwanted traffic.
# HTTP request header invalid
1:2221013
# HTTP missing host header
1:2221014
# masscan port scanner
1:2017615,1:2017616
# DOS possible ssdp amplification scan
1:2019102
# DoS attacks -- UDP & ICMP Invalid checksum & packet too small
1:2200075,1:2200038,1:2200076,1:2200024
# IP & TCP Invalid checksum
1:2200073,1:2200074
# TCP packet too small
1:2200033
# stream established retransmission packet before last ack
#1:2210021
# stream established packet out of window
#1:2210020
# GPL attack response id check returned root
1:2100498
# COMPROMISED & DROP & CINS Active Threats
pcre:ET\sCOMPROMISED
pcre:ET\sDROP
pcre:ET\sCINS
# MALWARE, TROJAN, WORM, MOBILE_MALWARE, Amplification DoS, DDoS
pcre:ET\sMALWARE
pcre:ET\sTROJAN
pcre:WORM
pcre:ET\sMOBILE_MALWARE
pcre:ET\sSCAN
#pcre:ET\sSHELLCODE
pcre:Amplification
pcre:ET\sDOS
pcre:ET\sEXPLOIT
pcre:ET\sUSER_AGENTS
pcre:ET\sWEB_SERVER
pcre:GPL\sSNMP
#pcre:SURICATA\sSTREAM
pcre:ET\sCURRENT_EVENTS
pcre:ET\sWEB_SPECIFIC_APPS
# Outgoing basic auth base64 http password
1:2006380
# Quantum Insert Attack (by NSA)
# (SURICATA STREAM reassembly overlap with different data - 2210050)
# (LOCAL QI 302 and possible inject - 12345)
# https://github.com/fox-it/quantuminsert/tree/master/detection/suricata
1:2210050,1:12345
# GPL WEB_SERVER 403 Forbidden
1:2101201
# ET POLICY Suspicious inbound to MSSQL port 1433
1:2010935
# ET POLICY Suspicious inbound to mySQL port 3306
1:2010937*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
sudo nano /etc/pulledpork/disablesid.confAppend the following at the end of the file, for example.
# TROJAN 1.1.1.1
1:2017000
# DELETED
pcre:ET\sDELETED
# MOBILE_MALWARE Google Android Device HTTP Request
1:2012251
# MALWARE WhenUClick.com Weather App Checkin (2)
1:2000915
# SURICATA STREAM alerts
#pcre:SURICATA\sSTREAM
# SURICATA STREAM
#1:2210000-1:2210049
#1:2210051-1:2210057
# SURICATA STREAM alert when downloading
1:2210021
1:2210020
1:2210029
1:2210045
1:2200074
1:2210038
1:2210044
# ET CURRENT_EVENTS Possible Dynamic DNS Exploit Pack
1:2014445
# ET WEB_SERVER WebShell
1:2016683
1:2016992
# ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
1:2009207
1:2009205
1:2009208
# ET TROJAN UPX compressed file download possible malware
1:2001046
# ET TROJAN VMProtect Packed Binary Inbound via HTTP
1:2009080
# ET WEB_SERVER Fake Googlebot UA 1 Inbound
#1:2015526After that, you can reload the rules by the following command.
sudo nsm_cronjob_rules_updateor
sudo nsm_rules_updateHow To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
sudo nsm_snorby_db_reinstallIn addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "
/etc/fstab".tmpfs /tmp tmpfs mode=1777,nosuid,nodev,noexec 0 0Then run the following commands before reboot. If you encountered any error, please do not reboot your boxes or you cannot boot them up.
sudo mount -a
sudo mount -o remount /Hope you enjoy your secured home network.
That's all! See you.
Monday, May 19, 2014
Croissants - Intrusion Detection and Prevention System
INTRODUCTION
In 2013, I joined the SmoothSec project and modified it to adopt to Intrusion Detection and Prevention System by using Suricata with AF_PACKET. Since SmoothSec 3.4 is developed on Debian 7 (Wheezy), the Linux kernel 3.2.x is too old for Suricata with AF_PACKET. I used the backport kernel to complete the task. However, it makes the system not so easy to maintain.
Meanwhile, the SmoothSec project seems to be dead. The core developer does not active in the project and IRC channel. Therefore, I make up my mind to create a new project namely "Croissants" based on the SmoothSec. Croissants is designed for Ubuntu Server LTS or higher (Long Team Support only) and targeted to work with Suricata on AF_PACKET only. It is an Open Source Project under GPLv3 License by Samiux.
Croissants is a bash script instead of a Linux distribution likes SmoothSec. It downloads and compiles as well as setup the applications almost automatically. It combines with Suricata (IDPS Engine), Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager). It will use the latest verion of the software on every installation but the only drawback is requiring internet.
WHY UBUNTU AND AF_PACKET?
I am a long term user of Ubuntu since 2006 (Ubuntu 6.06). I find that Ubuntu uses newer packages and kernel. Ubuntu can be set to update the system automatically, although you can do it with cron job. It makes the system almost up-to-date in order to avoid some known vulnerabilities attack. Therefore, you can focus on your business and network security monitoring (NSM). Furthermore, Ubuntu is free forever according to the founder, Mark Richard Shuttleworth.
AF_PACKET can be running on a very low-end computer, such as Intel ATOM D2550. The performance of the AF_PACKET is very good under this CPU on my home network. I can watch 720p Youtube video without lagging on my network (10Mbit internet and Gigabit internal network with Untangle UTM and Croissants). The amount of RAM is 8GB on this default setup. However, home router will be lagged while watching 720p Youtube video. This poor performance should be caused by the home router.
WHY CROISSANTS?
Croissants (food) is delicious and common as well as cheap in price. I would like Intrusion Detection and Prevention System is common and cheap in price that everyone can affort.
Croissants can run on a low-end computer such as Intel ATOM D2550 with 3 network interface cards and 4GB RAM. This configuration is ideal for home network and home office. For business, I recommended to have a more high-end multi-core computer and more than 32GB RAM for Croissants with some tuning on Suricata engine.
INSTALLATION
Make sure your computer can access to the internet when installing. Meanwhile, the "automatically update" should also be selected when installing Ubuntu Server. Set the Ubuntu Server LTS to UTC time zone at the end of the setup; otherwise, the time stamp of Snorby (event manager web application) will be incorrect. You are required to install OpenSSH only during the installation of Ubuntu Server.
Download the Croissants from here. Extracts it and runs the script namely "nsm_install" with "sudo". After that, re-cabling the computer when necessary and then reboot. That's all! However, the installation may take hours which is depending on the power of your hardware and the internet speed.
You can even reinstall the Snorby database by running "nsm_snorby_db_reinstall" after the trial run.
When you write some local rules, you can update them to the system by running the script "nsm_rules_update". When you want to update the Ubuntu Server, you can run "update_ubuntu". When updating the Croissants, you can run "update_nsm" which will update the system by compiling from source code that download from the internet. Make sure to run those scripts with "sudo".
In addition, Croissants will update the rules file on every 4 hours automatically.
That's all! See you.
Subscribe to:
Posts (Atom)