LecturesCMC/LinuxNetwork2013/09-SecurityAndTools

Ïîëåçíûå ñåòåâûå óòèëèòû. Èñïîëüçîâàíèå øèôðîâàíèÿ

Ïîëåçíûå óòèëèòû

Íåïîëåçíûå óòèëèòû: rsh è telnet

netcat è äðóãèå

• Ñåðâåð (-l, -p ïîðò) è êëèåíò
• UDP (-u) è unix domain (-U)
• Âñÿêîå: ïàêåòíàÿ îòäà÷à (-i ñåêóíäû), òàéì-àóò (-w ñåêóíäû). socks?

Äðóãèå

• socat

• openssl s_client -connect

wget è äðóãèå

• wget

• curl, lftp, aria2?

tcpdump

• Äîêóìåíòàöèÿ

Ñåòü â VirtualBox

• èíòåðôåéñû è èõ ðåæèìû: NAT, ìîñò, âíóòðåííÿÿ ñåòü, ?
• ðàáîòà ?âíóòðåííåé ñåòè?
• ðàáîòà "NAT" ðåæèìà
• ?ïðîáðîñ ïîðòîâ?

• Ñòåíä: îðãàíèçàöèÿ ñåòè è ïðîáðîñ ïîðòîâ (÷àñòü .ssh/config):

  host    nano
          Hostname localhost
          Port 2210
          HostKeyAlias nano
          User root
  
  host    nanoclient
          Hostname localhost
          Port 2211
          HostKeyAlias nanoclient
          User root

GnuPG

• Ïîäïèñü è øèôðîâàíèå
• äîâåðåííûå è íåäîâåðåííûå êëþ÷è
• ñåòè äîâåðèÿ; ïàäåíèå óðîâíåé äîâåðèÿ

• Êàê ïðîâîäèòü âñòðå÷è äëÿ ïîäïèñè êëþ÷åé GnuPG

Secure Shell, âåëèêèé è ìîãó÷èé

• Øèôðîâàíèå è àóòåíòèôèêàöèÿ
• Êëþ÷ ñåðâåðà è êëþ÷ ïîëüçîâàòåëÿ: èõ ïðèìåíåíèÿ
• Ïåðâîíà÷àëüíûé îáìåí êëþ÷àìè è man-in-the-middle
• Ïðîáðîñ ïîðòîâ ïî çàùèùåííîìó êàíàëó
• SSH-Àãåíò
  • Ïðîáëåìà äîñòóïà ê ssh-àãåíòó, ssh-askpass
• Socks
• ? !

Ä/Ç

Netcat

• Ïîãîâîðèòü ñ ñàìèì ñîáîé ñ ïîìîùüþ netcat:

  [root@uneex ~]# nc -l 12345 
  ?
  [root@uneexclient ~]# nc srv 12345 
  ?

  • Äëÿ òîãî, ÷òîáû çàêðûòü ïîòîê Â/Â, äîñòàòî÷íî íàæàòü "Ctrl+D"

Secure shell

• Çàéòè ñ êëèåíòà íà ñåðâåð ïî ssh, ïî÷èòàòü îòëàäî÷íóþ äèàãíîñòèêó è îáíàðóæèòü òàì èìåíà ôàéëîâ ñ êëþ÷àìè:

  • [root@uneexclient ~]# ssh -v root@srv

• Ñãåíåðèðîâàòü êëþ÷ (çàùèùåííûé êîäîâîé ôðàçîé "123456"):

  • [root@uneexclient ~]# rm -rf /root/.ssh/id_dsa && ssh-keygen -P123456 -t dsa -f /root/.ssh/id_dsa

    • Ïîâòîðÿòü ýòó êîìàíäó äî òåõ ïîð, ïîêà ASCII-àðò îòïå÷àòêà íå ïîêàæåòñÿ êðàñèâûì

    • óäàëèòü ôàéë .ssh/known_hosts è ñíîâà çàéòè íà ñåðâåð. Óâèäåòü äèàëîãThe authenticity of host 'srv (10.30.50.1)' can't be established è â íåì îòïå÷àòîê (îáðàùàþ âíèìàíèå, ÷òî îòâå÷àòü íàäî yes, à íå y).  îòëàäî÷íîé èíôîðìàöèè óâèäåòü, ÷òî ïðåäëîæåííûé êëþ÷ áûë îòâåðãíóò

• Ñêîïèðîâàòü îòêðûòûé êëþ÷ íà ñåðâåð (íàäî áóäåò ââåñòè êîäîâóþ ôðàçó):

  [root@uneexclient ~]# ssh-copy-id srv

  • ssh-copy-id ? ýòî ïðîñòîé ñöåíàðèé, çàïóñòèòü sh -x ssh-copy-id srv è ïîñìîòðåòü, êàêèìè êîìàíäàìè ÷òî êîïèðóåòñÿ

• Åùå ðàç çàéòè íà ñåðâåð (òåïåðü âìåñòî ïàðîëÿ íàäî áóäåò ââîäèòü êîäîâóþ ôðàçó)

• Çàïóñòèòü ssh-àãåíò (îáðàòèòå âíèìàíèå, ÷òî êîìàíäà ssh-agent ãåíåðèðóåò âñå îñòàëüíûå êîìàíäû, èõ ïðîñòî íàäî ñêîïèðîâàòü, è ÷èñëà òàì áóäóò äðóãèå)

  [root@uneexclient ~]# ssh-agent
  SSH_AUTH_SOCK=/root/tmp/ssh-XIglJWV12040/agent.12040; export SSH_AUTH_SOCK;
  SSH_AGENT_PID=12041; export SSH_AGENT_PID;
  [root@uneexclient ~]# SSH_AUTH_SOCK=/root/tmp/ssh-XIglJWV12040/agent.12040; export SSH_AUTH_SOCK;
  [root@uneexclient ~]# SSH_AGENT_PID=12041; export SSH_AGENT_PID;

  • Âìåñòî âñåãî ýòîãî ìîæíî áûëî âûïîëíÿòü òàêóþ êîìàíäó:

  [root@uneexclient ~]# eval `ssh-agent`  

• Äîáàâèòü â íåãî êëþ÷, ïîñìîòðåòü íà êëþ÷ è çàéòè íàêîíåö-òî áåç ïàðîëÿ!

  [root@uneexclient ~]# ssh-add -l
  The agent has no identities.
  [root@uneexclient ~]# ssh-add   
  Enter passphrase for /root/.ssh/id_dsa: 
  Identity added: /root/.ssh/id_dsa (/root/.ssh/id_dsa)
  [root@uneexclient ~]# ssh-add -l
  1024 5c:5f:59:eb:97:ec:e0:fc:f7:18:1f:10:89:dd:f4:90 /root/.ssh/id_dsa (DSA)
  [root@uneexclient ~]# ssh srv
  Last login: Fri Nov 29 14:16:39 2013 from host13.class.altlinux.org

• Ïðîáðîñèòü ïîäêëþ÷åíèå ñ êëèåíòà íà uneex.ru:80 íà ïîðò ñåðâåðà 8001:

  [root@uneexclient ~]# ssh srv -R8001:www.ru:80  
  Last login: Fri Nov 29 14:25:26 2013 from host13.class.altlinux.org
  [root@uneex ~]# netlist | grep 8001
  root     14358 sshd     8 tcp       127.0.0.1:8001          0.0.0.0:0     LISTEN
  [root@uneex ~]# links http://localhost:8001
  ?

  • Ñ ïîìîùüþ tcpdump óáåäèòüñÿ, ÷òî òðàôèê èäåò òàê: ñåðâåð(localhost):8001 ? êëèåíò(ssh-òîííåëü):22 ? www.ru:80

GnuPG

• Èìïîðòèðîâàòü îòêðûòûé GPG-êëþ÷ è ïðîâåðèòü åãî îòïå÷àòîê:

   [root@uneex ~]# rm -rf $HOME/.gnupg
   [root@uneex ~]# gpg --list-keys
   [root@uneex ~]# gpg --recv-keys 7C10D900
   [root@uneex ~]# gpg --fingerprint 
   /root/.gnupg/pubring.gpg
   ------------------------
   pub   1024D/7C10D900 2003-10-17
         Key fingerprint = D01B B410 C69D AE98 8EB0  16F0 E1F0 3D6E 7C10 D900

• Ïðîâåðèòü ïîäïèñü ýòîãî ôàéëà:

  [root@uneex ~]# curl 'https://uneex.ru/LecturesCMC/LinuxNetwork2013/09-SecurityAndTools?action=AttachFile&do=get&target=signed.txt' > signed.txt
  [root@uneex ~]# gpg --verify signed.txt

  • Îáðàòèòå âíèìàíèå, ÷òî êëþ÷ õîòÿ è ïðîâåðåí, íî âû ëè÷íî íå ïîäïèñûâàëè åãî, òàê ÷òî ïðè÷èí äîâåðÿòü åìó íåòó.

• Ñãåíåðèðîâàòü ó÷åáíûé êëþ÷ (ÂÍÈÌÀÍÈÅ!. Ó÷åòíûå äàííûå â ýòîì êëþ÷å ìåíÿòü íå íàäî, îíè èñïîëçóþòñÿ äëÿ ôîðìèðîâàíèÿ îò÷åòà. Âû ìîæåòå íàãåíåðèðîâàòü åùå êëþ÷åé, íî ýòîò íàäî îñòàâèòü).

  [root@uneex ~]# echo "
       Key-Type: DSA
       Key-Length: 1024
       Name-Real: Joe Tester
       Name-Comment: with stupid passphrase
       Name-Email: joe@foo.bar
       Expire-Date: 0
       %commit
  " | gpg --batch --gen-key -

  • Ïðè ïîÿâëåíèè íàäïèñè (åñëè âäðóã) "Not enough random bytes available." ïðèäåòñÿ çàéòè â ñîñåäíþþ êîíñîëü è íàæèìàòü íà âñå ïîäðÿä êëàâèøè êëàâèàòóðû. Â VirtualBox ñ ýíòðîïèåé ïëîõîâàòî.

• Ïîäïèñàòü êëþ÷ 7C10D900 è ñíîâà ïðîâåðèòü ïîäïèñü

  [root@uneex ~]# gpg --sign-key 7C10D900
  ?
  [root@uneex ~]# gpg --verify signed.txt
  ?